Return-Path: <1axb4kd6dlw1r4poem5h7loc5h13rqed7jw8ya-help=rommedia.eu@4354010m.wordfence.com>
Delivered-To: help@rommedia.eu
Received: from web05.ouiheberg.com
	by web05.ouiheberg.com with LMTP
	id oGcpBwSoeGUaShEAw70cEg
	(envelope-from <1axb4kd6dlw1r4poem5h7loc5h13rqed7jw8ya-help=rommedia.eu@4354010m.wordfence.com>)
	for <help@rommedia.eu>; Tue, 12 Dec 2023 19:35:48 +0100
Return-path: <1axb4kd6dlw1r4poem5h7loc5h13rqed7jw8ya-help=rommedia.eu@4354010m.wordfence.com>
Envelope-to: help@rommedia.eu
Delivery-date: Tue, 12 Dec 2023 19:35:48 +0100
Received: from bid458m.4354010m.wordfence.com ([158.247.16.68]:48867)
	by web05.ouiheberg.com with esmtps  (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
	(Exim 4.96.2)
	(envelope-from <1axb4kd6dlw1r4poem5h7loc5h13rqed7jw8ya-help=rommedia.eu@4354010m.wordfence.com>)
	id 1rD7bW-004kiv-1T
	for help@rommedia.eu;
	Tue, 12 Dec 2023 19:35:47 +0100
Received: by 172.16.227.89 with SMTP id aybpbz3a1zmnbris8zjnrg1ldbqf0ogo4inhksej;
        Tue, 12 Dec 2023 18:35:04 GMT
DKIM-Signature: v=1; s=hs2; d=4354010m.wordfence.com; 
        i=@4354010m.wordfence.com; 
        h=sender:from:from:reply-to:to:to:cc:cc:subject:subject:list-unsubscribe:form-sub:feedback-id; 
        a=rsa-sha256; c=relaxed/relaxed; 
        bh=eaTyHXPNk5nWPcZKdR2byVxG00xUAEZX5YdEaila+7I=; 
        b=mhBwZyYn0vD2Vy+6u03aW9dQJuHfncueNF8c65JUx16xLdvF6G+P1ym+thOPTg
         YQE7xkuJ3VoD/Zy4uiIWd5J43FMKOI0SVhvPuNPXgQRWEVkfkX64xMKeo6x8Hlt
         JWo61XFgEjmk7ClahROD9QMokTkXhBwSDiTeIQOfM0K4MY5oWdxb1ALyRrQY4/5
         HBfpYKkNbxGyr1S88sxEgITMR0LeaqIgx6/Iw9DBE160iL23vy/BPrcX+Zz+ivE
         ftjfHrkYclV+Las/GdxEkS6sz0uT0sqAvYX4x/JorPFIUbuw2DCeN1o44uPADR6
         pWl3mx+iCEGCaoYqIIFJ+Yo1Y0zA==; q=dns/txt; t=1702406104; 
        x=1702668904;
DKIM-Signature: v=1; s=hs2; d=wordfence.com; i=@wordfence.com; 
        h=sender:from:from:reply-to:to:to:cc:cc:subject:subject:list-unsubscribe:form-sub:feedback-id; 
        a=rsa-sha256; c=relaxed/relaxed; 
        bh=eaTyHXPNk5nWPcZKdR2byVxG00xUAEZX5YdEaila+7I=; 
        b=K7mi/xqQ3JW3YUiNo70YpdJzNDI76wlpOh9zvL3deQVlYPBLXHSExQJqe7YIw7
         /JLGvjDcHUP3awiQNMRVzNmMq1bBWl3wVna53kPTeQV7J+t7fW8ykCRWdQIUfUu
         c1IjaLDvsFQLYbWiFIPhuOoy4W5cKcoWmGZ9UkDANJUNpvfpCsHVnufLut2m3y7
         dv5umkf5fvSuqKEQulvDjkMS4T98It//yz0iTV/NKODJ7WmbwqEAXlqdB3ToM3l
         b6kdzFW9pNIa2qOi8Gx5NtgZ3BirKMzEyWvbANFKC4pkNHg3X5D9VjKbKBrdCy8
         0oVnffHznz5gVeUh7fJUvlHQSwnw==; q=dns/txt; t=1702406104; 
        x=1702668904;
X-HS-Cid: 1axfxjdq30jvmsqu0rgqp050ct6czwy2zpwyaa
List-Unsubscribe: <mailto:1axde1k9yu3o47m1l6cy7ynecod4jsg4nhetm6-help=rommedia.eu@4354010m.wordfence.com?subject=unsubscribe>
Date: Tue, 12 Dec 2023 10:35:04 -0800
From: Wordfence <list@wordfence.com>
Reply-To: no-reply@wordfence.com
To: help@rommedia.eu
Message-ID: <1702404657809.49a14207-05db-45f7-88c3-85da794f9e6c@4354010m.wordfence.com>
Subject: [WordPress Security] Over 100 WordPress Repository Plugins Affected
 by Shortcode-based Stored Cross-Site Scripting
MIME-Version: 1.0
Content-Type: multipart/alternative; 
	boundary="----=_Part_20917128_1451627436.1702406103119"
X-Report-Abuse-To: abuse@hubspot.com (see
 https://policy.hubspot.com/abuse-complaints)
X-Spam-Status: No, score=-0.2
X-Spam-Score: -1
X-Spam-Bar: /
X-Ham-Report: Spam detection software, running on the system "web05.ouiheberg.com",
 has NOT identified this incoming email as spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 root\@localhost for details.
 Content preview:  More than 100 plugins impacted by the same basic cross-site
    scripting vulnerability in shortcodes. Wordfence-Logo.png (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMVWfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FQd3prCCW6N1vHY6lZ3lpW2GqVb22F5BsPW3N70Tm2WxCFwVMDvWq8HlMKqW8F1Wxt5YVMTMW6v1Tng7mk0HYW2F
    [...] 
 Content analysis details:   (-0.2 points, 5.0 required)
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: wordpress.org]
  0.0 URIBL_DBL_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to
                             dbl.spamhaus.org was blocked due to usage
                             of an open resolver. See
                             https://www.spamhaus.org/returnc/pub/
                             [URIs: wordpress.org]
  0.0 RCVD_IN_ZEN_BLOCKED_OPENDNS RBL: ADMINISTRATOR NOTICE: The query
                              to zen.spamhaus.org was blocked due to
                             usage of an open resolver. See
                             https://www.spamhaus.org/returnc/pub/
                             [158.247.16.68 listed in zen.spamhaus.org]
  0.0 URIBL_ZEN_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to
                             zen.spamhaus.org was blocked due to usage
                             of an open resolver. See
                             https://www.spamhaus.org/returnc/pub/
                             [URIs: wordpress.org]
 -0.0 SPF_PASS               SPF: sender matches SPF record
  0.0 T_TVD_FUZZY_SECURITIES BODY: No description available.
  0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or
                             identical to background
  0.0 HTML_MESSAGE           BODY: HTML included in message
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -0.1 DKIM_VALID_EF          Message has a valid DKIM or DK signature from
                             envelope-from domain
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.0 LOTS_OF_MONEY          Huge... sums of money
 -0.0 T_SCC_BODY_TEXT_LINE   No description available.
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
X-Spam-Flag: NO

------=_Part_20917128_1451627436.1702406103119
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

More than 100 plugins impacted by the same basic cross-site scripting vulne=
rability in shortcodes.

Wordfence-Logo.png (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXM=
VWfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FQd3prCCW6N1vHY6lZ3lpW2GqVb22F5BsPW3N7=
0Tm2WxCFwVMDvWq8HlMKqW8F1Wxt5YVMTMW6v1Tng7mk0HYW2FZMwJ2StmjnW4jZzKR5yQBxtW8=
jmXd724zWyzW3nQHQQ4rw3GtW8y0Xxb5K8n2DW2mKsnb1wcd4GW44xL8d5f-FGxW4pmmzX7qzzg=
zW46GS_h6kQ-ycW9jW-Kr12NWQwN1rGXBcLttVxW2PYWNx6-frTvW8646Bm6pn7PbVPszNJ28Fd=
l7V5xyRF3TYj4yN18KJQfm9nYSW5tlXRC4DjgPqf2QjWyY04 )

FeaturedImage_Wordfence_61.02 (https://email.wordfence.com/e3t/Ctc/GC+113/c=
wG7R04/MVXMVWfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FPY5m_5PW69t95C6lZ3mcW4YvsK=
86yzpTYW1jGdZw8xggkHW10htxv17hhWyW6R5NtH37CxJcW64MQ_f81QlM2W1CN2Cv962J4PVvk=
vDR91CnBpW3S4NWf3yXf5BW2Pxp_m25QjxSW7MPqb55tPTtBV3g6jC3Wk4-gW8QJpJ25_1sdSW9=
3DC932rkJkMW2vTcfc6VhX5FW6hcTpK9jtzMmN5nhn8Dd2z8FW6b-wfY101QrgMmV7BB-F0rBW1=
cmysL1Lm5bCW98TFtQ1lVX-3W8VfqMT95QBwFW7TRfKM8GRJH2W1s38jD8PPgzfW93YGhb6PjWY=
MW7Vb-Fn2xr2dvW6cMzM88jHV7PN3229Hq38yM8W5C980W8frLWrVVkRrw5MGdvTN3t_5vGpZH5=
1N4tPjC_v290mW8-rwfL9fWk4JW6Hs9H44HrfYvW32314Y2q_dCCW8fThBY7tGbZQW7fmYW037m=
Y6Vdg1-8804 )

A previous version of this email was sent with an incorrect title. This has=
 been corrected at this time.

=F0=9F=8E=81 Wordfence just launched its bug bounty program. Through Decemb=
er 20th 2023, all researchers will earn 6.25x our normal bounty rates when =
Wordfence handles responsible disclosure for our Holiday Bug Extravaganza! =
Register as a researcher (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R0=
4/MVXMVWfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FQR3prCCW7Y8-PT6lZ3kyVtMKlk8SzPq=
fW48BMNt6dhXYtW7R1PvV8rG-6nW3LnBss5hn1x9W16v3YF2BRqW2W96mJBb2whRN1M3tsKfRJk=
x4W4B_y8R1JK371W2vqXmm8gkt_MW5WsRw72y6sZ6W2fg2cw93RZVpVml9kc4MF5S0W8GZfCm44=
hJ33W24lr4T7tBNGgW9dZq0x2y8NT3W2Jhlql63NXFBW8_CsBv6tmJxFW3ySvF92zY0fbW1wNcK=
W8pk2_PM3Jsbh7fZD6W8cfPS97_zSyLW7wsRLc40vth2W435nc15kcDbvW7tHHXx3C-DwDN8qtG=
B9R_xD9Mv6m7WnCLMXf8-9xxj04 )  and submit your vulnerabilities (https://ema=
il.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMVWfTg7ZW92pV3h7_3C90W3Z50n156-6=
DHN5j5FR63prCCW8wLKSR6lZ3lDW5fQvzS5rgCRLW41hLpb2T8QRNW53nQRS3LmN0KVL5KPB943=
69GW2MGGxk4wBb_VMGzbM0rBwzKW4nRCdC6ZLkg7W5J4Drq6jJDLTW7C0SzL6vqdWtVyZyzT4dX=
rWfW51Y9K82lnJPbW5HzkMl35yf-cW6Mj0xt4YHV20W8t62_g6Bj-pSW4QY-n26hw3CSW7S3D2H=
47B5JkW5nsmH0214P0FW7fdvMz4Nx5rcW7srd0l2Y6-c2W1ygRZ66Px6xZW5QPjK64tRkjtW2cg=
bWd4XqLlcN5NPn9f_zC3hW4Qyy2p6F1Z1gW1WBsRt7jSCG7N11yxcwm7gNrW7nPjmQ2QV5y6W3M=
-BZw7BvsSBf5yXdVz04 )  today! =F0=9F=8E=81

On August 14, 2023, the Wordfence Threat Intelligence team began a research=
 project to find Stored Cross-Site Scripting (XSS) via Shortcode vulnerabil=
ities in WordPress repository plugins. This type of vulnerability enables t=
hreat actors with contributor-level permissions or higher to inject malicio=
us web scripts into pages using plugin shortcodes, which will execute whene=
ver a victim accesses the injected page. We found over 100 vulnerabilities =
across 100 plugins which affect over 6 million sites. You can find the comp=
lete chart of affected plugins below.

All Wordfence Premium (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/M=
VXMVWfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FQR3prCCW7Y8-PT6lZ3lGW4QBYwP1YQHktV=
3vZD922r1ZqV6bszV4Cj7LQW1l1jBg6XqcR5W29npn364qKFvW6WbPXy84T72SW5Gq3yL2fpwjg=
W7fXJ2T8FJtJjW15GkPb93PvTPW70QwBZ8b_PCKW3P-m6V4FZxhKVjJqBX1zc8NwW3QfmtN4tmM=
1zW7R3dHy3_c7LsW8_6FMX76md6dW4Lbpp_7BlHP5VgM0Kx6wNwZYW8Wd7CT5w0knnW4lYWyD5X=
cNRyVfb72H3NwmvrW8MhRnM8_M5jHMz1MXQVjsGtW2Bf9N39lht91W1lR-sb3Lt29dW626p071b=
ld_VW12YTty2V_vmVf2F_2nM04 ) , Wordfence Care (https://email.wordfence.com/=
e3t/Ctc/GC+113/cwG7R04/MVXMVWfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FQR3prCCW7Y=
8-PT6lZ3p9W7jn73g52C8_ZVWHwPL5K5vWlN836vwRHXqqTN5_NzFFplC2YW1HC9Zp7dZ_3HW5P=
H-jG5btTFpW39H9095XPgHhVpMfnf3jmTgdW2SS9lb5S7D41W6Mm-yX5pNY95W6GqDhW8x_7wXW=
5PX0G23qZT7DW9bDpbM8gl5nWW1NhtLt5FlPCNN7Q4JLP9Dt_LN3k_FXczCzHFW6YZGLL1735JY=
W3N4NSR2sWZs1N4zhTgq3HvyQW2kR6Nl1xgFVTW1YzmvF8703LkW726YSX5w0tfrVVKpjh35VNY=
MW6lLXmq7mJncxW23838r2B3pwRN2LfYHx7SWvqf2Sm7ZP04 ) , and Wordfence Response=
 (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMVWfTg7ZW92pV3h7_3C=
90W3Z50n156-6DHN5j5FQR3prCCW7Y8-PT6lZ3p-W3ljqf-995kg8N7mJyfYPMLw_W8TmS2w4y3=
_yfW63qwb55vGdFcW3JqZDZ4kl9y1W2JGg1M21bvhgW6h_04w5jGtzSW1rd2l37KYBQqW4Dp4lP=
1cS46DW8knWgl4sT9F1W753s7c3nllgdM2PVjP24FPgW2CJJ4s5MKdprW5hkCz17bwSfbV5kGQV=
3PNmH_N2WJzmMjX90BW3grQBv3b5VpLN5KpjBNPXG9MN8SGbW6-f-89VmyRvp90YD8_W6V8nSH3=
qLdvcW6_7QSS1RJn5_N2hb5_jK-MYxW10rmLL1RVZZmW5j0M4q8DdPnWW3Pz4gg7YRPf6f1vTc6=
C04 )  customers, as well as those still using the free version of our plug=
in, are protected by the Wordfence firewall=E2=80=99s built-in Cross-Site S=
cripting protection against any exploits targeting this type of vulnerabili=
ty.

CONTINUE READING ON THE BLOG
(https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMVWfTg7ZW92pV3h7_3C9=
0W3Z50n156-6DHN5j5FPY5m_5PW69t95C6lZ3mcW4YvsK86yzpTYW1jGdZw8xggkHW10htxv17h=
hWyW6R5NtH37CxJcW64MQ_f81QlM2W1CN2Cv962J4PVvkvDR91CnBpW3S4NWf3yXf5BW2Pxp_m2=
5QjxSW7MPqb55tPTtBV3g6jC3Wk4-gW8QJpJ25_1sdSW93DC932rkJkMW2vTcfc6VhX5FW6hcTp=
K9jtzMmN5nhn8Dd2z8FW6b-wfY101QrgMmV7BB-F0rBW1cmysL1Lm5bCW98TFtQ1lVX-3W8VfqM=
T95QBwFW7TRfKM8GRJH2W1s38jD8PPgzfW93YGhb6PjWYMW7Vb-Fn2xr2dvW6cMzM88jHV7PN32=
29Hq38yM8W5C980W8frLWrVVkRrw5MGdvTN3t_5vGpZH51N4tPjC_v290mW8-rwfL9fWk4JW6Hs=
9H44HrfYvW32314Y2q_dCCW8fThBY7tGbZQW7fmYW037mY6Vdg1-8804 )

Why are these vulnerabilities so common?

By a general definition, shortcodes are unique macro codes added by plugin =
developers to dynamically and automatically generate content. Developers ca=
n use shortcode attributes to optionally add settings, making the content e=
ven more dynamic and providing more options for users.

It is important to note that shortcodes are typically used in the post cont=
ent on WordPress sites, and the post content input is sanitized before bein=
g saved to the database, which is a WordPress core functionality, so it is =
often sanitized in all cases.

Developers might assume that since WordPress core sanitizes post content, t=
he attributes used in shortcodes are also sanitized and secure. However, th=
e wp_kses_post() sanitization function only sanitizes complete HTML element=
s.

