<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>BlogSecurity &#187; WordPress</title>
	<atom:link href="http://blogsecurity.net/category/wordpress/feed" rel="self" type="application/rss+xml" />
	<link>http://blogsecurity.net</link>
	<description>Always something worth reading...</description>
	<lastBuildDate>Tue, 12 Jan 2010 22:00:03 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>WordPress Trackback &lt; 2.8.5 Denial of Service</title>
		<link>http://blogsecurity.net/wordpress/wordpress-trackback-2-8-5-denial-of-service</link>
		<comments>http://blogsecurity.net/wordpress/wordpress-trackback-2-8-5-denial-of-service#comments</comments>
		<pubDate>Tue, 12 Jan 2010 22:00:03 +0000</pubDate>
		<dc:creator>DK</dc:creator>
				<category><![CDATA[Advisories]]></category>
		<category><![CDATA[WordPress]]></category>

		<guid isPermaLink="false">http://blogsecurity.net/?p=603</guid>
		<description><![CDATA[If you are running WordPress &#60; 2.8.5 and finding your blog inaccessible at times this post may be for you.
A denial of vulnerability was released back in Oct 2009 that affects &#60; WordPress 2.8.5. 
The exploit sends a continuous stream of POST requests with overly large blog titles to wp-trackback.php. This could result in the [...]]]></description>
		<wfw:commentRss>http://blogsecurity.net/wordpress/wordpress-trackback-2-8-5-denial-of-service/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Distributed WordPress Password Guessing</title>
		<link>http://blogsecurity.net/wordpress/distributed-wordpress-password-guessing</link>
		<comments>http://blogsecurity.net/wordpress/distributed-wordpress-password-guessing#comments</comments>
		<pubDate>Tue, 08 Dec 2009 23:00:22 +0000</pubDate>
		<dc:creator>DK</dc:creator>
				<category><![CDATA[Advisories]]></category>
		<category><![CDATA[Articles]]></category>
		<category><![CDATA[WordPress]]></category>

		<guid isPermaLink="false">http://blogsecurity.net/?p=589</guid>
		<description><![CDATA[One of The Internet Storm Center readers recently discovered a malicious WordPress hacking script.
The script is nothing more then a password guessing tool. However, what makes it unique &#8212; as pointed out by ISC, is the fact that it uses a MySQL database backend to store password attempts. This means the script could be executed [...]]]></description>
		<wfw:commentRss>http://blogsecurity.net/wordpress/distributed-wordpress-password-guessing/feed</wfw:commentRss>
		<slash:comments>10</slash:comments>
		</item>
		<item>
		<title>WordPress </title>
		<link>http://blogsecurity.net/wordpress/wordpress-2-8-3-reset-admin-password-vulnerability</link>
		<comments>http://blogsecurity.net/wordpress/wordpress-2-8-3-reset-admin-password-vulnerability#comments</comments>
		<pubDate>Tue, 11 Aug 2009 15:02:50 +0000</pubDate>
		<dc:creator>DK</dc:creator>
				<category><![CDATA[Advisories]]></category>
		<category><![CDATA[WordPress]]></category>

		<guid isPermaLink="false">http://blogsecurity.net/?p=578</guid>
		<description><![CDATA[An exploit has been released for all current versions of WordPress including WordPress ]]></description>
		<wfw:commentRss>http://blogsecurity.net/wordpress/wordpress-2-8-3-reset-admin-password-vulnerability/feed</wfw:commentRss>
		<slash:comments>12</slash:comments>
		</item>
		<item>
		<title>WordPress 2.8.3 Fixes Security Holes</title>
		<link>http://blogsecurity.net/wordpress/wordpress-2-8-3-fixes-security-holes</link>
		<comments>http://blogsecurity.net/wordpress/wordpress-2-8-3-fixes-security-holes#comments</comments>
		<pubDate>Tue, 04 Aug 2009 21:43:40 +0000</pubDate>
		<dc:creator>DK</dc:creator>
				<category><![CDATA[Advisories]]></category>
		<category><![CDATA[WordPress]]></category>

