Cyber criminals are increasingly looking for ways to abuse the security holes in WordPress and its template library. WordPress is the world’s largest free open-source blogging tool and content management system which drives nearly a quarter of all websites.

A few days ago the company for information security Zscaler published the news about one of criminals recent activity. Reportedly a large number of owners of WordPress based sites recently became a victim of online phishing. Attackers planted false application forms into the WordPress interface. These forms intercepted and saved the entered data and sent them in an encrypted format via e-mail.

Another potential security hole was found by researchers at Sucuri. According to this website vulnerability exists in the icon fonts package Genericons for WordPress. It affects plugins and themes that use this package. According to a WordPress blog post “The Genericons icon font package, which is used in a number of popular themes and plugins, contained an HTML file vulnerable to a cross-site scripting attack.” The vulnerability impacts the JetPack plugin, which has over 1 million active installs, and the TwentyFifteen theme, which you can find installed in WordPress by default.

Update your WordPress to the latest version

WordPress already included the fix for this vulnerability in its security and maintenance release. Computer security experts recommended the installation of this update for all who use WordPress. The latest version 4.2.2. will solve these problems and remove some other bugs and errors.

So, if you haven’t done it yet, upgrade your WordPress to version 4.2.2.

Despite all the “problems” I believe that WordPress will still remain one of the most popular interfaces for processing web content – CMS (content management system). According to the analytical portal W3Tech from the beginning of 2015 more than 23 percent of the most visited Internet sites was powered by WordPress. It is used by the biggest names in the global Internet, such as eBay, Sony, Reuters, TechCrunch and Mashable.