These vulnerabilities occur when the value provided in the shortcode attrib=
ute is output in dynamically generated content within the attributes of an =
HTML element. In such cases, the value specified in the shortcode contains =
only HTML element attributes, which are not sanitized during the save of a =
post. As mentioned earlier, the sanitize function only sanitizes complete H=
TML tags.

An example shortcode containing an HTML tag sanitized by the wp_kses_post()=
 function:

[custom_link class=3D"<p onmouseover=3D'alert(/XSS/)'>Click Here!</p>"]

In this case, wp_kses_post() checks and sanitizes the entire <p> tag and it=
s attributes.

An example shortcode not sanitized by the wp_kses_post() function:

[cutsom_link class=3D"' onmouseover=3D'alert(/XSS/)']

As there is no HTML tag in this case, the wp_kses_post() function does not =
check or sanitize anything.

Note: The above explanation demonstrates the usage of cross-site scripting =
within HTML attributes as it is the most common scenario, but the same prob=
lem applies to JS variable values, which will be equally vulnerable if not =
properly escaped.

Even the WordPress security handbook says the following about escaping outp=
ut:

=E2=80=9CMost WordPress functions properly prepare the data for output, and=
 additional escaping is not needed.=E2=80=9D

https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMVWfTg7ZW92pV3h7_3C90=
W3Z50n156-6DHN5j5FQR3prCCW7Y8-PT6lZ3mlW6WysQd3Tb89lW5nKvQs1cqcGgW4gSpPJ1Z10=
G7W3QVGK64k_1MvW9ct-k73HpLM8W8ySfS78NLTqgW2kRFYW1S5P94W6N9g-X91_SSYVsPbWd6x=
6ddwW23Cl-32rP0npW3Cllg37dsD6LW4VQ6db6rsWsQW532TK692my3GW9j5_mN4nsbwcW5Q61F=
n2MQCr9W3w7zWC4mfry1W2VfjTB82kgDVN5PwdLDn2zyQW50gvKJ3wnLLDW4NnDxk8LcnxSW8_j=
PTf1kyvHjN4tfZlMrWg-1W57McsG3J16fZW4fG1dP1M17xJW6jX8-B3jyt5PW1Q8ltS1Yl9DWf3=
nQ8M804 (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMVWfTg7ZW92p=
V3h7_3C90W3Z50n156-6DHN5j5FQR3prCCW7Y8-PT6lZ3mlW6WysQd3Tb89lW5nKvQs1cqcGgW4=
gSpPJ1Z10G7W3QVGK64k_1MvW9ct-k73HpLM8W8ySfS78NLTqgW2kRFYW1S5P94W6N9g-X91_SS=
YVsPbWd6x6ddwW23Cl-32rP0npW3Cllg37dsD6LW4VQ6db6rsWsQW532TK692my3GW9j5_mN4ns=
bwcW5Q61Fn2MQCr9W3w7zWC4mfry1W2VfjTB82kgDVN5PwdLDn2zyQW50gvKJ3wnLLDW4NnDxk8=
LcnxSW8_jPTf1kyvHjN4tfZlMrWg-1W57McsG3J16fZW4fG1dP1M17xJW6jX8-B3jyt5PW1Q8lt=
S1Yl9DWf3nQ8M804 )

After reading this, developers might reasonably assume that the shortcode a=
ttributes are sanitized and secure. However, as demonstrated in the above e=
xample, there are exceptions.

Vulnerability Summary from Wordfence Intelligence

VIEW IMPACTED PLUGINS ON THE BLOG
(https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMVWfTg7ZW92pV3h7_3C9=
0W3Z50n156-6DHN5j5FPY5m_5PW69t95C6lZ3mcW4YvsK86yzpTYW1jGdZw8xggkHW10htxv17h=
hWyW6R5NtH37CxJcW64MQ_f81QlM2W1CN2Cv962J4PVvkvDR91CnBpW3S4NWf3yXf5BW2Pxp_m2=
5QjxSW7MPqb55tPTtBV3g6jC3Wk4-gW8QJpJ25_1sdSW93DC932rkJkMW2vTcfc6VhX5FW6hcTp=
K9jtzMmN5nhn8Dd2z8FW6b-wfY101QrgMmV7BB-F0rBW1cmysL1Lm5bCW98TFtQ1lVX-3W8VfqM=
T95QBwFW7TRfKM8GRJH2W1s38jD8PPgzfW93YGhb6PjWYMW7Vb-Fn2xr2dvW6cMzM88jHV7PN32=
29Hq38yM8W5C980W8frLWrVVkRrw5MGdvTN3t_5vGpZH51N4tPjC_v290mW8-rwfL9fWk4JW6Hs=
9H44HrfYvW32314Y2q_dCCW8fThBY7tGbZQW7fmYW037mY6Vdg1-8804 )

Security recommendations for developers

We recommend using one of the built-in WordPress escaping functions before =
outputting user data. WordPress has a number of functions that can be used =
for different situations. You can read more about these functions at: https=
://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMVWfTg7ZW92pV3h7_3C90W3Z50=
n156-6DHN5j5FQR3prCCW7Y8-PT6lZ3mlW6WysQd3Tb89lW5nKvQs1cqcGgW4gSpPJ1Z10G7W3Q=
VGK64k_1MvW9ct-k73HpLM8W8ySfS78NLTqgW2kRFYW1S5P94W6N9g-X91_SSYVsPbWd6x6ddwW=
23Cl-32rP0npW3Cllg37dsD6LW4VQ6db6rsWsQW532TK692my3GW9j5_mN4nsbwcW5Q61Fn2MQC=
r9W3w7zWC4mfry1W2VfjTB82kgDVN5PwdLDn2zyQW50gvKJ3wnLLDW4NnDxk8LcnxSW8_jPTf1k=
yvHjN4tfZlMrWg-1W57McsG3J16fZW4fG1dP1M17xJW6jX8-B3jyt5PW1Q8ltS1Yl9DWf3nQ8M8=
04 (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMVWfTg7ZW92pV3h7_=
3C90W3Z50n156-6DHN5j5FQR3prCCW7Y8-PT6lZ3mlW6WysQd3Tb89lW5nKvQs1cqcGgW4gSpPJ=
1Z10G7W3QVGK64k_1MvW9ct-k73HpLM8W8ySfS78NLTqgW2kRFYW1S5P94W6N9g-X91_SSYVsPb=
Wd6x6ddwW23Cl-32rP0npW3Cllg37dsD6LW4VQ6db6rsWsQW532TK692my3GW9j5_mN4nsbwcW5=
Q61Fn2MQCr9W3w7zWC4mfry1W2VfjTB82kgDVN5PwdLDn2zyQW50gvKJ3wnLLDW4NnDxk8LcnxS=
W8_jPTf1kyvHjN4tfZlMrWg-1W57McsG3J16fZW4fG1dP1M17xJW6jX8-B3jyt5PW1Q8ltS1Yl9=
DWf3nQ8M804 )

Technical Analysis #1

A general but fictional shortcode will be used to demonstrate a shortcode X=
SS vulnerability, focusing only on the most important details.

Let=E2=80=99s take an example where shortcode attributes are used as HTML a=
ttributes.

The vulnerable shortcode function:

ray-so-export (16) (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXM=
VWfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FPY5m_5PW69t95C6lZ3mcW4YvsK86yzpTYW1jG=
dZw8xggkHW10htxv17hhWyW6R5NtH37CxJcW64MQ_f81QlM2W1CN2Cv962J4PVvkvDR91CnBpW3=
S4NWf3yXf5BW2Pxp_m25QjxSW7MPqb55tPTtBV3g6jC3Wk4-gW8QJpJ25_1sdSW93DC932rkJkM=
W2vTcfc6VhX5FW6hcTpK9jtzMmN5nhn8Dd2z8FW6b-wfY101QrgMmV7BB-F0rBW1cmysL1Lm5bC=
W98TFtQ1lVX-3W8VfqMT95QBwFW7TRfKM8GRJH2W1s38jD8PPgzfW93YGhb6PjWYMW7Vb-Fn2xr=
2dvW6cMzM88jHV7PN3229Hq38yM8W5C980W8frLWrVVkRrw5MGdvTN3t_5vGpZH51N4tPjC_v29=
0mW8-rwfL9fWk4JW6Hs9H44HrfYvW32314Y2q_dCCW8fThBY7tGbZQW7fmYW037mY6Vdg1-8804=
 )

Let=E2=80=99s take a look at an example where the following shortcode is us=
ed in the post content:

[custom_link class=3D'my-custom-class']Link Text[/custom_link]

As a result, the following link will be displayed in the post:

ray-so-export (17) (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXM=
VWfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FPY5m_5PW69t95C6lZ3mcW4YvsK86yzpTYW1jG=
dZw8xggkHW10htxv17hhWyW6R5NtH37CxJcW64MQ_f81QlM2W1CN2Cv962J4PVvkvDR91CnBpW3=
S4NWf3yXf5BW2Pxp_m25QjxSW7MPqb55tPTtBV3g6jC3Wk4-gW8QJpJ25_1sdSW93DC932rkJkM=
W2vTcfc6VhX5FW6hcTpK9jtzMmN5nhn8Dd2z8FW6b-wfY101QrgMmV7BB-F0rBW1cmysL1Lm5bC=
W98TFtQ1lVX-3W8VfqMT95QBwFW7TRfKM8GRJH2W1s38jD8PPgzfW93YGhb6PjWYMW7Vb-Fn2xr=
2dvW6cMzM88jHV7PN3229Hq38yM8W5C980W8frLWrVVkRrw5MGdvTN3t_5vGpZH51N4tPjC_v29=
0mW8-rwfL9fWk4JW6Hs9H44HrfYvW32314Y2q_dCCW8fThBY7tGbZQW7fmYW037mY6Vdg1-8804=
 )

In this case, the class attribute of the shortcode is used and outputted in=
 the class attribute of the <a> HTML tag.

The Exploit

Now, let=E2=80=99s take a look at a threat actor that wants to inject malic=
ious web scripts into a post using the plugin=E2=80=99s shortcode. To accom=
plish this, the attacker needs to leave the specified HTML attribute, which=
 in the example is the =E2=80=9Cclass=E2=80=9D attribute and add an additio=
nal malicious HTML attribute after.

Here=E2=80=99s an exploit example:

[custom_link class=3D'" onmouseover=3D"alert(/XSS/)']Link Text[/custom_link=
]

With the payload above, the following link will be displayed in the post:

ray-so-export (18) (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXM=
VWfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FPY5m_5PW69t95C6lZ3mcW4YvsK86yzpTYW1jG=
dZw8xggkHW10htxv17hhWyW6R5NtH37CxJcW64MQ_f81QlM2W1CN2Cv962J4PVvkvDR91CnBpW3=
S4NWf3yXf5BW2Pxp_m25QjxSW7MPqb55tPTtBV3g6jC3Wk4-gW8QJpJ25_1sdSW93DC932rkJkM=
W2vTcfc6VhX5FW6hcTpK9jtzMmN5nhn8Dd2z8FW6b-wfY101QrgMmV7BB-F0rBW1cmysL1Lm5bC=
W98TFtQ1lVX-3W8VfqMT95QBwFW7TRfKM8GRJH2W1s38jD8PPgzfW93YGhb6PjWYMW7Vb-Fn2xr=
2dvW6cMzM88jHV7PN3229Hq38yM8W5C980W8frLWrVVkRrw5MGdvTN3t_5vGpZH51N4tPjC_v29=
0mW8-rwfL9fWk4JW6Hs9H44HrfYvW32314Y2q_dCCW8fThBY7tGbZQW7fmYW037mY6Vdg1-8804=
 )

The first double quotation mark provided in the shortcode=E2=80=99s =E2=80=
=9Cclass=E2=80=9D attribute closes the =E2=80=9Cclass=E2=80=9D HTML attribu=
te within the <a> tag. After that the =E2=80=9Conmouseover=E2=80=9D HTML at=
tribute containing a malicious script is added to the <a> tag. This means t=
hat whenever a user mouses over the rendered shortcode, a prompt with =E2=
=80=9CXSS=E2=80=9D would appear on the screen.

The Solution

To make the shortcode secure, escape functions must be used. This prevents =
user-defined input from leaving the original =E2=80=9Cclass=E2=80=9D HTML a=
ttribute as any quotes used to leave the HTML attribute will be escaped.

Let=E2=80=99s make the example shortcode code secure:

ray-so-export (19) (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXM=
VWfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FPY5m_5PW69t95C6lZ3mcW4YvsK86yzpTYW1jG=
dZw8xggkHW10htxv17hhWyW6R5NtH37CxJcW64MQ_f81QlM2W1CN2Cv962J4PVvkvDR91CnBpW3=
S4NWf3yXf5BW2Pxp_m25QjxSW7MPqb55tPTtBV3g6jC3Wk4-gW8QJpJ25_1sdSW93DC932rkJkM=
W2vTcfc6VhX5FW6hcTpK9jtzMmN5nhn8Dd2z8FW6b-wfY101QrgMmV7BB-F0rBW1cmysL1Lm5bC=
W98TFtQ1lVX-3W8VfqMT95QBwFW7TRfKM8GRJH2W1s38jD8PPgzfW93YGhb6PjWYMW7Vb-Fn2xr=
2dvW6cMzM88jHV7PN3229Hq38yM8W5C980W8frLWrVVkRrw5MGdvTN3t_5vGpZH51N4tPjC_v29=
0mW8-rwfL9fWk4JW6Hs9H44HrfYvW32314Y2q_dCCW8fThBY7tGbZQW7fmYW037mY6Vdg1-8804=
 )

The =E2=80=9Cclass=E2=80=9D data is an attribute, so it is recommended to u=
se the esc_attr() function there.

The =E2=80=9Chref=E2=80=9D data is a url, which is an attribute that has mo=
re specific requirements, so it is recommended to use the esc_url() functio=
n there.

The above two functions make the shortcode completely secure against Cross-=
Site Scripting.

If the attacker tries to add a malicious shortcode using the patched functi=
onality, it will result in the following link, which no longer contains exe=
cutable JavaScript:

ray-so-export (20) (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXM=
VWfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FPY5m_5PW69t95C6lZ3mcW4YvsK86yzpTYW1jG=
dZw8xggkHW10htxv17hhWyW6R5NtH37CxJcW64MQ_f81QlM2W1CN2Cv962J4PVvkvDR91CnBpW3=
S4NWf3yXf5BW2Pxp_m25QjxSW7MPqb55tPTtBV3g6jC3Wk4-gW8QJpJ25_1sdSW93DC932rkJkM=
W2vTcfc6VhX5FW6hcTpK9jtzMmN5nhn8Dd2z8FW6b-wfY101QrgMmV7BB-F0rBW1cmysL1Lm5bC=
W98TFtQ1lVX-3W8VfqMT95QBwFW7TRfKM8GRJH2W1s38jD8PPgzfW93YGhb6PjWYMW7Vb-Fn2xr=
2dvW6cMzM88jHV7PN3229Hq38yM8W5C980W8frLWrVVkRrw5MGdvTN3t_5vGpZH51N4tPjC_v29=
0mW8-rwfL9fWk4JW6Hs9H44HrfYvW32314Y2q_dCCW8fThBY7tGbZQW7fmYW037mY6Vdg1-8804=
 )

Technical Analysis #2

Next, let=E2=80=99s look at an example where shortcode attributes are used =
as JS variable values.

