Software Update: WordPress 4.1.2

While development of version 4.2 is nearing completion, an update for WordPress version 4.1 has been released. With this program, which is made available under a GPL license, it is possible to set up and maintain a weblog. WordPress is easy to set up and can be up and running in under five minutes if a server with PHP and MySQL is already available. There are possibilities to further extend the functionality of WordPress, in addition to blogging, and improve the appearance with plugins and themes to adjust. Version 4.1 includes a new default theme. Furthermore, there is an option that makes all toolbars disappear when you enter text, something that should make you concentrate better. Several security vulnerabilities have been fixed in this release.

WordPress 4.1.1 Security Release;

WordPress 4.1.2 is now available. this is a critical security release for all previous versions and we strongly encourage you to update your sites immediately.

WordPress versions 4.1.1 and earlier are affected by a critical cross-site scripting vulnerability, which could enable anonymous users to compromise a site. This was reported by Cedric Van Bockhaven and fixed by Gary Pendergast† Mike Adamsand Andrew Nacino of the WordPress security team.

We also fixed three other security issues:

• In WordPress 4.1 and higher, files with invalid or unsafe names could be uploaded. Discovered by Michael Kapfer and Sebastian Kraemer of HSASec†
• In WordPress 3.9 and higher, a very limited cross-site scripting vulnerability could be used as part of a social engineering attack. Discovered by Jakub Zoczek†
• Some plugins were vulnerable to an SQL injection vulnerability. Discovered by Ben Bidner of the WordPress security team.

We also made four hardening changes, discovered by JD GrimesDivyesh Prajapati, Allan Collins and Marc-Alexandre Montpas†