		<guid isPermaLink="false">http://blogsecurity.net/?p=571</guid>
		<description><![CDATA[If you haven&#8217;t already done so, we&#8217;d stongly recommend upgrading to WordPress 2.8.3. Also, the WordPress 2.0.x branches are now deprecated (a bit earlier then expected) and will therefore no longer be maintained. [Link]
Unfortunately, I missed some places when fixing the privilege escalation issues for 2.8.1.  Luckily, the entire WordPress community has our backs. [...]]]></description>
		<wfw:commentRss>http://blogsecurity.net/wordpress/wordpress-2-8-3-fixes-security-holes/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>WordPress Plugin DM Albums 1.9.2 vulnerabilities</title>
		<link>http://blogsecurity.net/wordpress/wordpress-plugin-dm-albums-192-vulnerabilities</link>
		<comments>http://blogsecurity.net/wordpress/wordpress-plugin-dm-albums-192-vulnerabilities#comments</comments>
		<pubDate>Wed, 01 Jul 2009 13:33:37 +0000</pubDate>
		<dc:creator>DK</dc:creator>
				<category><![CDATA[Advisories]]></category>
		<category><![CDATA[WordPress]]></category>

		<guid isPermaLink="false">http://blogsecurity.net/?p=559</guid>
		<description><![CDATA[DM Albums™ is an inline photo album/gallery plugin that displays high quality images and thumbnails perfectly sized to your blog.
Two vulnerabilities have been made public:
1. Stack released  a &#8220;remote file disclosure vulnerability&#8221; (Low-Medium Risk Level)
2. Septemb0x released a &#8220;remote file include vulnerability&#8221; (Critical Risk Level)
An attacker could use these vulnerabilities to potentially gain full access [...]]]></description>
		<wfw:commentRss>http://blogsecurity.net/wordpress/wordpress-plugin-dm-albums-192-vulnerabilities/feed</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>WordPress Plugin Related Sites 2.1 Blind SQL Injection Vulnerability</title>
		<link>http://blogsecurity.net/wordpress/wordpress-plugin-related-sites-21-blind-sql-injection-vulnerability</link>
		<comments>http://blogsecurity.net/wordpress/wordpress-plugin-related-sites-21-blind-sql-injection-vulnerability#comments</comments>
		<pubDate>Wed, 01 Jul 2009 13:26:07 +0000</pubDate>
		<dc:creator>DK</dc:creator>
				<category><![CDATA[Advisories]]></category>
		<category><![CDATA[WordPress]]></category>

		<guid isPermaLink="false">http://blogsecurity.net/?p=555</guid>
		<description><![CDATA[A critical vulnerability has been discovered in the WordPress Plugin Related Sites plugin. An exploit is available in the wild and available on Milw0rm, making this attack easier to exploit.
Although, the vulnerability says that version 2.1 is vulnerable. You should assume previous versions are vulnerable as well.
BlogSec have confirmed that the current version (at the [...]]]></description>
		<wfw:commentRss>http://blogsecurity.net/wordpress/wordpress-plugin-related-sites-21-blind-sql-injection-vulnerability/feed</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>WordPress Install Files Security Risk</title>
		<link>http://blogsecurity.net/wordpress/wordpress-install-files-security-risk</link>
		<comments>http://blogsecurity.net/wordpress/wordpress-install-files-security-risk#comments</comments>
		<pubDate>Fri, 08 May 2009 13:35:32 +0000</pubDate>
		<dc:creator>DK</dc:creator>
				<category><![CDATA[News]]></category>
		<category><![CDATA[WordPress]]></category>
		<category><![CDATA[blog]]></category>
		<category><![CDATA[blogs]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://blogsecurity.net/?p=512</guid>
		<description><![CDATA[Jeff Starr over at Perishable Press has discovered a way to hack a WordPress blog in rare cases where the installation files have been left behind and the database is in accessible:

The other day, my server crashed and Perishable Press was unable to connect to the MySQL database. Normally, when WordPress encounters a database error&#8230;
The [...]]]></description>
		<wfw:commentRss>http://blogsecurity.net/wordpress/wordpress-install-files-security-risk/feed</wfw:commentRss>
		<slash:comments>7</slash:comments>
		</item>
		<item>
		<title>WordPress MU &lt; 2.7 Cross Site Scripting Vulnerability</title>
		<link>http://blogsecurity.net/wordpress/wordpress-mu-27-cross-site-scripting-vulnerability</link>
		<comments>http://blogsecurity.net/wordpress/wordpress-mu-27-cross-site-scripting-vulnerability#comments</comments>
		<pubDate>Thu, 19 Mar 2009 08:32:08 +0000</pubDate>
		<dc:creator>DK</dc:creator>
				<category><![CDATA[Advisories]]></category>
		<category><![CDATA[WordPress]]></category>

		<guid isPermaLink="false">http://blogsecurity.net/?p=488</guid>
		<description><![CDATA[Cross Site Scripting Vulnerability
Juan Galiana Lara has released details regarding a vulnerability that affects WordPress MU versions &#60; 2.7.
Version 2.7 is NOT affected according to the advisory. So if you have upgraded to 2.7 you can ignore this advisory.
Vulnerability Details
WordPress MU prior to version 2.7 fails to sanitize the Host header correctly in choose_primary_blog function [...]]]></description>
		<wfw:commentRss>http://blogsecurity.net/wordpress/wordpress-mu-27-cross-site-scripting-vulnerability/feed</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>How to Firewall Your WordPress Blog</title>
		<link>http://blogsecurity.net/wordpress/how-to-firewall-your-wordpress-blog</link>
		<comments>http://blogsecurity.net/wordpress/how-to-firewall-your-wordpress-blog#comments</comments>
		<pubDate>Thu, 05 Mar 2009 10:22:56 +0000</pubDate>
		<dc:creator>DK</dc:creator>
				<category><![CDATA[Articles]]></category>
		<category><![CDATA[WordPress]]></category>
		<category><![CDATA[blog security]]></category>
		<category><![CDATA[wordpress security]]></category>

		<guid isPermaLink="false">http://blogsecurity.net/?p=471</guid>
		<description><![CDATA[You already know to use a decent password for your blog, but brute-force or dictionary attacks aren&#8217;t the only attacks used against bloggers.  It&#8217;s much cheaper and faster to exploit software flaws, and that the hackers do.  A programmer&#8217;s oversight may allow a hacker to gain access to your blog to insert spyware, [...]]]></description>
		<wfw:commentRss>http://blogsecurity.net/wordpress/how-to-firewall-your-wordpress-blog/feed</wfw:commentRss>
		<slash:comments>25</slash:comments>
		</item>
		<item>
		<title>Guvnr 10 Steps to Secure WordPress Video</title>
		<link>http://blogsecurity.net/wordpress/guvnr-10-steps-to-secure-wordpress-video</link>
		<comments>http://blogsecurity.net/wordpress/guvnr-10-steps-to-secure-wordpress-video#comments</comments>
		<pubDate>Tue, 03 Mar 2009 00:29:09 +0000</pubDate>
		<dc:creator>DK</dc:creator>
				<category><![CDATA[News]]></category>
		<category><![CDATA[WordPress]]></category>
		<category><![CDATA[wordpress security]]></category>
		<category><![CDATA[wordpress whitepaper]]></category>

		<guid isPermaLink="false">http://blogsecurity.net/?p=460</guid>
		<description><![CDATA[Guvnr has released a really detailed article securing a blog using our WordPress Security Whitepaper (which is due for an update soon). The article is titled, &#34;10 tips to make wordpress hack proof&#34;. Has a nice ring to it.
In addition to this, Guvnr has put together a very cool video which takes one through the [...]]]></description>
		<wfw:commentRss>http://blogsecurity.net/wordpress/guvnr-10-steps-to-secure-wordpress-video/feed</wfw:commentRss>
		<slash:comments>7</slash:comments>
		</item>
	</channel>
</rss>