The vulnerable shortcode function assigns shortcode attributes to JS variab=
les:

ray-so-export (21) (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXM=
VWfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FPY5m_5PW69t95C6lZ3mcW4YvsK86yzpTYW1jG=
dZw8xggkHW10htxv17hhWyW6R5NtH37CxJcW64MQ_f81QlM2W1CN2Cv962J4PVvkvDR91CnBpW3=
S4NWf3yXf5BW2Pxp_m25QjxSW7MPqb55tPTtBV3g6jC3Wk4-gW8QJpJ25_1sdSW93DC932rkJkM=
W2vTcfc6VhX5FW6hcTpK9jtzMmN5nhn8Dd2z8FW6b-wfY101QrgMmV7BB-F0rBW1cmysL1Lm5bC=
W98TFtQ1lVX-3W8VfqMT95QBwFW7TRfKM8GRJH2W1s38jD8PPgzfW93YGhb6PjWYMW7Vb-Fn2xr=
2dvW6cMzM88jHV7PN3229Hq38yM8W5C980W8frLWrVVkRrw5MGdvTN3t_5vGpZH51N4tPjC_v29=
0mW8-rwfL9fWk4JW6Hs9H44HrfYvW32314Y2q_dCCW8fThBY7tGbZQW7fmYW037mY6Vdg1-8804=
 )

Here=E2=80=99s an example where the following shortcode is used in the post=
 content:

[custom_js_color_variable color=3D'blue']

As a result, the following script with a variable setting for =E2=80=9Ccolo=
r=E2=80=9D will be displayed in the post:

ray-so-export (22) (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXM=
VWfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FPY5m_5PW69t95C6lZ3mcW4YvsK86yzpTYW1jG=
dZw8xggkHW10htxv17hhWyW6R5NtH37CxJcW64MQ_f81QlM2W1CN2Cv962J4PVvkvDR91CnBpW3=
S4NWf3yXf5BW2Pxp_m25QjxSW7MPqb55tPTtBV3g6jC3Wk4-gW8QJpJ25_1sdSW93DC932rkJkM=
W2vTcfc6VhX5FW6hcTpK9jtzMmN5nhn8Dd2z8FW6b-wfY101QrgMmV7BB-F0rBW1cmysL1Lm5bC=
W98TFtQ1lVX-3W8VfqMT95QBwFW7TRfKM8GRJH2W1s38jD8PPgzfW93YGhb6PjWYMW7Vb-Fn2xr=
2dvW6cMzM88jHV7PN3229Hq38yM8W5C980W8frLWrVVkRrw5MGdvTN3t_5vGpZH51N4tPjC_v29=
0mW8-rwfL9fWk4JW6Hs9H44HrfYvW32314Y2q_dCCW8fThBY7tGbZQW7fmYW037mY6Vdg1-8804=
 )

The Exploit

Now, we=E2=80=99ll try to exploit the shortcode:

[custom_js_color_variable color=3D'"; alert(/XSS/); let more=3D"']

As a result, the following script will be displayed in the post:

ray-so-export (23) (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXM=
VWfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FPY5m_5PW69t95C6lZ3mcW4YvsK86yzpTYW1jG=
dZw8xggkHW10htxv17hhWyW6R5NtH37CxJcW64MQ_f81QlM2W1CN2Cv962J4PVvkvDR91CnBpW3=
S4NWf3yXf5BW2Pxp_m25QjxSW7MPqb55tPTtBV3g6jC3Wk4-gW8QJpJ25_1sdSW93DC932rkJkM=
W2vTcfc6VhX5FW6hcTpK9jtzMmN5nhn8Dd2z8FW6b-wfY101QrgMmV7BB-F0rBW1cmysL1Lm5bC=
W98TFtQ1lVX-3W8VfqMT95QBwFW7TRfKM8GRJH2W1s38jD8PPgzfW93YGhb6PjWYMW7Vb-Fn2xr=
2dvW6cMzM88jHV7PN3229Hq38yM8W5C980W8frLWrVVkRrw5MGdvTN3t_5vGpZH51N4tPjC_v29=
0mW8-rwfL9fWk4JW6Hs9H44HrfYvW32314Y2q_dCCW8fThBY7tGbZQW7fmYW037mY6Vdg1-8804=
 )

The Solution

Let=E2=80=99s make the example shortcode code secure:

ray-so-export (24) (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXM=
VWfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FPY5m_5PW69t95C6lZ3mcW4YvsK86yzpTYW1jG=
dZw8xggkHW10htxv17hhWyW6R5NtH37CxJcW64MQ_f81QlM2W1CN2Cv962J4PVvkvDR91CnBpW3=
S4NWf3yXf5BW2Pxp_m25QjxSW7MPqb55tPTtBV3g6jC3Wk4-gW8QJpJ25_1sdSW93DC932rkJkM=
W2vTcfc6VhX5FW6hcTpK9jtzMmN5nhn8Dd2z8FW6b-wfY101QrgMmV7BB-F0rBW1cmysL1Lm5bC=
W98TFtQ1lVX-3W8VfqMT95QBwFW7TRfKM8GRJH2W1s38jD8PPgzfW93YGhb6PjWYMW7Vb-Fn2xr=
2dvW6cMzM88jHV7PN3229Hq38yM8W5C980W8frLWrVVkRrw5MGdvTN3t_5vGpZH51N4tPjC_v29=
0mW8-rwfL9fWk4JW6Hs9H44HrfYvW32314Y2q_dCCW8fThBY7tGbZQW7fmYW037mY6Vdg1-8804=
 )

The =E2=80=9Ccolor=E2=80=9D data is a JS variable, so it is recommended to =
use the esc_js() function.

The following script will be displayed in the post if the attacker tries us=
ing the same malicious shortcode:

ray-so-export (25) (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXM=
VWfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FPY5m_5PW69t95C6lZ3mcW4YvsK86yzpTYW1jG=
dZw8xggkHW10htxv17hhWyW6R5NtH37CxJcW64MQ_f81QlM2W1CN2Cv962J4PVvkvDR91CnBpW3=
S4NWf3yXf5BW2Pxp_m25QjxSW7MPqb55tPTtBV3g6jC3Wk4-gW8QJpJ25_1sdSW93DC932rkJkM=
W2vTcfc6VhX5FW6hcTpK9jtzMmN5nhn8Dd2z8FW6b-wfY101QrgMmV7BB-F0rBW1cmysL1Lm5bC=
W98TFtQ1lVX-3W8VfqMT95QBwFW7TRfKM8GRJH2W1s38jD8PPgzfW93YGhb6PjWYMW7Vb-Fn2xr=
2dvW6cMzM88jHV7PN3229Hq38yM8W5C980W8frLWrVVkRrw5MGdvTN3t_5vGpZH51N4tPjC_v29=
0mW8-rwfL9fWk4JW6Hs9H44HrfYvW32314Y2q_dCCW8fThBY7tGbZQW7fmYW037mY6Vdg1-8804=
 )

Conclusion

In this blog post, we have detailed Stored Shortcode-Based XSS vulnerabilit=
ies within several WordPress repository plugins. This vulnerability allows =
authenticated threat actors with contributor-level permissions or higher to=
 inject malicious web scripts into pages that execute when a user accesses =
an affected page. As with all XSS vulnerabilities, a malicious payload coul=
d be used to perform actions as an administrator, including adding new mali=
cious administrator users to the site and embedding backdoors in plugin and=
 theme files, as well as redirecting users to malicious sites.

We encourage WordPress users to verify that their sites are updated to the =
latest patched version of each impacted plugin. For unpatched plugins that =
have been closed by the WordPress.org security team, we recommend that Word=
Press users delete the affected plugin and look for an alternative solution=
.

All Wordfence users, including those running Wordfence Premium (https://ema=
il.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMVWfTg7ZW92pV3h7_3C90W3Z50n156-6=
DHN5j5FQR3prCCW7Y8-PT6lZ3lGW4QBYwP1YQHktV3vZD922r1ZqV6bszV4Cj7LQW1l1jBg6Xqc=
R5W29npn364qKFvW6WbPXy84T72SW5Gq3yL2fpwjgW7fXJ2T8FJtJjW15GkPb93PvTPW70QwBZ8=
b_PCKW3P-m6V4FZxhKVjJqBX1zc8NwW3QfmtN4tmM1zW7R3dHy3_c7LsW8_6FMX76md6dW4Lbpp=
_7BlHP5VgM0Kx6wNwZYW8Wd7CT5w0knnW4lYWyD5XcNRyVfb72H3NwmvrW8MhRnM8_M5jHMz1MX=
QVjsGtW2Bf9N39lht91W1lR-sb3Lt29dW626p071bld_VW12YTty2V_vmVf2F_2nM04 ) , Wor=
dfence Care (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMVWfTg7Z=
W92pV3h7_3C90W3Z50n156-6DHN5j5FQR3prCCW7Y8-PT6lZ3p9W7jn73g52C8_ZVWHwPL5K5vW=
lN836vwRHXqqTN5_NzFFplC2YW1HC9Zp7dZ_3HW5PH-jG5btTFpW39H9095XPgHhVpMfnf3jmTg=
dW2SS9lb5S7D41W6Mm-yX5pNY95W6GqDhW8x_7wXW5PX0G23qZT7DW9bDpbM8gl5nWW1NhtLt5F=
lPCNN7Q4JLP9Dt_LN3k_FXczCzHFW6YZGLL1735JYW3N4NSR2sWZs1N4zhTgq3HvyQW2kR6Nl1x=
gFVTW1YzmvF8703LkW726YSX5w0tfrVVKpjh35VNYMW6lLXmq7mJncxW23838r2B3pwRN2LfYHx=
7SWvqf2Sm7ZP04 ) , and Wordfence Response (https://email.wordfence.com/e3t/=
Ctc/GC+113/cwG7R04/MVXMVWfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FQR3prCCW7Y8-PT=
6lZ3p-W3ljqf-995kg8N7mJyfYPMLw_W8TmS2w4y3_yfW63qwb55vGdFcW3JqZDZ4kl9y1W2JGg=
1M21bvhgW6h_04w5jGtzSW1rd2l37KYBQqW4Dp4lP1cS46DW8knWgl4sT9F1W753s7c3nllgdM2=
PVjP24FPgW2CJJ4s5MKdprW5hkCz17bwSfbV5kGQV3PNmH_N2WJzmMjX90BW3grQBv3b5VpLN5K=
pjBNPXG9MN8SGbW6-f-89VmyRvp90YD8_W6V8nSH3qLdvcW6_7QSS1RJn5_N2hb5_jK-MYxW10r=
mLL1RVZZmW5j0M4q8DdPnWW3Pz4gg7YRPf6f1vTc6C04 ) , as well as sites still run=
ning the free version of Wordfence, are fully protected against this type o=
f vulnerability.

If you know someone who uses any of these plugins on their site, we recomme=
nd sharing this advisory with them to ensure their site remains secure, as =
this type of vulnerability poses a significant risk.

For security researchers looking to disclose vulnerabilities responsibly an=
d obtain a CVE ID, you can submit your findings to Wordfence Intelligence a=
nd potentially earn a spot on our leaderboard.

Did you know that Wordfence has a Bug Bounty Program (https://email.wordfen=
ce.com/e3t/Ctc/GC+113/cwG7R04/MVXMVWfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FQR3=
prCCW7Y8-PT6lZ3mfW2rtv4y6YfxlmVfgY6X2Fvs3VW7S_K8W1q7bp0MHdk6B7G0xpW4bT_Rc88=
lb4HN1Ys3wgs_cYyVn7mTy4Z6WMlVX6M0S2ywsk9W8K7gQm5FmjWhW66tl4J8TzK6qW8XgPlS3R=
7KDwW4mTcWg3vpP3cW7TNNSb5KXzfGVyk16N9bxGjWW1Y8TNf7f-xZqW7SwG9X9crn_wW10JgLm=
5wQ12wW15mBdB7W560DW8fNJbw1RWCF8W1ntctc5bCF4qVJ4mTm2X9NcDVHWYBp7KLwslVx-5kn=
60QzfMW71b8yf8PPBjHW4712qF2jHFFTW4zgBVx4qPkNSf4lFxQT04 ) ? We=E2=80=99ve re=
cently increased our bounties by 6.25x until December 20th, 2023, with our =
bounties for the most critical vulnerabilities reaching $10,000 USD! If you=
=E2=80=99re an aspiring or current vulnerability researcher, click here to =
sign up. (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMVWfTg7ZW92=
pV3h7_3C90W3Z50n156-6DHN5j5FQR3prCCW7Y8-PT6lZ3kyVtMKlk8SzPqfW48BMNt6dhXYtW7=
R1PvV8rG-6nW3LnBss5hn1x9W16v3YF2BRqW2W96mJBb2whRN1M3tsKfRJkx4W4B_y8R1JK371W=
2vqXmm8gkt_MW5WsRw72y6sZ6W2fg2cw93RZVpVml9kc4MF5S0W8GZfCm44hJ33W24lr4T7tBNG=
gW9dZq0x2y8NT3W2Jhlql63NXFBW8_CsBv6tmJxFW3ySvF92zY0fbW1wNcKW8pk2_PM3Jsbh7fZ=
D6W8cfPS97_zSyLW7wsRLc40vth2W435nc15kcDbvW7tHHXx3C-DwDN8qtGB9R_xD9Mv6m7WnCL=
MXf8-9xxj04 )

The Full Product Lineup

wf-stacked-free-1 (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMV=
WfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FQR3prCCW7Y8-PT6lZ3nXW8Y1rqB2LKLspW1B6f=
6B7b39nHN5cSmZKgzxFfW1k-vcx8jCzgbW8hd2G17Lz1RdW35vGFg4DzwcXN3wqFQyFQpRcW4ZC=
tg_3nd6z8N4cFfPS1RmMXW1tqpw64wF9P_W2k3SXz1tlrwzW4bGnDt4xFyxQW74pfGn27b-pJW4=
cRb9B1xfw1yW8bNb523vrWvcW7N19f77qWb9xW48rmr514q4bGW31zjX66lp402W51ZBhR5lBYy=
XW622ljJ35WKp7W7M4sP26BMcrlW74c47V5N8WBMVh1CRB4v_wwfW1f8fCn5tnNGRVNrYYg16Gy=
mLVqHxnJ7yYXbYf2YMcs404 )

wf-stacked-premium-1 (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MV=
XMVWfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FQR3prCCW7Y8-PT6lZ3mQW1lRSgK5ccqtJW8=
m_7l65NFkLQW4xGZv81l9WBvW55_1nP1d9L0KW8rbGZ81_lF6_W1Lxxmj1TPnzHW60spNp6-VVY=
9W7mpD_H4Qy-_1W222Vq24pryHyW6QQ2_32CfPQwW2hpBs17nwdJHW1zLGf_23P7DHW3m9CMq6Q=
Bqb-W3xNyPV4lWTjbVWpVrS31BZv1W6qs5VP5GW_vJW4dvxzl6c5Yl9W7j5Cb74jvfkwN7mGZC8=
PjqhqW5yFj6G7fwVZHW2YhbhD2cMHnbN4_83qHYjmh-W2dGJ-D5WQKkVW3NfnTb7MhdpkW3drs5=
X8KW1XhVlMwsn8t9pnMf4qLlcz04 )

wf-stacked-care-3 (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMV=
WfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FQR3prCCW7Y8-PT6lZ3pYVw9QHl94szsKW1NhLs=
03PbJMyW3xbqsp95p-mZW3RgFyf8YZH6QN1Kw425BnbNHW1xVCws4TWyNyW8fJ-gn6T2Tg5W6JZ=
vV84Sdq4nW4JXrwz2cRfjsW1_Y6n62WRyL8W5kx6-Q6WdlCbW9ddC9F2zFZGyW65_pC-45RQQ5W=
17CvBs8kBj63N4wJFc5LR6FYW23QKdB8Rj2-7W20lWyz5z5mf4W4DHPFC6M3nCRW6ZM8Yx6xfNS=
tW4gR4kV5jBpVtN1WZrKnrhMp8W4DwyYW2scPnzW94Dbd73wQjgbW8SJ0Z_5dkbMhW6ZTtb783B=
VnBVy3NLk8qFlkZf7z5V3b04 )

wf-stacked-response-2 (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/M=
VXMVWfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FQR3prCCW7Y8-PT6lZ3p-W3ljqf-995kg8N=
7mJyfYPMLw_W8TmS2w4y3_yfW63qwb55vGdFcW3JqZDZ4kl9y1W2JGg1M21bvhgW6h_04w5jGtz=
SW1rd2l37KYBQqW4Dp4lP1cS46DW8knWgl4sT9F1W753s7c3nllgdM2PVjP24FPgW2CJJ4s5MKd=
prW5hkCz17bwSfbV5kGQV3PNmH_N2WJzmMjX90BW3grQBv3b5VpLN5KpjBNPXG9MN8SGbW6-f-8=
9VmyRvp90YD8_W6V8nSH3qLdvcW6_7QSS1RJn5_N2hb5_jK-MYxW10rmLL1RVZZmW5j0M4q8DdP=
nWW3Pz4gg7YRPf6f1vTc6C04 )

wf-stacked-cli (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMVWfT=
g7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FQR3prCCW7Y8-PT6lZ3nwW4dHlvB4wnvt-W4JJ27R2=
1kj7WW8_3gYY7kYjK4VRmhH0966ZfwW3N2Kn29732f0W71LlQK9dd1_QW3Bn3668l6vztW96v7l=
n6-h36lW4l0yW56FWB28VrvmKp1B8Mv1W3bbnw3473LH8W75sX3J7XN7d4W78Mn4980fqLyW5Qm=
LKJ1xnCzPW7VJjyL1KCXk1W636k-q5wqr1dW3jLk1B9j7cNcN3C102f29GlyW1bQhnB58_hhxW8=
Dvbyk4N1t6VW5DjQ5j9jRtQyW8CVn074K-VZvN41tZY57vMVQW7vdd5y9504QJW3MntRp5NtkTf=
W3BGP474b3xLyf1hbTkY04 )

wf-stacked-intelligence (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04=
/MVXMVWfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FQx3prCCW7lCdLW6lZ3ktW6rqBlj3D9Tq=
pW8pzD9F81CqdJW60C8ZH8R0KyjVK88sS8zZPn2W2TSKpm8bDhMvW7t8_Gd1HV0m8W6dP5V9703=
5xwW51QccK2m0SvHW3-G0Hz1xbKdbVvp3Tf6VyR18W3mLzbR5FpQQJW6k439C3-1_WsW3zlGfB5=
KNH5XW927blX1ZGQz8VrvyWC5QrNLHMHccG64vJCWV13JKG1gkR5WV1wT9h46Lx6HW8s70__1df=
vCSW46NSC761rKydW15_Mg27g35KrW1GF5Qj8V814XN8FhckZzG7LFW3yVn_Y2yrLYPf4KkSZY0=
4 )

logo-defiant (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMVWfTg7=
ZW92pV3h7_3C90W3Z50n156-6DHN5j5FQd3prCCW6N1vHY6lZ3mGVthPCS1DMBZ9W644FhF5lgX=
kqW3LRpbl69yhZhW6rN1Mj28bJw1W8yn_z_5Bqyl0W8xMcGF6W6t-xW7fmmP31wdwjMW5xxLbF4=
XQkb8VQZ4yw5XKZG5W2Wvs7y5gXr8bW3RdQXf50lYYBW60C5461QLgJrW8vwXrJ504qcTW127H1=
l6QgmNsW1YqYs37k1MzwW5RkGSS3cz-yBVsF9Yk39mP5NW4V_l0s7lCgTMW2HPLXs3gXjwVW3jw=
YKs14n8MfW3NmysX5n519-N77CgqBHKtp_f6tpr5T04 )

Defiant, Inc., 1700 Westlake Ave N STE 200

Seattle, WA  98109 United States

Unsubscribe (https://email.wordfence.com/hs/manage-preferences/unsubscribe-=
all?languagePreference=3Den&d=3DVnbshC892TtnVCnbkg45v0QyW3_X4wv3SXQ-tW4h29f=
m6J4V3WVmWcPn6Wq6D9N6TK9Lv25CRQW8H-j1P7F0kT0W5kngBL7c4317V1yf0N30ghpMW6W_cJ=
S1YtzpfW62tmL67JhQyV23W3&v=3D3&_hsenc=3Dp2ANqtz-9GjjX34-g2PC3XNw7Q2AnlOL27e=
inCYeAm8ISkt6fWYQFXPeTYOEg575rFIkw68NUEni2k25XfLY9FgJx-Di6dpP1A0g&_hsmi=3D2=
86209999 ) Manage Preferences (https://email.wordfence.com/hs/manage-prefer=
ences/unsubscribe?languagePreference=3Den&d=3DVnbshC892TtnVCnbkg45v0QyW3_X4=
wv3SXQ-tW4h29fm6J4V3WVmWcPn6Wq6D9N6TK9Lv25CRQW8H-j1P7F0kT0W5kngBL7c4317V1yf=
0N30ghpMW6W_cJS1YtzpfW62tmL67JhQyV23W3&v=3D3&_hsenc=3Dp2ANqtz-9GjjX34-g2PC3=
XNw7Q2AnlOL27einCYeAm8ISkt6fWYQFXPeTYOEg575rFIkw68NUEni2k25XfLY9FgJx-Di6dpP=
1A0g&_hsmi=3D286209999 )

ISO_27001 (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMVWfTg7ZW9=
2pV3h7_3C90W3Z50n156-6DHN5j5FQd3prCCW6N1vHY6lZ3m9W47XfMC7Rhg68W3XrHX-2ZS5V2=
W2G7LDb8hT_XYW6j2fSz6MNv46W4sSWl95wH1HbW23fzKh8JXwgWVYX60f2jyBXrW7mf6D04YxF=
sMW7qsVVN5FFRnKW8flG9Y4M8FTMN21xZdlp1_15F6FwJgcbZ0FVjv_Xx7Kj65pVh3QBm87sB3z=
N16pWsg_Q3wJW155QP65YVcd3W1kYB633Nml1RW6nSsF_19x8ChW6wCnBD5x9DzPW4qj8wQ5nym=
nJW47_RlD60jH2DW8pYr892N6mr-f7smgSF04 )

You're receiving this email because you signed up to the Wordfence WordPres=
s security mailing list.
------=_Part_20917128_1451627436.1702406103119
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional //EN" "http://www=
.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns=3D"http://www.w3=
.org/1999/xhtml" xmlns:o=3D"urn:schemas-microsoft-com:office:office" xmlns:=
v=3D"urn:schemas-microsoft-com:vml" lang=3D"en"><head>
    <title>[WordPress Security] Over 100 WordPress Repository Plugins Affec=
ted by Shortcode-based Stored Cross-Site Scripting</title>
    <meta property=3D"og:title" content=3D"[WordPress Security] Over 100 Wo=
rdPress Repository Plugins Affected by Shortcode-based Stored Cross-Site Sc=
ripting">
    <meta name=3D"twitter:title" content=3D"[WordPress Security] Over 100 W=
ordPress Repository Plugins Affected by Shortcode-based Stored Cross-Site S=
cripting">
   =20
   =20
   =20
<meta name=3D"x-apple-disable-message-reformatting">
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DUTF-8">
<meta http-equiv=3D"X-UA-Compatible" content=3D"IE=3Dedge">
<meta name=3D"viewport" content=3D"width=3Ddevice-width, initial-scale=3D1.=
0">
    <!--[if gte mso 9]>
  <xml>
      <o:OfficeDocumentSettings>
      <o:AllowPNG/>
      <o:PixelsPerInch>96</o:PixelsPerInch>
      </o:OfficeDocumentSettings>
  </xml>
 =20
  <style>
    ul > li {
      text-indent: -1em;
    }
  </style>
<![endif]-->
<!--[if mso]>
<style type=3D"text/css">
 body, td {font-family: Arial, Helvetica, sans-serif;}
 .hse-body-wrapper-table {background-color: #FFFFFF;padding: 20px 0 !import=
ant}
</style>
<![endif]-->
   =20
     =20
   =20
  <meta name=3D"generator" content=3D"HubSpot"><meta property=3D"og:url" co=
ntent=3D"https://email.wordfence.com/-temporary-slug-6303995e-2a4e-4e87-bcd=
c-2f50d6bcc45e"><meta name=3D"robots" content=3D"noindex,follow"><!--[if !(=
(mso)|(IE))]><!-- --><style type=3D"text/css">.moz-text-html .hse-column-co=
ntainer{max-width:600px !important;width:600px !important}
.moz-text-html .hse-column{display:table-cell;vertical-align:top}.moz-text-=
html .hse-section .hse-size-4{max-width:200px !important;width:200px !impor=
tant}
.moz-text-html .hse-section .hse-size-8{max-width:400px !important;width:40=
0px !important}
.moz-text-html .hse-section .hse-size-12{max-width:600px !important;width:6=
00px !important}
@media only screen and (min-width:640px){.hse-column-container{max-width:60=
0px !important;width:600px !important}
.hse-column{display:table-cell;vertical-align:top}.hse-section .hse-size-4{=
max-width:200px !important;width:200px !important}
.hse-section .hse-size-8{max-width:400px !important;width:400px !important}=
.hse-section .hse-size-12{max-width:600px !important;width:600px !important=
}
}@media only screen and (max-width:639px){img.stretch-on-mobile,.hs_rss_ema=
il_entries_table img,.hs-stretch-cta .hs-cta-img{height:auto !important;wid=
th:100% !important}
.display_block_on_small_screens{display:block}.hs_padded{padding-left:20px =
!important;padding-right:20px !important}
ul,blockquote{margin:0;padding:1em 40px} }</style><!--<![endif]--><style ty=
pe=3D"text/css">#hs_body #hs_cos_wrapper_main a[x-apple-data-detectors]{col=
or:inherit !important;text-decoration:none !important;font-size:inherit !im=
portant;font-family:inherit !important;font-weight:inherit !important;line-=
height:inherit !important}
a{text-decoration:underline}p{margin:0}body{-ms-text-size-adjust:100%;-webk=
it-text-size-adjust:100%;-webkit-font-smoothing:antialiased;moz-osx-font-sm=
oothing:grayscale}</style></head>
  <body id=3D"hs_body" bgcolor=3D"#FFFFFF" style=3D"margin:0 !important; pa=
dding:0 !important; font-family:Arial, sans-serif; font-size:15px; color:#5=
25355; word-break:break-word">
    <div id=3D"preview_text" style=3D"display:none;font-size:1px;color:#FFF=
FFF;line-height:1px;max-height:0px;max-width:0px;opacity:0;overflow:hidden;=
">More than 100 plugins impacted by the same basic cross-site scripting vul=
nerability in shortcodes.</div>
   =20
<!--[if gte mso 9]>
<v:background xmlns:v=3D"urn:schemas-microsoft-com:vml" fill=3D"t">
    <v:fill type=3D"tile" size=3D"100%,100%" color=3D"#ffffff"/>
</v:background>
<![endif]-->
    <div class=3D"hse-body-background" style=3D"background-color:#ffffff" b=
gcolor=3D"#ffffff">
      <table role=3D"presentation" class=3D"hse-body-wrapper-table" cellpad=
ding=3D"0" cellspacing=3D"0" style=3D"border-spacing:0 !important; border-c=
ollapse:collapse; mso-table-lspace:0pt; mso-table-rspace:0pt; margin:0; pad=
ding:0; width:100% !important; min-width:320px !important; height:100% !imp=
ortant" width=3D"100%" height=3D"100%">
        <tbody><tr>
          <td class=3D"hse-body-wrapper-td" valign=3D"top" style=3D"border-=
collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans-se=
rif; font-size:15px; color:#525355; word-break:break-word">
            <div id=3D"hs_cos_wrapper_main" class=3D"hs_cos_wrapper hs_cos_=
wrapper_widget hs_cos_wrapper_type_dnd_area" style=3D"color: inherit; font-=
size: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" d=
ata-hs-cos-type=3D"dnd_area">  <div id=3D"section-0" class=3D"hse-section h=
se-section-first" style=3D"padding-left:10px; padding-right:10px; padding-t=
op:20px">
   =20
   =20
    <!--[if !((mso)|(IE))]><!-- -->
      <div class=3D"hse-column-container hse-border hse-border-top" style=
=3D"min-width:280px; max-width:600px; Margin-left:auto; Margin-right:auto; =
border-collapse:collapse; border-spacing:0; border-left:0px solid #008cc1; =
border-right:0px solid #008cc1; box-sizing:border-box; border-top:0px solid=
 #008cc1; background-color:#FFFFFF" bgcolor=3D"#FFFFFF">
    <!--<![endif]-->
   =20
    <!--[if (mso)|(IE)]>
      <div class=3D"hse-column-container" style=3D"min-width:280px;max-widt=
h:600px;width:100%;Margin-left:auto;Margin-right:auto;border-collapse:colla=
pse;border-spacing:0;">
      <table align=3D"center" style=3D"border-collapse:collapse;mso-table-l=
space:0pt;mso-table-rspace:0pt;width:600px;border-left:0px solid #008CC1;bo=
rder-right:0px solid #008CC1;border-top:0px solid #008CC1" cellpadding=3D"0=
" cellspacing=3D"0" role=3D"presentation" class=3D"hse-border hse-border-to=
p" width=3D"600" bgcolor=3D"#FFFFFF">
      <tr style=3D"background-color:#FFFFFF;">
    <![endif]-->
    <!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:600px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"600" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:600px">
<![endif]-->
<div id=3D"column-0-0" class=3D"hse-column hse-size-12">
  <div id=3D"hs_cos_wrapper_module-0-0-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMV=
WfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FQd3qgyTW6N1vHY6lZ3lbW4c_3tZ43N-jXN4-lM=
WZWfrThW51z6VQ76WlYsW11zRxW5j0Ng_W8xVCN-22HX3kW4GN2cG6zbQv6V45fg_8kYjrQW2qs=
B4H6Gx-6LW5ZM-Fr2WY5xbW7pS16N69whWhW3Zz2RJ65lfxlW2L1-k75QpBfgW8Hlk-k2MZc7qW=
7DW0rQ2hjJ7jW5jgkXC6DgWd7W7NPnDk7QNxwDW4s8z6r3M3hTZW78H9pQ55c1XlW6CK1pf8S5m=
l7W3w7vRf6qXcH9W5bVvj2234XvrW8Dc14d9cmwMJf6WH30-04" target=3D"_blank" style=
=3D"color:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"0">
        <img alt=3D"Wordfence-Logo.png" src=3D"https://email.wordfence.com/=
hs-fs/hubfs/Logos/Wordfence-Logo.png.png?width=3D600&amp;upscale=3Dtrue&amp=
;name=3DWordfence-Logo.png.png" style=3D"outline:none; text-decoration:none=
; -ms-interpolation-mode:bicubic; border:none; max-width:100%; font-size:16=
px" width=3D"300" align=3D"middle" srcset=3D"https://email.wordfence.com/hs=
-fs/hubfs/Logos/Wordfence-Logo.png.png?upscale=3Dtrue&amp;width=3D600&amp;u=
pscale=3Dtrue&amp;name=3DWordfence-Logo.png.png 300w, https://email.wordfen=
ce.com/hs-fs/hubfs/Logos/Wordfence-Logo.png.png?upscale=3Dtrue&amp;width=3D=
1200&amp;upscale=3Dtrue&amp;name=3DWordfence-Logo.png.png 600w" sizes=3D"(m=
ax-width: 300px) 100vw, 300px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
    <!--[if (mso)|(IE)]></tr></table><![endif]-->
    </div>
  =20
  </div>
  <div id=3D"section-1" class=3D"hse-section" style=3D"padding-left:10px; p=
adding-right:10px">
   =20
   =20
    <!--[if !((mso)|(IE))]><!-- -->
      <div class=3D"hse-column-container hse-border" style=3D"min-width:280=
px; max-width:600px; Margin-left:auto; Margin-right:auto; border-collapse:c=
ollapse; border-spacing:0; border-left:0px solid #008cc1; border-right:0px =
solid #008cc1; box-sizing:border-box; background-color:#FFFFFF" bgcolor=3D"=
#FFFFFF">
    <!--<![endif]-->
   =20
    <!--[if (mso)|(IE)]>
      <div class=3D"hse-column-container" style=3D"min-width:280px;max-widt=
h:600px;width:100%;Margin-left:auto;Margin-right:auto;border-collapse:colla=
pse;border-spacing:0;">
      <table align=3D"center" style=3D"border-collapse:collapse;mso-table-l=
space:0pt;mso-table-rspace:0pt;width:600px;border-left:0px solid #008CC1;bo=
rder-right:0px solid #008CC1" cellpadding=3D"0" cellspacing=3D"0" role=3D"p=
resentation" class=3D"hse-border" width=3D"600" bgcolor=3D"#FFFFFF">
      <tr style=3D"background-color:#FFFFFF;">
    <![endif]-->
    <!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:600px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"600" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:600px">
<![endif]-->
<div id=3D"column-1-0" class=3D"hse-column hse-size-12">
  <div id=3D"hs_cos_wrapper_module-1-0-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMV=
WfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FPY5nR32W69t95C6lZ3pJW2gQj_68kbvsXW640j=
sf4W7H2MVW4JJC6KkKV_W5WN0xG6NTJCCN2p6bk7wCgq8W5tVPv441-DfvW5SfRvf1DFJ7XVVr9=
fk4j86DRW1MT6zH2McYVgW8YDKBx6L1GyZW3K4j2N98BhV1W27YVCc48yJv9W4Cn_vr78VVgbW2=
jbXsJ5p77vLW5gprzh8J5YM0W2xydYP3GxcMVW2slM4x1lrRx1W3tt8Ym7wsZbVW5YnGL369X1J=
3W73B7nt8b293ZW4pltz23Lzb7VVr7qX_3_-l84W5t3SkL2mnxfhW797B-S2h9n2lVCmWx328Sd=
-CW1PtCXX5qBfR4W1GK5Rs275-TXW5lpwTN57JPG4N1BWC87w8p8kW4pcSTV1tQh_tW3Nt2Xg53=
JHYXW6V9NRk3r1_YKW373y2F3w3l8ZW4yYQfx8Lk_LbW7FYkjW1kWrVFW2bkB5B5ptdVSf6pnb3=
604" target=3D"_blank" style=3D"color:#00a4bd; mso-line-height-rule:exactly=
" data-hs-link-id=3D"0">
        <img alt=3D"FeaturedImage_Wordfence_61.02" src=3D"https://email.wor=
dfence.com/hs-fs/hubfs/FeaturedImage_Wordfence_61.02.png?width=3D1120&amp;u=
pscale=3Dtrue&amp;name=3DFeaturedImage_Wordfence_61.02.png" style=3D"outlin=
e:none; text-decoration:none; -ms-interpolation-mode:bicubic; border:none; =
max-width:100%; font-size:16px" width=3D"560" align=3D"middle" srcset=3D"ht=
tps://email.wordfence.com/hs-fs/hubfs/FeaturedImage_Wordfence_61.02.png?ups=
cale=3Dtrue&amp;width=3D1120&amp;upscale=3Dtrue&amp;name=3DFeaturedImage_Wo=
rdfence_61.02.png 560w, https://email.wordfence.com/hs-fs/hubfs/FeaturedIma=
ge_Wordfence_61.02.png?upscale=3Dtrue&amp;width=3D2240&amp;upscale=3Dtrue&a=
mp;name=3DFeaturedImage_Wordfence_61.02.png 1120w" sizes=3D"(max-width: 560=
px) 100vw, 560px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module_17024040694741" class=3D"=
hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"c=
olor: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-gener=
al-type=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapper_mo=
dule_17024040694741_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_=
wrapper_type_rich_text" style=3D"color: inherit; font-size: inherit; line-h=
eight: inherit;" data-hs-cos-general-type=3D"widget" data-hs-cos-type=3D"ri=
ch_text"><p style=3D"mso-line-height-rule:exactly; line-height:175%"><em>A =
previous version of this email was sent with an incorrect title. This has b=
een corrected at this time.</em></p></div></div></td></tr></tbody></table>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module-1-0-1" class=3D"hs_cos_wr=
apper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"color: inh=
erit; font-size: inherit; line-height: inherit;" data-hs-cos-general-type=
=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapper_module-1-=
0-1_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_ric=
h_text" style=3D"color: inherit; font-size: inherit; line-height: inherit;"=
 data-hs-cos-general-type=3D"widget" data-hs-cos-type=3D"rich_text"><p styl=
e=3D"mso-line-height-rule:exactly; line-height:175%">=F0=9F=8E=81&nbsp;<em>=
Wordfence just launched its&nbsp;<a style=3D"color:#00a4bd; mso-line-height=
-rule:exactly" data-hs-link-id=3D"0" target=3D"_blank">bug bounty program</=
a>. Through December 20th 2023, all researchers will&nbsp;<strong>earn 6.25=
x our normal bounty rates</strong>&nbsp;when Wordfence handles responsible =
disclosure for our Holiday Bug Extravaganza!&nbsp;<a href=3D"https://email.=
wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMVWfTg7ZW92pV3h7_3C90W3Z50n156-6DHN=
5j5FR63qgyTW8wLKSR6lZ3kFN2lT73WxxfKRW4127nw4yzrZKN5btrRBvtWTJN5ckl6KCW6TdW7=
wJkZC2JWQsmW88VD8f98pTJbW3s_dNM81tG6PN9cXQHGn87kbW3qfwk-3r-xPDW4_-_0p6K_D9t=
VHWl0447Ykk_W8xlDF86C1J9xW3fssmV54dlmfW2l7zs92PBXVRW6HDLJM3-mnb_W68LDB32dbN=
7PW79g2vk4RPnKMW3xX9052n3LTLW66BNvy80mKPLW3PhrpD8J4xhKW96RXk68FkD-JN7Xz9s2y=
7j97W7QncTH3PLgsVW89RC1B97ZCJKW62_16y5F4vv8W2hg_W97lqmJwVvb88M5Qw0hsW4Z4sFr=
6sYyY3f7NcJ1z04" target=3D"_blank" rel=3D"noopener" style=3D"color:#00a4bd;=
 mso-line-height-rule:exactly" data-hs-link-id=3D"0">Register as a research=
er</a>&nbsp;and&nbsp;<a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/=
cwG7R04/MVXMVWfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FR63qgyTW8wLKSR6lZ3pxW3P1h=
Vh534jGnW2qdLKl9dGDsPW6bZDjw8cGmQ9N4qwkXpPTdB8Vfj2qJ1fSP7PW4X37jv3cKLVzW27Z=
xKw8ryHgJW8j4QXP2m1myzW2fZ2b04k83QlW8RjpJg7PzSfvW1-H2Ql8k2HvNW7450ST903HLVW=
5bgrgV6rSs91W5V3b5T7tzJhyW3qs5c37GzL_CV55Nf78RW03zW8PJnzB3bQGV0W5xwbPr4MD07=
JW2jL_662t95WZW5wc0TW6c3T28N4myGVBbFcpXW7MdbFy8Z_6CPV37ywz2sRSdLN8GytlMBRp1=
SW4P7Mrb6zvMpTW8DYLzM58dCBkW2Krs537_RGX3W7cLCwb2_mSx-f6Kc6gd04" target=3D"_=
blank" rel=3D"noopener" style=3D"color:#00a4bd; mso-line-height-rule:exactl=
y" data-hs-link-id=3D"0">submit your vulnerabilities</a>&nbsp;today!</em>&n=
bsp;=F0=9F=8E=81</p></div></div></td></tr></tbody></table>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module_17023190733302" class=3D"=
hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"c=
olor: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-gener=
al-type=3D"widget" data-hs-cos-type=3D"module"><!--[if gte mso 9]>
<div style=3D"line-height: 0; font-size: 0px">
  <v:rect xmlns:v=3D"urn:schemas-microsoft-com:vml" fill=3D"true" stroke=3D=
"false" style=3D"width:560px; height:2pt;" fillcolor=3D"none">
    <v:fill type=3D"tile"/>
    <v:textbox inset=3D"0,0,0,0">
      <div>
<![endif]-->
<table role=3D"presentation" width=3D"100%" align=3D"center" border=3D"0" s=
tyle=3D"position:relative; top:-1px; min-width:20px; width:100%; max-width:=
100%; border-spacing:0; mso-table-lspace:0pt; mso-table-rspace:0pt; border-=
collapse:collapse; font-size:1px">
  <tbody><tr>
    <td width=3D"auto" style=3D"border-collapse:collapse; mso-line-height-r=
ule:exactly; font-family:Arial, sans-serif; font-size:15px; color:#525355; =
word-break:break-word; line-height:0"><!--[if mso 16]>&nbsp;<![endif]--></t=
d>
    <td width=3D"50%" valign=3D"middle" style=3D"border-collapse:collapse; =
mso-line-height-rule:exactly; font-family:Arial, sans-serif; font-size:15px=
; color:#525355; word-break:break-word; line-height:0; border:transparent; =
border-bottom:1px solid #000000; mso-border-bottom-alt:2pt solid #000000; b=
order-bottom-width:1px"><!--[if mso 16]>&nbsp;<![endif]--></td>
    <td width=3D"auto" style=3D"border-collapse:collapse; mso-line-height-r=
ule:exactly; font-family:Arial, sans-serif; font-size:15px; color:#525355; =
word-break:break-word; line-height:0"><!--[if mso 16]>&nbsp;<![endif]--></t=
d>
    </tr>
</tbody></table>
<!--[if gte mso 9]>
      </div>
    </v:textbox>
  </v:rect>
</div>
<![endif]--></div></td></tr></tbody></table>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
    <!--[if (mso)|(IE)]></tr></table><![endif]-->
    </div>
  =20
  </div>
  <div id=3D"section-2" class=3D"hse-section" style=3D"padding-left:10px; p=
adding-right:10px">
   =20
   =20
    <!--[if !((mso)|(IE))]><!-- -->
      <div class=3D"hse-column-container hse-border" style=3D"min-width:280=
px; max-width:600px; Margin-left:auto; Margin-right:auto; border-collapse:c=
ollapse; border-spacing:0; border-left:0px solid #008cc1; border-right:0px =
solid #008cc1; box-sizing:border-box; background-color:#FFFFFF" bgcolor=3D"=
#FFFFFF">
    <!--<![endif]-->
   =20
    <!--[if (mso)|(IE)]>
      <div class=3D"hse-column-container" style=3D"min-width:280px;max-widt=
h:600px;width:100%;Margin-left:auto;Margin-right:auto;border-collapse:colla=
pse;border-spacing:0;">
      <table align=3D"center" style=3D"border-collapse:collapse;mso-table-l=
space:0pt;mso-table-rspace:0pt;width:600px;border-left:0px solid #008CC1;bo=
rder-right:0px solid #008CC1" cellpadding=3D"0" cellspacing=3D"0" role=3D"p=
resentation" class=3D"hse-border" width=3D"600" bgcolor=3D"#FFFFFF">
      <tr style=3D"background-color:#FFFFFF;">
    <![endif]-->
    <!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:600px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"600" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:600px">
<![endif]-->
<div id=3D"column-2-0" class=3D"hse-column hse-size-12">
  <table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D=
"100%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-=
table-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" =
style=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-famil=
y:Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; =
padding:10px 20px"><div id=3D"hs_cos_wrapper_module_17023190359051" class=
=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=
=3D"color: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-=
general-type=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapp=
er_module_17023190359051_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs=
_cos_wrapper_type_rich_text" style=3D"color: inherit; font-size: inherit; l=
ine-height: inherit;" data-hs-cos-general-type=3D"widget" data-hs-cos-type=
=3D"rich_text"><p style=3D"mso-line-height-rule:exactly; line-height:175%">=
On August 14, 2023, the Wordfence Threat Intelligence team began a research=
 project to find Stored Cross-Site Scripting (XSS) via Shortcode vulnerabil=
ities in WordPress repository plugins. This type of vulnerability enables t=
hreat actors with contributor-level permissions or higher to inject malicio=
us web scripts into pages using plugin shortcodes, which will execute whene=
ver a victim accesses the injected page. We found over 100 vulnerabilities =
across 100 plugins which affect over 6 million sites. You can find the comp=
lete chart of affected plugins below.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">All&nbsp;<a hre=
f=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMVWfTg7ZW92pV3h7=
_3C90W3Z50n156-6DHN5j5FQR3qgyTW7Y8-PT6lZ3mDW8ZttSK92c6_XW1j0mmd7Vz6F7VTjMj5=
7PfFFTW5bSC084cJ7rxW9bq3Dt4wG6gHW450xYw4VgvxwVY4Kmy3cV1bSW6f9djc8zBtfrW3sSn=
__7_hrDXW4r_PsD5j_ZjJW5SJPWC2sJH8cW338Lst98JzGHW6c_fbL3cMXGwW6rJkFv4WBrffW2=
rp8jr79lT5XW8xchMX8MS3CGW1Zw49m4YTjF_W8Pts5d8NjCWmW5JP0JY9btlZQW6xN2Qt8RX9F=
NW5xyRCm3ZXH-TW6RycK522CGvZW33F3Vh1ptNhrN7wxWWY9BfMwW3JYGwp5VKPxkW7fbb3Q1k7=
dSPf5xLPtb04" target=3D"_blank" rel=3D"noopener" style=3D"color:#00a4bd; ms=
o-line-height-rule:exactly" data-hs-link-id=3D"0">Wordfence Premium</a>,&nb=
sp;<a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMVWfTg7=
ZW92pV3h7_3C90W3Z50n156-6DHN5j5FQR3qgyTW7Y8-PT6lZ3q5W92z2dj28WpZYN3dzSL76J4=
JtW66ltpV2DsBhrW50K6yW2cgCvlW6Dfh_d3vcRrQW41-BX37s_HxDF7zPjgRHcGBW8hsK2W2MV=
0v2W210qJQ4HFXbGW3Rt9Jr6y82hJVtPd4h64KnmvW7p3JrC2JmvwLW6ysF8h74kYH9W9lg4ng8=
nv6G0W3glgV84Bfm7qVxbwRD7sndjRW1RWq_K6jJ-vgW8_Tsx495Kb36W3bK9Z05dMkSfN7dR7S=
-qCvZhW6fzXZv6y8KL1W23f_mZ1PQ7BtW2gNL2g6Nrl9RW3j9XGN3h954YN4PD_0w_lJbsW4nYS=
mN7zfP3sf5JxwM-04" target=3D"_blank" rel=3D"noopener" style=3D"color:#00a4b=
d; mso-line-height-rule:exactly" data-hs-link-id=3D"0">Wordfence Care</a>, =
and&nbsp;<a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXM=
VWfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FQR3qgyTW7Y8-PT6lZ3lTW7sqLDb24Jx08W71H=
sHF26LRqwW3tlzn-14NZ_QW4Yml8f46FrrvW4SCMgT6xpHJ6MScNvh4svDSW8Mt1C73vNSL7W1r=
tbKM1SJXSLW9dJfHf3D06v2W63fx8n4k2pR-W4V-t5p8YnwqYW8PNwpL91NqdrW85qHBh7LVrn8=
W8zLcPZ5VvhCbW7f61by5H4ltyW13jW4T7H6qhvW90MjH829ZD60W62V8mh1WLwx9W1bFWYj32F=
6RNW9clwZc1_5Z4zW5w8mzm8ly9-hW5Mw42L4m_9b2W5Vt4fY1tCBmLW4rq17C65Rzv_VqhFSZ2=
n9_dGW1y3X3H3Hs4Cyf4QVKpF04" target=3D"_blank" rel=3D"noopener" style=3D"co=
lor:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"0">Wordfence =
Response</a>&nbsp;customers, as well as those still using the free version =
of our plugin, are protected by the Wordfence firewall=E2=80=99s built-in C=
ross-Site Scripting protection against any exploits targeting this type of =
vulnerability.</p></div></div></td></tr></tbody></table>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module_16971242493161" class=3D"=
hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"c=
olor: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-gener=
al-type=3D"widget" data-hs-cos-type=3D"module">
 =20
  <table align=3D"center" border=3D"0" cellpadding=3D"0" cellspacing=3D"0" =
role=3D"presentation" style=3D"border-spacing:0 !important; mso-table-lspac=
e:0pt; mso-table-rspace:0pt; border-collapse:separate!important">
    <tbody><tr>
        <!--[if mso]>
      <td align=3D"center" valign=3D"middle" bgcolor=3D"#00709E" valign=3D"=
middle" style=3D"border-radius:8px;cursor:auto;background-color:#00709E;pad=
ding:12px 18px;">
    <![endif]-->
    <!--[if !mso]><!-- -->
      <td align=3D"center" valign=3D"middle" bgcolor=3D"#00709E" style=3D"b=
order-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, s=
ans-serif; font-size:15px; color:#525355; word-break:break-word; border-rad=
ius:8px; cursor:auto; background-color:#00709E">
   <!--<![endif]-->
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMV=
WfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FPY5nR32W69t95C6lZ3mHVJRPDD6slypgW4sYX1=
C3ML768W2csK3f5qBYzbW8LrtFB1yqgQzW8_WWdV6YjQWyMDZ0zVxxxs1W6gs1wk8DxKmQN28y1=
GZ_vrrGVMpjsM1mNv5PW6LyvCg5GFmwSW5PthMC418yFlW3sB0vY3gH-4lW1DPcBF2ZhshxMKqM=
KmL9J7BW8STmJs3RFy3SW1m9JT73j-4x-W642y4P5YY7DRW5nBhDQ6ZCbcJN2JP2ddBjT73N1Vv=
095vdzxhW3q47yV7blTm8W1r2Htj1VlskhW85W3_C8Y-tqRW6Zwtbh93JKBGW5NKWlK7rTWtfW8=
dGWzR8XFCBqW77c2xX16t4rXW9hGtkf14tRvVW2G8W-H1ntD0_W1SQ5_Z4DDz6wW8N9gSQ45lph=
YW6BR1W66WLMb3W4ZF-m57pXg62W7jM9c61PP2cnW7KjrGS3G-rG6N5S6DB19DGbWf6DYL3F04"=
 target=3D"_blank" style=3D"color:#00a4bd; mso-line-height-rule:exactly; fo=
nt-size:16px; font-family:arial, helvetica, sans-serif; Margin:0; text-tran=
sform:none; text-decoration:none; padding:12px 18px; display:block" data-hs=
-link-id=3D"1">
          <strong style=3D"color:#ffffff;font-weight:normal;text-decoration=
:none;font-style:normal;">CONTINUE READING ON THE BLOG</strong>
        </a>
      </td>
    </tr>
  </tbody></table>
</div></td></tr></tbody></table>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
    <!--[if (mso)|(IE)]></tr></table><![endif]-->
    </div>
  =20
  </div>
  <div id=3D"section-3" class=3D"hse-section" style=3D"padding-left:10px; p=
adding-right:10px">
   =20
   =20
    <!--[if !((mso)|(IE))]><!-- -->
      <div class=3D"hse-column-container hse-border" style=3D"min-width:280=
px; max-width:600px; Margin-left:auto; Margin-right:auto; border-collapse:c=
ollapse; border-spacing:0; border-left:0px solid #008cc1; border-right:0px =
solid #008cc1; box-sizing:border-box; background-color:#FFFFFF" bgcolor=3D"=
#FFFFFF">
    <!--<![endif]-->
   =20
    <!--[if (mso)|(IE)]>
      <div class=3D"hse-column-container" style=3D"min-width:280px;max-widt=
h:600px;width:100%;Margin-left:auto;Margin-right:auto;border-collapse:colla=
pse;border-spacing:0;">
      <table align=3D"center" style=3D"border-collapse:collapse;mso-table-l=
space:0pt;mso-table-rspace:0pt;width:600px;border-left:0px solid #008CC1;bo=
rder-right:0px solid #008CC1" cellpadding=3D"0" cellspacing=3D"0" role=3D"p=
resentation" class=3D"hse-border" width=3D"600" bgcolor=3D"#FFFFFF">
      <tr style=3D"background-color:#FFFFFF;">
    <![endif]-->
    <!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:600px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"600" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:600px">
<![endif]-->
<div id=3D"column-3-0" class=3D"hse-column hse-size-12">
  <table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D=
"100%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-=
table-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" =
style=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-famil=
y:Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; =
padding:10px 20px"><div id=3D"hs_cos_wrapper_module_17023191351374" class=
=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=
=3D"color: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-=
general-type=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapp=
er_module_17023191351374_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs=
_cos_wrapper_type_rich_text" style=3D"color: inherit; font-size: inherit; l=
ine-height: inherit;" data-hs-cos-general-type=3D"widget" data-hs-cos-type=
=3D"rich_text"><h2 style=3D"margin:0; mso-line-height-rule:exactly; line-he=
ight:175%; font-size:22px">Why are these vulnerabilities so common?</h2>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">By a general de=
finition, shortcodes are unique macro codes added by plugin developers to d=
ynamically and automatically generate content. Developers can use shortcode=
 attributes to optionally add settings, making the content even more dynami=
c and providing more options for users.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">It is important=
 to note that shortcodes are typically used in the post content on WordPres=
s sites, and the post content input is sanitized before being saved to the =
database, which is a WordPress core functionality, so it is often sanitized=
 in all cases.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">Developers migh=
t assume that since WordPress core sanitizes post content, the attributes u=
sed in shortcodes are also sanitized and secure. However, the&nbsp;wp_kses_=
post()&nbsp;sanitization function only sanitizes complete HTML elements.</p=
>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">These vulnerabi=
lities occur when the value provided in the shortcode attribute is output i=
n dynamically generated content within the attributes of an HTML element. I=
n such cases, the value specified in the shortcode contains only HTML eleme=
nt attributes, which are not sanitized during the save of a post. As mentio=
ned earlier, the sanitize function only sanitizes complete HTML tags.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">An example shor=
tcode containing an HTML tag sanitized by the&nbsp;wp_kses_post()&nbsp;func=
tion:</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%"><br>[custom_lin=
k class=3D"&lt;p onmouseover=3D'alert(/XSS/)'&gt;Click Here!&lt;/p&gt;"]<br=
>In this case, wp_kses_post() checks and sanitizes the entire&nbsp;&lt;p&gt=
;&nbsp;tag and its attributes.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">An example shor=
tcode not sanitized by the&nbsp;wp_kses_post()&nbsp;function:<br>[cutsom_li=
nk class=3D"' onmouseover=3D'alert(/XSS/)']</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%"><br>As there is=
 no HTML tag in this case, the wp_kses_post() function does not check or sa=
nitize anything.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">Note: The above=
 explanation demonstrates the usage of cross-site scripting within HTML att=
ributes as it is the most common scenario, but the same problem applies to =
JS variable values, which will be equally vulnerable if not properly escape=
d.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">Even the WordPr=
ess security handbook says the following about escaping output:</p>
<blockquote style=3D"mso-line-height-rule:exactly; line-height:175%">
<p style=3D"mso-line-height-rule:exactly; line-height:175%"><em>=E2=80=9CMo=
st WordPress functions properly prepare the data for output, and additional=
 escaping is not needed.=E2=80=9D</em></p>
</blockquote>
<p style=3D"mso-line-height-rule:exactly; line-height:175%"><a href=3D"http=
s://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMVWfTg7ZW92pV3h7_3C90W3Z5=
0n156-6DHN5j5FQR3qgyTW7Y8-PT6lZ3l2W3DMZ_R127FMCW3HC-mN2dPcWqW1NpTgn70HsgjW2=
cL_1j97wVNLW8xrty24x8mGjN7qBTZQm5-MzV9_0NY5Fg8sKW6TzLxq4fzQCpW5bYpjD1gvSr7W=
1StK8C43gt6DN8sY5DbKn4SyW5MtCV11jbzwzW2fs3tj7wC4dtW4JRhZW6B120JW7lYttg3t48p=
GW42FJ-y54yRvkW32kr7M5ggkMmW46PfpB9cv_GSW1R5HXQ8LhMMYW3wyZmT1qvf9_W4G3Q9x40=
zQzMW58PlPH6TKBxbV8y_hK3TVgFFW33ZGZR3drb0xW8bKzPW5QkzDhMQhSj8kBhYBf1MqJYj04=
" target=3D"_blank" rel=3D"noopener" style=3D"color:#00a4bd; mso-line-heigh=
t-rule:exactly" data-hs-link-id=3D"0">https://developer.wordpress.org/apis/=
security/escaping/</a></p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">After reading t=
his, developers might reasonably assume that the shortcode attributes are s=
anitized and secure. However, as demonstrated in the above example, there a=
re exceptions.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<h2 style=3D"margin:0; mso-line-height-rule:exactly; line-height:175%; font=
-size:22px">Vulnerability Summary from Wordfence Intelligence</h2></div></d=
iv></td></tr></tbody></table>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module_17024024125301" class=3D"=
hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"c=
olor: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-gener=
al-type=3D"widget" data-hs-cos-type=3D"module">
 =20
  <table align=3D"center" border=3D"0" cellpadding=3D"0" cellspacing=3D"0" =
role=3D"presentation" style=3D"border-spacing:0 !important; mso-table-lspac=
e:0pt; mso-table-rspace:0pt; border-collapse:separate!important">
    <tbody><tr>
        <!--[if mso]>
      <td align=3D"center" valign=3D"middle" bgcolor=3D"#00709E" valign=3D"=
middle" style=3D"border-radius:8px;cursor:auto;background-color:#00709E;pad=
ding:12px 18px;">
    <![endif]-->
    <!--[if !mso]><!-- -->
      <td align=3D"center" valign=3D"middle" bgcolor=3D"#00709E" style=3D"b=
order-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, s=
ans-serif; font-size:15px; color:#525355; word-break:break-word; border-rad=
ius:8px; cursor:auto; background-color:#00709E">
   <!--<![endif]-->
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMV=
WfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FPY5nR32W69t95C6lZ3q0VwhVQj3Jg8phW5K-2k=
Z59CdwTW5KJd5s7hXMHqW7dl6qz3XZLCZVr5jW585SyR4W75l9VS6NZNdrW3nc9t38d4b4cW43P=
G_t4Z49c2VPM-P28d6T-gVvGBbn3Z2Q7-W2D2qDv54RxQGW7njswp3zNmzdVqrVNP7srr0RW2zF=
mTL4dn2Y_N8-1TJ2h4nbWW29gZ_G58NCxqMKVzjm3TQSjN8MYspFMf_WcW8dyd9N5w65g3W3RMT=
0t8lVn33W8N-x6j943XwMW6RZGHT7h8jxZW2nLTxs7Md3CHN6rzJYJFJR-nW7xkn2W8jBkFkW4p=
_KnF3VtrHYW3MhnDk9lDSNQW22Tqnx8v4t2fW3ggH482rqs47W4rS8gg1fqSg-N5L7p1klJf9DW=
197c0M8TFp1rW5tmjGn3yF3h8W23ZBX17lNhW8N3c2mt7lWCk6W8cPDWw2YdxY8f28XRD204" t=
arget=3D"_blank" style=3D"color:#00a4bd; mso-line-height-rule:exactly; font=
-size:16px; font-family:arial, helvetica, sans-serif; Margin:0; text-transf=
orm:none; text-decoration:none; padding:12px 18px; display:block" data-hs-l=
ink-id=3D"2">
          <strong style=3D"color:#ffffff;font-weight:normal;text-decoration=
:none;font-style:normal;">VIEW IMPACTED PLUGINS ON THE BLOG</strong>
        </a>
      </td>
    </tr>
  </tbody></table>
</div></td></tr></tbody></table>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module_17020429609141" class=3D"=
hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"c=
olor: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-gener=
al-type=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapper_mo=
dule_17020429609141_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_=
wrapper_type_rich_text" style=3D"color: inherit; font-size: inherit; line-h=
eight: inherit;" data-hs-cos-general-type=3D"widget" data-hs-cos-type=3D"ri=
ch_text"><h2 style=3D"margin:0; mso-line-height-rule:exactly; line-height:1=
75%; font-size:22px">Security recommendations for developers</h2>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">We recommend us=
ing one of the built-in WordPress escaping functions before outputting user=
 data. WordPress has a number of functions that can be used for different s=
ituations. You can read more about these functions at:&nbsp;<a href=3D"http=
s://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMVWfTg7ZW92pV3h7_3C90W3Z5=
0n156-6DHN5j5FQR3qgyTW7Y8-PT6lZ3lKW4RCxz74Yv6TZW5Q94Dz1k8fcLW2_X8X78v5W1kW8=
QK1ZM2z3zCNW2bhRhf4XJh5tW4yX4Y59dWvGGW7C08XB88MkW9W5LQmm87HTws5N1zpt6X1s4nT=
W7y3GLn83mvMwN14CW1-W-rqbW4wRPsg27Gjc3VHNdyr5LyBg4W8GNLQK94RjQtW5vYvl84CgCd=
2VSMvSN4JDYQgW8THpKQ7VB7RwW6QHZWK1N-dsjV1wTJ46z22BNW5mrVNt8-9qX4W6ZzltZ7TpH=
NxW96FZMW33WHwqW9l1Vxl5hlvBGW1btSXn7WBCSMW8p0rKM3LBtwKW99_vPG35XcDDf5369440=
4" target=3D"_blank" rel=3D"noopener" style=3D"color:#00a4bd; mso-line-heig=
ht-rule:exactly" data-hs-link-id=3D"1">https://developer.wordpress.org/apis=
/security/escaping/</a></p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<h2 style=3D"margin:0; mso-line-height-rule:exactly; line-height:175%; font=
-size:22px">Technical Analysis #1</h2>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">A general but f=
ictional shortcode will be used to demonstrate a shortcode XSS vulnerabilit=
y, focusing only on the most important details.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">Let=E2=80=99s t=
ake an example where shortcode attributes are used as HTML attributes.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">The vulnerable =
shortcode function:</p></div></div></td></tr></tbody></table>
<div id=3D"hs_cos_wrapper_module_17023191568245" class=3D"hs_cos_wrapper hs=
_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; fo=
nt-size: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget=
" data-hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"pr=
esentation" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"bor=
der-spacing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; m=
so-table-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMV=
WfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FPY5nR32W69t95C6lZ3lKW5QKSxd503JdfW9b-6=
Hq7lLZJqW85_Wv95Rm3ldW3x4lF66mk5BMW6qKsdB4l7bggVZVw8X9kbfzmW4djKY63bDBVVVpn=
dKd2fxxmBVHKGV_4mHR5cN5p3KNR34Yd6W6lnwqr4-tJ56VjwyZL2bjxdJW38lK0n45km_7W9cQ=
dvs3z6rj7N6s54xLQCrQrW94D6h96Fht5JW2R_jJh3ypHCmW51WmDH1Hqp26VkVrCR76QZXwW2m=
6B7_36wtZWN4psZdG4JvsyW3_MS-W3v08ZkVY47XG96qQ5TW7_8M7T5VRlDNW4YRhCv2BSb17W5=
SGQHr3vVch3W2x7Z997Wj4-JW5QT7lh2_LHqTVKxfB51NMf-DW8fKfGg5mBYCGW3ZPtnf2qYVvL=
W3vbn611TkLMwW5Ldms11sxh7FV6gGhY1N70f4W8B6nV18LYTBMW3V7wPT5XzynBf3fYwwF04" =
target=3D"_blank" style=3D"color:#00a4bd; mso-line-height-rule:exactly" dat=
a-hs-link-id=3D"3">
        <img alt=3D"ray-so-export (16)" src=3D"https://email.wordfence.com/=
hs-fs/hubfs/ray-so-export%20(16).png?width=3D1120&amp;upscale=3Dtrue&amp;na=
me=3Dray-so-export%20(16).png" style=3D"outline:none; text-decoration:none;=
 -ms-interpolation-mode:bicubic; border:none; max-width:100%; font-size:16p=
x" width=3D"560" align=3D"middle" srcset=3D"https://email.wordfence.com/hs-=
fs/hubfs/ray-so-export%20(16).png?upscale=3Dtrue&amp;width=3D1120&amp;upsca=
le=3Dtrue&amp;name=3Dray-so-export%20(16).png 560w, https://email.wordfence=
.com/hs-fs/hubfs/ray-so-export%20(16).png?upscale=3Dtrue&amp;width=3D2240&a=
mp;upscale=3Dtrue&amp;name=3Dray-so-export%20(16).png 1120w" sizes=3D"(max-=
width: 560px) 100vw, 560px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module_17023191753336" class=3D"=
hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"c=
olor: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-gener=
al-type=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapper_mo=
dule_17023191753336_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_=
wrapper_type_rich_text" style=3D"color: inherit; font-size: inherit; line-h=
eight: inherit;" data-hs-cos-general-type=3D"widget" data-hs-cos-type=3D"ri=
ch_text"><p style=3D"mso-line-height-rule:exactly; line-height:175%">Let=E2=
=80=99s take a look at an example where the following shortcode is used in =
the post content:<br>[custom_link class=3D'my-custom-class']Link Text[/cust=
om_link]</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">As a result, th=
e following link will be displayed in the post:</p></div></div></td></tr></=
tbody></table>
<div id=3D"hs_cos_wrapper_module_17024025968212" class=3D"hs_cos_wrapper hs=
_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; fo=
nt-size: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget=
" data-hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"pr=
esentation" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"bor=
der-spacing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; m=
so-table-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMV=
WfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FPY5nR32W69t95C6lZ3kSW1rBsnJ4zcmK0W3s5j=
Yd38wWXrW5ksywh4D98FLW8C-cZG4DFV42W3VwVMY45DQSvW71tLHf5zk1hPW5F_tSn8W3z9ZVg=
yQYP6s37dDW6pwN847Rjk34W5HmBKK3Jw-r4W2tD9Jd5Ds7_zVNJZPX2d3DCJVzzM_M4f_ZcmW3=
rnt09558CnFW18h_PT8rnR1DW4vY37k2ChtnxW1Bv3Np2S1t_CW3-Dhrp5dZNhjW7lMpmM26MS1=
hV8Jcc96-D5GlW66m-sD7j_HsgW3gCbxk4pcmwbW2rmMCH2mH3y3N5lh2t-QySMGW198g567fYx=
XfM3bFzLkRgK-W2BPz2l6NTvl-W5Tvynp2RdtWpN4s1fT8n6vd3W6N6hcn1C5YLvW8Xh_fZ5NZG=
34W57bdCg8pqW4dW7kM-0B1T_WDrVM489n5ZbSc5V7KR_88pxrN0W5Gmn9d3np83Gf7g_Srv04"=
 target=3D"_blank" style=3D"color:#00a4bd; mso-line-height-rule:exactly" da=
ta-hs-link-id=3D"4">
        <img alt=3D"ray-so-export (17)" src=3D"https://email.wordfence.com/=
hs-fs/hubfs/ray-so-export%20(17).png?width=3D1120&amp;upscale=3Dtrue&amp;na=
me=3Dray-so-export%20(17).png" style=3D"outline:none; text-decoration:none;=
 -ms-interpolation-mode:bicubic; border:none; max-width:100%; font-size:16p=
x" width=3D"560" align=3D"middle" srcset=3D"https://email.wordfence.com/hs-=
fs/hubfs/ray-so-export%20(17).png?upscale=3Dtrue&amp;width=3D1120&amp;upsca=
le=3Dtrue&amp;name=3Dray-so-export%20(17).png 560w, https://email.wordfence=
.com/hs-fs/hubfs/ray-so-export%20(17).png?upscale=3Dtrue&amp;width=3D2240&a=
mp;upscale=3Dtrue&amp;name=3Dray-so-export%20(17).png 1120w" sizes=3D"(max-=
width: 560px) 100vw, 560px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module_17024026049443" class=3D"=
hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"c=
olor: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-gener=
al-type=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapper_mo=
dule_17024026049443_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_=
wrapper_type_rich_text" style=3D"color: inherit; font-size: inherit; line-h=
eight: inherit;" data-hs-cos-general-type=3D"widget" data-hs-cos-type=3D"ri=
ch_text"><p style=3D"mso-line-height-rule:exactly; line-height:175%">In thi=
s case, the class attribute of the shortcode is used and outputted in the c=
lass attribute of the&nbsp;&lt;a&gt;&nbsp;HTML tag.</p>
<h2 style=3D"margin:0; mso-line-height-rule:exactly; line-height:175%; font=
-size:22px">The Exploit</h2>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">Now, let=E2=80=
=99s take a look at a threat actor that wants to inject malicious web scrip=
ts into a post using the plugin=E2=80=99s shortcode. To accomplish this, th=
e attacker needs to leave the specified HTML attribute, which in the exampl=
e is the =E2=80=9Cclass=E2=80=9D attribute and add an additional malicious =
HTML attribute after.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">Here=E2=80=99s =
an exploit example:<br>[custom_link class=3D'" onmouseover=3D"alert(/XSS/)'=
]Link Text[/custom_link]</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">With the payloa=
d above, the following link will be displayed in the post:</p></div></div><=
/td></tr></tbody></table>
<div id=3D"hs_cos_wrapper_module_17024026453624" class=3D"hs_cos_wrapper hs=
_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; fo=
nt-size: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget=
" data-hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"pr=
esentation" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"bor=
der-spacing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; m=
so-table-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMV=
WfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FPY5nR32W69t95C6lZ3nDW28kWk83vZqqdW5GLm=
4q229nysW8vTQ4J4qsyrCW9m2dTt5MtqK5W70MH5T29G6jhW9gS2jD1mvcT0W1C3nB_21NmHvW1=
MqnL061-mNcW3Cq34t7VkTDmW8kfTmk8cTmB5N8xMfsd-Sy4PW3h7xd4633LkpW8lz8R97bK1-h=
W4ym_gZ27zQ8MW5yHqyW4NBjYCV6T41B142Q0BW2HBct88yM4rSW6TJjDl8H8NJnW43_hbp45gy=
-fW8tPX9W251SmnW1vt2_c6-4MlBW4-RSTd68smtmW14kDk63KTxCnN3cjb_TXJK4-W1Xs5kl2Z=
QX1rW6Fh5x75R7fQ-W4fjB7d5cV7_GW3sl3fm3P07z-MbkpVbCpdj5VrTwh42TdY-fW1hj_SV5z=
7W68W2FMvcg7sRYPNW7NSQgV5m_S-sW6M3l5j4xgr24W3NKM8797HGLgW8QXmF65F1wtrf6NqWj=
004" target=3D"_blank" style=3D"color:#00a4bd; mso-line-height-rule:exactly=
" data-hs-link-id=3D"5">
        <img alt=3D"ray-so-export (18)" src=3D"https://email.wordfence.com/=
hs-fs/hubfs/ray-so-export%20(18).png?width=3D1120&amp;upscale=3Dtrue&amp;na=
me=3Dray-so-export%20(18).png" style=3D"outline:none; text-decoration:none;=
 -ms-interpolation-mode:bicubic; border:none; max-width:100%; font-size:16p=
x" width=3D"560" align=3D"middle" srcset=3D"https://email.wordfence.com/hs-=
fs/hubfs/ray-so-export%20(18).png?upscale=3Dtrue&amp;width=3D1120&amp;upsca=
le=3Dtrue&amp;name=3Dray-so-export%20(18).png 560w, https://email.wordfence=
.com/hs-fs/hubfs/ray-so-export%20(18).png?upscale=3Dtrue&amp;width=3D2240&a=
mp;upscale=3Dtrue&amp;name=3Dray-so-export%20(18).png 1120w" sizes=3D"(max-=
width: 560px) 100vw, 560px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module_17024026550355" class=3D"=
hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"c=
olor: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-gener=
al-type=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapper_mo=
dule_17024026550355_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_=
wrapper_type_rich_text" style=3D"color: inherit; font-size: inherit; line-h=
eight: inherit;" data-hs-cos-general-type=3D"widget" data-hs-cos-type=3D"ri=
ch_text"><p style=3D"mso-line-height-rule:exactly; line-height:175%">The fi=
rst double quotation mark provided in the shortcode=E2=80=99s =E2=80=9Cclas=
s=E2=80=9D attribute closes the =E2=80=9Cclass=E2=80=9D HTML attribute with=
in the&nbsp;&lt;a&gt;&nbsp;tag. After that the =E2=80=9Conmouseover=E2=80=
=9D HTML attribute containing a malicious script is added to the&nbsp;&lt;a=
&gt;&nbsp;tag. This means that whenever a user mouses over the rendered sho=
rtcode, a prompt with =E2=80=9CXSS=E2=80=9D would appear on the screen.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<h2 style=3D"margin:0; mso-line-height-rule:exactly; line-height:175%; font=
-size:22px">The Solution</h2>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">To make the sho=
rtcode secure, escape functions must be used. This prevents user-defined in=
put from leaving the original =E2=80=9Cclass=E2=80=9D HTML attribute as any=
 quotes used to leave the HTML attribute will be escaped.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">Let=E2=80=99s m=
ake the example shortcode code secure:</p></div></div></td></tr></tbody></t=
able>
<div id=3D"hs_cos_wrapper_module_17024026706456" class=3D"hs_cos_wrapper hs=
_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; fo=
nt-size: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget=
" data-hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"pr=
esentation" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"bor=
der-spacing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; m=
so-table-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMV=
WfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FPY5nR32W69t95C6lZ3pSW2qS7X03QQ0GJW7ZdS=
BY4m1bMHVTwDdS4zcsLQW4ChlN73YzKw2W6W-x_S3qKpllVMXvrj6bM_TYW96QHZH1J93Y9W4s-=
LWs3KKN61W4G-Xrn4YsMKnW98X1Ps3hFDcMW3x6Rv-27TCMPW8Hr8m42jQTkYW4HRBg35PvVBMW=
4Jf3lj3k2jYwW1yKNx62yy8d3N3vTpz5nmN7lW5MTYvw3rT6TdN5Wv_x5j3bkHW14P9n64q8czt=
N9ckKRzbVlWLW1-Sb_W53W9h_W7xQzdT4ZjX1_W4YlkBw7w72H6W7ndNw_8Nk7DrN5mCQcjxF9b=
wW3p15RX96JLmhN3-clfKn082zW1XQDkZ3gDJdhW7kghT96HM_fyW212QFq4j4_ZfW8LJrGv67G=
dTfW4MnFCP7SM4PTW4Spycv8-CspYW3nsnVV84Gmk9W5SJnrm6pj_KtW1dtp0R2QWvS9f9f7V8x=
04" target=3D"_blank" style=3D"color:#00a4bd; mso-line-height-rule:exactly"=
 data-hs-link-id=3D"6">
        <img alt=3D"ray-so-export (19)" src=3D"https://email.wordfence.com/=
hs-fs/hubfs/ray-so-export%20(19).png?width=3D1120&amp;upscale=3Dtrue&amp;na=
me=3Dray-so-export%20(19).png" style=3D"outline:none; text-decoration:none;=
 -ms-interpolation-mode:bicubic; border:none; max-width:100%; font-size:16p=
x" width=3D"560" align=3D"middle" srcset=3D"https://email.wordfence.com/hs-=
fs/hubfs/ray-so-export%20(19).png?upscale=3Dtrue&amp;width=3D1120&amp;upsca=
le=3Dtrue&amp;name=3Dray-so-export%20(19).png 560w, https://email.wordfence=
.com/hs-fs/hubfs/ray-so-export%20(19).png?upscale=3Dtrue&amp;width=3D2240&a=
mp;upscale=3Dtrue&amp;name=3Dray-so-export%20(19).png 1120w" sizes=3D"(max-=
width: 560px) 100vw, 560px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module_17024026971287" class=3D"=
hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"c=
olor: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-gener=
al-type=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapper_mo=
dule_17024026971287_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_=
wrapper_type_rich_text" style=3D"color: inherit; font-size: inherit; line-h=
eight: inherit;" data-hs-cos-general-type=3D"widget" data-hs-cos-type=3D"ri=
ch_text"><p style=3D"mso-line-height-rule:exactly; line-height:175%">The =
=E2=80=9Cclass=E2=80=9D data is an attribute, so it is recommended to use t=
he&nbsp;esc_attr()&nbsp;function there.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%"><br>The =E2=80=
=9Chref=E2=80=9D data is a url, which is an attribute that has more specifi=
c requirements, so it is recommended to use the&nbsp;esc_url()&nbsp;functio=
n there.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">The above two f=
unctions make the shortcode completely secure against Cross-Site Scripting.=
</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">If the attacker=
 tries to add a malicious shortcode using the patched functionality, it wil=
l result in the following link, which no longer contains executable JavaScr=
ipt:</p></div></div></td></tr></tbody></table>
<div id=3D"hs_cos_wrapper_module_17024027165158" class=3D"hs_cos_wrapper hs=
_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; fo=
nt-size: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget=
" data-hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"pr=
esentation" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"bor=
der-spacing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; m=
so-table-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMV=
WfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FPY5nR32W69t95C6lZ3lsW47s-f4181qJvW2zVt=
b17g6x6bW18DrW13XH8C5W5Mlhmv6GcBrDW7T6d7T8w6p4JW70g6hr39bVw_W7xjkJj70Dz0kW3=
nNgKM4NB6XvW71cRGf4HnMjgW6xsgxd5WN8tPW1hKDl32Hjs8DW3kq8JB4s5ChsW43C9NP8m2V7=
tW31JnSV31tRJHW50CZ6t4kZhL3W5Gg4mk5QnZSCW39dlW43VC5_rW6qR5K095ZSK3W7Bxczf64=
lRJqN8Ydjkfgnb1hW67_TQ_6MMRQ0W8Ql5V21cpYrHW8sm2nt6cZyXnW78RDkY85sbXbW2dLJMc=
7lTb_7W5wH0_N6pYJSfW3PsyBJ6K49_4W1NhT7d58Ml0bW4KNcrF2zwKP-W1tpFYb3m_whyW7RF=
m6r3CLL0zW8ClHK18-Rs4gN6-W-Y11PzfJW4hLngj6HJ2bPW88K_PD1vKJYxW6j0FLW8Grh5Tf5=
DSsjs04" target=3D"_blank" style=3D"color:#00a4bd; mso-line-height-rule:exa=
ctly" data-hs-link-id=3D"7">
        <img alt=3D"ray-so-export (20)" src=3D"https://email.wordfence.com/=
hs-fs/hubfs/ray-so-export%20(20).png?width=3D1120&amp;upscale=3Dtrue&amp;na=
me=3Dray-so-export%20(20).png" style=3D"outline:none; text-decoration:none;=
 -ms-interpolation-mode:bicubic; border:none; max-width:100%; font-size:16p=
x" width=3D"560" align=3D"middle" srcset=3D"https://email.wordfence.com/hs-=
fs/hubfs/ray-so-export%20(20).png?upscale=3Dtrue&amp;width=3D1120&amp;upsca=
le=3Dtrue&amp;name=3Dray-so-export%20(20).png 560w, https://email.wordfence=
.com/hs-fs/hubfs/ray-so-export%20(20).png?upscale=3Dtrue&amp;width=3D2240&a=
mp;upscale=3Dtrue&amp;name=3Dray-so-export%20(20).png 1120w" sizes=3D"(max-=
width: 560px) 100vw, 560px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module_17024027440519" class=3D"=
hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"c=
olor: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-gener=
al-type=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapper_mo=
dule_17024027440519_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_=
wrapper_type_rich_text" style=3D"color: inherit; font-size: inherit; line-h=
eight: inherit;" data-hs-cos-general-type=3D"widget" data-hs-cos-type=3D"ri=
ch_text"><h2 style=3D"margin:0; mso-line-height-rule:exactly; line-height:1=
75%; font-size:22px">Technical Analysis #2</h2>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">Next, let=E2=80=
=99s look at an example where shortcode attributes are used as JS variable =
values.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">The vulnerable =
shortcode function assigns shortcode attributes to JS variables:</p></div><=
/div></td></tr></tbody></table>
<div id=3D"hs_cos_wrapper_module_170240275834210" class=3D"hs_cos_wrapper h=
s_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; f=
ont-size: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widge=
t" data-hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"p=
resentation" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"bo=
rder-spacing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; =
mso-table-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMV=
WfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FPY5nR32W69t95C6lZ3ktVvr9-L13jWwjW46ksB=
q8ZdjnwW4rBFFq8nd76HW6YknZT5R_nsqW19HZmL1kY5MZW67YRX750-V_bW5ctNHx4-7HB0V_0=
bpt60SbbvW4S3lfV3_NTYHW6pFCyH6xXJzrVXts2z8zsZtRW6Z_9Bb73CDQ6W5qWpQQ1WNS1xW2=
Nx167802V6WW2BypGk8JGnJ8N47dgM8B_vGrW5-f8YV7km-NVW5rp7Zj1sBm6dW1xCy9t6HMqpF=
W90bnjb2XRNs9W5-VR-14bVRzRW2QC8Mp7ZJqqPW1j3wVt63VS7yN90F2XnmPVF7W7vvWNM6rgH=
V5W4CdP0q8C7Y4FW8XXJNt6jZtmdW7J8pPG7gM163N1KnbrJm5sZRW4-g9bn6bGZ_kW7YWr3G2v=
CZgVW1FXdTy2Psdw6W55v6sL3r4nnmN53Px9K85N2LW8jhK8c569wjBW8NN2WJ61MNc0f8X66-j=
04" target=3D"_blank" style=3D"color:#00a4bd; mso-line-height-rule:exactly"=
 data-hs-link-id=3D"8">
        <img alt=3D"ray-so-export (21)" src=3D"https://email.wordfence.com/=
hs-fs/hubfs/ray-so-export%20(21).png?width=3D1120&amp;upscale=3Dtrue&amp;na=
me=3Dray-so-export%20(21).png" style=3D"outline:none; text-decoration:none;=
 -ms-interpolation-mode:bicubic; border:none; max-width:100%; font-size:16p=
x" width=3D"560" align=3D"middle" srcset=3D"https://email.wordfence.com/hs-=
fs/hubfs/ray-so-export%20(21).png?upscale=3Dtrue&amp;width=3D1120&amp;upsca=
le=3Dtrue&amp;name=3Dray-so-export%20(21).png 560w, https://email.wordfence=
.com/hs-fs/hubfs/ray-so-export%20(21).png?upscale=3Dtrue&amp;width=3D2240&a=
mp;upscale=3Dtrue&amp;name=3Dray-so-export%20(21).png 1120w" sizes=3D"(max-=
width: 560px) 100vw, 560px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module_170240278439811" class=3D=
"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"=
color: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-gene=
ral-type=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapper_m=
odule_170240278439811_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_co=
s_wrapper_type_rich_text" style=3D"color: inherit; font-size: inherit; line=
-height: inherit;" data-hs-cos-general-type=3D"widget" data-hs-cos-type=3D"=
rich_text"><p style=3D"mso-line-height-rule:exactly; line-height:175%">Here=
=E2=80=99s an example where the following shortcode is used in the post con=
tent:<br>[custom_js_color_variable color=3D'blue']</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">As a result, th=
e following script with a variable setting for =E2=80=9Ccolor=E2=80=9D will=
 be displayed in the post:</p></div></div></td></tr></tbody></table>
<div id=3D"hs_cos_wrapper_module_170240285112212" class=3D"hs_cos_wrapper h=
s_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; f=
ont-size: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widge=
t" data-hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"p=
resentation" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"bo=
rder-spacing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; =
mso-table-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMV=
WfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FPY5nR32W69t95C6lZ3mVW80r48s6FQJ8HVVtCH=
p6VyJ1sN3_Sw756x7VhW7YfnX_8HQVCVW8zN-VG8hNWXSW4xC6Gx6rPq16N1wnVbDHz_bjW8731=
1H95jmn4N71pWQHBX9f9W4j50pN7pbFKZW9jffRf6qPcfVW2YmQZS3JBZS8W6zJH0l5yr7thW1r=
dlnQ5Dh2Z7N1SS4ZkxnrLjW7ZFsLK33QnJVW1MXCfb3wnQSjW7Wdl0w5M_xrQN6Qhx8sm5k2bW6=
cby2s7QFb-4N6NCryd6RDLxN69QRqjykCw6W2jFNWB4PNNWWW80wX-72pp2mtW7GN3T-3rWK1NW=
5fQ-_D15mBCDW2vP3rQ2_w292W5Pt_tt1MrrmGW4f5pBp2V256qV5GKBn66ZD-_W6CMMDR31nhd=
_W6yrTQJ2RwHwWW3bTY5w7sw377W3HpdtB8q-fqXN3GdSwffxYdHW2m3rzb8Fx3FDd76QQF04" =
target=3D"_blank" style=3D"color:#00a4bd; mso-line-height-rule:exactly" dat=
a-hs-link-id=3D"9">
        <img alt=3D"ray-so-export (22)" src=3D"https://email.wordfence.com/=
hs-fs/hubfs/ray-so-export%20(22).png?width=3D1120&amp;upscale=3Dtrue&amp;na=
me=3Dray-so-export%20(22).png" style=3D"outline:none; text-decoration:none;=
 -ms-interpolation-mode:bicubic; border:none; max-width:100%; font-size:16p=
x" width=3D"560" align=3D"middle" srcset=3D"https://email.wordfence.com/hs-=
fs/hubfs/ray-so-export%20(22).png?upscale=3Dtrue&amp;width=3D1120&amp;upsca=
le=3Dtrue&amp;name=3Dray-so-export%20(22).png 560w, https://email.wordfence=
.com/hs-fs/hubfs/ray-so-export%20(22).png?upscale=3Dtrue&amp;width=3D2240&a=
mp;upscale=3Dtrue&amp;name=3Dray-so-export%20(22).png 1120w" sizes=3D"(max-=
width: 560px) 100vw, 560px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module_170240287761913" class=3D=
"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"=
color: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-gene=
ral-type=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapper_m=
odule_170240287761913_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_co=
s_wrapper_type_rich_text" style=3D"color: inherit; font-size: inherit; line=
-height: inherit;" data-hs-cos-general-type=3D"widget" data-hs-cos-type=3D"=
rich_text"><h2 style=3D"margin:0; mso-line-height-rule:exactly; line-height=
:175%; font-size:22px">The Exploit</h2>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">Now, we=E2=80=
=99ll try to exploit the shortcode:<br>[custom_js_color_variable color=3D'"=
; alert(/XSS/); let more=3D"']</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">As a result, th=
e following script will be displayed in the post:</p></div></div></td></tr>=
</tbody></table>
<div id=3D"hs_cos_wrapper_module_170240289491414" class=3D"hs_cos_wrapper h=
s_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; f=
ont-size: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widge=
t" data-hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"p=
resentation" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"bo=
rder-spacing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; =
mso-table-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMV=
WfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FPY5nR32W69t95C6lZ3kWW7bcDk87w0k9hW7z-Z=
KY9dxcPWW5vNbMY8kVR7HW8M-sR54J4p5cN2Dw77QK98GzV2GJPW2hnr4MW6djWb66tvl2qW6Yz=
cMn1rd5wWW412-zS5Bj8b8W6_RjBW7C9DmBW2hml2J3PMHTMW4BCG2z6gC2CQW4pDRrj4Sp_vfW=
9hQtn489z9tdN8YTf4TxNgWtW1d8nwZ1H9JbPW3hwwzJ4c57cnW429ZLs8HVZK5W1TrlyJ4X2l-=
SW8nnxTb8fdS8GW53XC4W7pcQ81W8gwgNP7T3YTBW4xQSvY1LCWlSW2yr8S06lYqGjW2WsjXQ2j=
RBN7N6gLdlvjQM3tW95SZgc3m0h8TW8QBDCm8X7KvDN1spmXLlRQf_W1_mnY35QC_HwW5D0cBj3=
sqHbGW1-6TtQ20z1fXVbYk4w3QBWQdW6YrqGn1vht4tW2sR8c15Lrq26W9kPs7N7mJpDgf3XX7G=
v04" target=3D"_blank" style=3D"color:#00a4bd; mso-line-height-rule:exactly=
" data-hs-link-id=3D"10">
        <img alt=3D"ray-so-export (23)" src=3D"https://email.wordfence.com/=
hs-fs/hubfs/ray-so-export%20(23).png?width=3D1120&amp;upscale=3Dtrue&amp;na=
me=3Dray-so-export%20(23).png" style=3D"outline:none; text-decoration:none;=
 -ms-interpolation-mode:bicubic; border:none; max-width:100%; font-size:16p=
x" width=3D"560" align=3D"middle" srcset=3D"https://email.wordfence.com/hs-=
fs/hubfs/ray-so-export%20(23).png?upscale=3Dtrue&amp;width=3D1120&amp;upsca=
le=3Dtrue&amp;name=3Dray-so-export%20(23).png 560w, https://email.wordfence=
.com/hs-fs/hubfs/ray-so-export%20(23).png?upscale=3Dtrue&amp;width=3D2240&a=
mp;upscale=3Dtrue&amp;name=3Dray-so-export%20(23).png 1120w" sizes=3D"(max-=
width: 560px) 100vw, 560px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module_170240293150515" class=3D=
"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"=
color: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-gene=
ral-type=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapper_m=
odule_170240293150515_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_co=
s_wrapper_type_rich_text" style=3D"color: inherit; font-size: inherit; line=
-height: inherit;" data-hs-cos-general-type=3D"widget" data-hs-cos-type=3D"=
rich_text"><h2 style=3D"margin:0; mso-line-height-rule:exactly; line-height=
:175%; font-size:22px">The Solution</h2>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">Let=E2=80=99s m=
ake the example shortcode code secure:</p></div></div></td></tr></tbody></t=
able>
<div id=3D"hs_cos_wrapper_module_170240294493816" class=3D"hs_cos_wrapper h=
s_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; f=
ont-size: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widge=
t" data-hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"p=
resentation" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"bo=
rder-spacing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; =
mso-table-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMV=
WfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FPY5nR32W69t95C6lZ3kVN3gpjX_s8cJGW4mHG2=
t4d-NtRW58bJ0l1H1B7cW2gnXF1373gKMN7dnNhRKDWhjW2Lp_pR85Yg-mW8Svhnk8Mf6ySVGPn=
wQ3_W_zrW2mjmRX7rkzh2W66l10X829TbRN88cVFtYnPM7W7_wJjm8Z3cyvW6Fl50c518cx-W1T=
6Mlf61kkk_W77bly05Jd3M7VXYV0P2S0WrTW38rqyC1s8rDZW754b1j6cc-QXW3Fj48s45jnT3W=
5rKY6887LnBCW2w31dS5vnvc0W2Z-wcv5sN7BBW16_LZQ2GSzsDW7R_mFc4c8dSDW1mPG7g1RmW=
BbW3LTr2N147TsYW7H3Jly8tTs17W28S0sQ1M4XBVW6C0vkN4fm9hrW6nmD712ykqTJW1BnYzP8=
pxXvSW4fdbkb6jSHp_W6bSFf19bgk8yN8wFPmvMdtNZW1R74j78gsDj-W2G8psd5H_pHbf3nzq1=
204" target=3D"_blank" style=3D"color:#00a4bd; mso-line-height-rule:exactly=
" data-hs-link-id=3D"11">
        <img alt=3D"ray-so-export (24)" src=3D"https://email.wordfence.com/=
hs-fs/hubfs/ray-so-export%20(24).png?width=3D1120&amp;upscale=3Dtrue&amp;na=
me=3Dray-so-export%20(24).png" style=3D"outline:none; text-decoration:none;=
 -ms-interpolation-mode:bicubic; border:none; max-width:100%; font-size:16p=
x" width=3D"560" align=3D"middle" srcset=3D"https://email.wordfence.com/hs-=
fs/hubfs/ray-so-export%20(24).png?upscale=3Dtrue&amp;width=3D1120&amp;upsca=
le=3Dtrue&amp;name=3Dray-so-export%20(24).png 560w, https://email.wordfence=
.com/hs-fs/hubfs/ray-so-export%20(24).png?upscale=3Dtrue&amp;width=3D2240&a=
mp;upscale=3Dtrue&amp;name=3Dray-so-export%20(24).png 1120w" sizes=3D"(max-=
width: 560px) 100vw, 560px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module_170240297487717" class=3D=
"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"=
color: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-gene=
ral-type=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapper_m=
odule_170240297487717_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_co=
s_wrapper_type_rich_text" style=3D"color: inherit; font-size: inherit; line=
-height: inherit;" data-hs-cos-general-type=3D"widget" data-hs-cos-type=3D"=
rich_text"><p style=3D"mso-line-height-rule:exactly; line-height:175%">The =
=E2=80=9Ccolor=E2=80=9D data is a JS variable, so it is recommended to use =
the&nbsp;esc_js()&nbsp;function.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">The following s=
cript will be displayed in the post if the attacker tries using the same ma=
licious shortcode:</p></div></div></td></tr></tbody></table>
<div id=3D"hs_cos_wrapper_module_170240298835618" class=3D"hs_cos_wrapper h=
s_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; f=
ont-size: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widge=
t" data-hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"p=
resentation" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"bo=
rder-spacing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; =
mso-table-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMV=
WfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FPY5nR32W69t95C6lZ3pqW5vZh-M7GlSsmVVbvL=
J7t1J5LW419SCl2JRCFhW13DK4Q42lZWfW5dPFlP2HsRh-VZny4C6xTb2sN87hzgxpsSCcW38ZY=
Pd6j2b5kVV_mzk1pm-M8VGsWcq42v6D2W5Hd9tK5Y0wJTW8RtwJ-1qFFTJVpn-wV850bT4W2B_3=
3Q1WKH2wW8F2YXD12L1xHVMBLVN6KH-zsW2sCT-33TmKP6W22nBbd1bNN6NW2WnRB12hzkHFW2F=
vLt026NdkSW6jdPSD5f1WkJW9hslFy9crS0QW895z7w83t4y-W5ppcq-2CFC77N2Gq1VqGhhvrW=
2nKthq8ssgkBW6Cz4Zd72GC7mW58H-J62DfYhgW7K9b3k8xckSPW4V8wW26YCjqZW1Km5s-76Fl=
QMW4hMBVK6xjR1-N2xXbB44dMZ9N5h4xTZspCWwW2Xjlt05nH-mBW8hBfmC2yWqVsf16tbJY04"=
 target=3D"_blank" style=3D"color:#00a4bd; mso-line-height-rule:exactly" da=
ta-hs-link-id=3D"12">
        <img alt=3D"ray-so-export (25)" src=3D"https://email.wordfence.com/=
hs-fs/hubfs/ray-so-export%20(25).png?width=3D1120&amp;upscale=3Dtrue&amp;na=
me=3Dray-so-export%20(25).png" style=3D"outline:none; text-decoration:none;=
 -ms-interpolation-mode:bicubic; border:none; max-width:100%; font-size:16p=
x" width=3D"560" align=3D"middle" srcset=3D"https://email.wordfence.com/hs-=
fs/hubfs/ray-so-export%20(25).png?upscale=3Dtrue&amp;width=3D1120&amp;upsca=
le=3Dtrue&amp;name=3Dray-so-export%20(25).png 560w, https://email.wordfence=
.com/hs-fs/hubfs/ray-so-export%20(25).png?upscale=3Dtrue&amp;width=3D2240&a=
mp;upscale=3Dtrue&amp;name=3Dray-so-export%20(25).png 1120w" sizes=3D"(max-=
width: 560px) 100vw, 560px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module_170240303037319" class=3D=
"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"=
color: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-gene=
ral-type=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapper_m=
odule_170240303037319_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_co=
s_wrapper_type_rich_text" style=3D"color: inherit; font-size: inherit; line=
-height: inherit;" data-hs-cos-general-type=3D"widget" data-hs-cos-type=3D"=
rich_text"><h2 style=3D"margin:0; mso-line-height-rule:exactly; line-height=
:175%; font-size:22px">Conclusion</h2>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">In this blog po=
st, we have detailed Stored Shortcode-Based XSS vulnerabilities within seve=
ral WordPress repository plugins. This vulnerability allows authenticated t=
hreat actors with contributor-level permissions or higher to inject malicio=
us web scripts into pages that execute when a user accesses an affected pag=
e. As with all XSS vulnerabilities, a malicious payload could be used to pe=
rform actions as an administrator, including adding new malicious administr=
ator users to the site and embedding backdoors in plugin and theme files, a=
s well as redirecting users to malicious sites.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">We encourage Wo=
rdPress users to verify that their sites are updated to the latest patched =
version of each impacted plugin. For unpatched plugins that have been close=
d by the WordPress.org security team, we recommend that WordPress users del=
ete the affected plugin and look for an alternative solution.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">All Wordfence u=
sers, including those running&nbsp;<a href=3D"https://email.wordfence.com/e=
3t/Ctc/GC+113/cwG7R04/MVXMVWfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FQR3qgyTW7Y8=
-PT6lZ3msW6f2p4l9cwX5-W5KQVvH4V4d1WW3QhY2Y5L-9mHW1vhxHT71csHdW7Dngm36p0HplW=
5GdWwr8wFxvrW7HspnM1wsZhlW52lvwj5ldM2HW6rbMNf9364BdMz6h2Pq2nKsW5wW0l91Zctxb=
W8mgcxd4GzCmFW4PmQZm89NCSHW5PQ3mF1TT7qwW43KG_d1hMKj0W9bMMZX892DJ8W5ttDmK7x9=
sdmW2r6-F16l4C5lW67H5g83b_DM0W9cP37_853kg7W6fFHS568hrRHW8nX_GC7tD-jHW1XQzzB=
75g3NWW17kQ2B4XVbgKN8H4prvh58MXW8JGJ4Z1M8Jhtf7C96F404" target=3D"_blank" re=
l=3D"noopener" style=3D"color:#00a4bd; mso-line-height-rule:exactly" data-h=
s-link-id=3D"1">Wordfence Premium</a>,&nbsp;<a href=3D"https://email.wordfe=
nce.com/e3t/Ctc/GC+113/cwG7R04/MVXMVWfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FQR=
3qgyTW7Y8-PT6lZ3pHW3mRqGT5HCk8ZW6Y_s_n5svrvzW1w4d42556Y50W2mSckz9dXHhhW2GNq=
Q26pR8dbW23CX_v5kjkKQW4tTNkn86NnPLW8WXsw02f_HdqW1mxmc696bhbTW6rlrrW8NsvvHN3=
R0s9xLs4v8W3WFHKv7pBJBvW2L-RH73Bd2znW2_rzBv7LKVNGW8pQfgt5rbtj7N93tFyQxfdK_W=
7ClBSK8FVWktVFGGpn9cJLn2W2TBDTq85p2nvW2Lz21p5_BzxpW1xY4tt8d-Zf2W3GBKbf1LTzQ=
PVp8LtB94MsTrW1gF9Qj8m9FmcW24bWqz1_PhQ4W411tR53NXX_Cf3ssskP04" target=3D"_b=
lank" rel=3D"noopener" style=3D"color:#00a4bd; mso-line-height-rule:exactly=
" data-hs-link-id=3D"1">Wordfence Care</a>, and&nbsp;<a href=3D"https://ema=
il.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMVWfTg7ZW92pV3h7_3C90W3Z50n156-6=
DHN5j5FQR3qgyTW7Y8-PT6lZ3k-W7WdFr35P89C7Vb22gq1ly4nFW4xnzfy8457FnW3_HlJV96C=
P1LVqVjM21yBV4TN7sTbXkXLlHwW1xjRnb7_r221M9Y0Yw8y6l-W6H5yxn7Jb9HbW3s5bMV4-Nz=
PHW9jSNyQ2M512mN5Z6BqZrGwhfW3x8qyY6pk3s1N7Ch5c9BfsyKVln6N46RQTljW6mnd2p1NQY=
33W5YBDZM5hjHkYW1DtMbn5TCj6SW69s1tw91PBmYW7HgG6d4jRvFYW5xjVFB6thRTDW5SrzWK6=
cWl87W7zWpJm26g1pYW1lnNYj7BMgtSW3cpsmZ7glKkNW98jSLp1XWMsYf8-5G2W04" target=
=3D"_blank" rel=3D"noopener" style=3D"color:#00a4bd; mso-line-height-rule:e=
xactly" data-hs-link-id=3D"1">Wordfence Response</a>, as well as sites stil=
l running the free version of Wordfence, are fully protected against this t=
ype of vulnerability.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">If you know som=
eone who uses any of these plugins on their site, we recommend sharing this=
 advisory with them to ensure their site remains secure, as this type of vu=
lnerability poses a significant risk.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">For security re=
searchers looking to disclose vulnerabilities responsibly and obtain a CVE =
ID, you can submit your findings to Wordfence Intelligence and potentially =
earn a spot on our leaderboard.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%"><em>Did you kno=
w that Wordfence has a&nbsp;<a href=3D"https://email.wordfence.com/e3t/Ctc/=
GC+113/cwG7R04/MVXMVWfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FR63qgyTW8wLKSR6lZ3=
ndW6KN1NX12vMrTW81hSrB9jmb0hW1FWP5H9jcrVsW1xFT1f3MKLmnF1DbkpRKj1vW11zzCV13L=
QxcW6_V3xl3yMcQqW7XhvXs45Ltd3W74glry27P3X-N7nVpX9lgSDbW4tC1Fw22rFkkW4tTkmz2=
JXBrvW7Nznv93ps8sZW7twQMF95NDPbW905hHl9fCqQvMkz9rnwbjv6W685Mdk9bqDTTW5zQSpF=
33xJMrN5Qcx-M2H6N1W27lx9X5XS5wdN4vB8pJG1ZklW3FwWcg1tLWYNW5b-P453tXr56W2Qw7Z=
b89Q97TMDSXmSkt97gW3d789-3WWQnWW60DZj42zw3ZTW7TRbnJ4gRdKTf3FK_cP04" target=
=3D"_blank" rel=3D"noopener" style=3D"color:#00a4bd; mso-line-height-rule:e=
xactly" data-hs-link-id=3D"0">Bug Bounty Program</a>? We=E2=80=99ve recentl=
y increased our bounties by 6.25x until December 20th, 2023, with our bount=
ies for the most critical vulnerabilities reaching $10,000 USD! If you=E2=
=80=99re an aspiring or current vulnerability researcher,&nbsp;<a href=3D"h=
ttps://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMVWfTg7ZW92pV3h7_3C90W=
3Z50n156-6DHN5j5FR63qgyTW8wLKSR6lZ3mBW1_FHgr6YtBYKW44W7Zd43NBVtW4268-m97TB2=
ZW8Y07VX73LQxPW7XPhlf6dFP6MN3NdHttXZ4cYW8XzVHb4lHmmKW2zGh9Q81fpRVW5R_Bt33mB=
_pdW8mcBcB3XgklZW2Lt6FC1yZmF9W2BpKct5Kgl2WW96ZJ2F3_rV_4W9grjB81_KynWW5qv8fR=
6ZSkDgW6scRBz7B_VtdW3w5jn64dz6YcW3WLTW97NswBwW2F_-d35sMZ5YW6-0ZDk3NsZCsW6gJ=
KZb2Q5sH8W6yRHtk5NGyYGW77BhvY54s3sHW7F3zF-6b55KsVFl-qm1rtDRYW6jpcnl8-SNQPW7=
TzPM73Cq27cN2YL9BQWpy0bf66bbd004" target=3D"_blank" rel=3D"noopener" style=
=3D"color:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"1">clic=
k here to sign up.</a></em></p></div></div></td></tr></tbody></table>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:0px 20px 15px"><div id=3D"hs_cos_wrapper_module-3-0-0" class=3D"hs_co=
s_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"color:=
 inherit; font-size: inherit; line-height: inherit;" data-hs-cos-general-ty=
pe=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapper_module-=
3-0-0_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_r=
ich_text" style=3D"color: inherit; font-size: inherit; line-height: inherit=
;" data-hs-cos-general-type=3D"widget" data-hs-cos-type=3D"rich_text"><h2 s=
tyle=3D"margin:0; mso-line-height-rule:exactly; font-size:20px; line-height=
:175%; text-align:center; font-weight:bold" align=3D"center"><span style=3D=
"font-family: Arial, sans-serif; color: #000000;">The Full Product Lineup</=
span></h2></div></div></td></tr></tbody></table>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
    <!--[if (mso)|(IE)]></tr></table><![endif]-->
    </div>
  =20
  </div>
  <div id=3D"section-4" class=3D"hse-section" style=3D"padding-left:10px; p=
adding-right:10px">
   =20
   =20
    <!--[if !((mso)|(IE))]><!-- -->
      <div class=3D"hse-column-container hse-border" style=3D"min-width:280=
px; max-width:600px; Margin-left:auto; Margin-right:auto; border-collapse:c=
ollapse; border-spacing:0; border-left:0px solid #008cc1; border-right:0px =
solid #008cc1; box-sizing:border-box; background-color:#FFFFFF" bgcolor=3D"=
#FFFFFF">
    <!--<![endif]-->
   =20
    <!--[if (mso)|(IE)]>
      <div class=3D"hse-column-container" style=3D"min-width:280px;max-widt=
h:600px;width:100%;Margin-left:auto;Margin-right:auto;border-collapse:colla=
pse;border-spacing:0;">
      <table align=3D"center" style=3D"border-collapse:collapse;mso-table-l=
space:0pt;mso-table-rspace:0pt;width:600px;border-left:0px solid #008CC1;bo=
rder-right:0px solid #008CC1" cellpadding=3D"0" cellspacing=3D"0" role=3D"p=
resentation" class=3D"hse-border" width=3D"600" bgcolor=3D"#FFFFFF">
      <tr style=3D"background-color:#FFFFFF;">
    <![endif]-->
    <!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:200px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"200" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:200px">
<![endif]-->
<div id=3D"column-4-0" class=3D"hse-column hse-size-4">
  <div id=3D"hs_cos_wrapper_module-4-0-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMV=
WfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FQR3qgyTW7Y8-PT6lZ3mJW29X1Tr7VR6ZJW8f0y=
Lr2XhWRnW2-GT8h7dFKgBW7fCxtz8w5qXTW1ZF-Mv84pjWJW8Pwqhr4fw7KzW3bfLWf8nDjQ-W3=
3JmJg4jVGdvW4KY8tk4ZYQ0RW5BC6wB5WzZJzW665CK01RQXHkW1ZnRHx1_7q98W95QPcX6m-Rq=
qW4cm6x166dqLzW5_jtrT69KF1NW8DNxg951zbZzW8PJt-c2rbmpLW6CMGSx2b-HK0N8XlmF4Yl=
FvPW8MQQ7G56jx_vW7p90HQ1LXQQ8W6Jwtq-1PQ8sMW5y02yL5JWgVpW1jWZG98vRrJpVb19ST2=
wSnLJVRPSdX7ZX3Krd5Cccl04" target=3D"_blank" style=3D"color:#00a4bd; mso-li=
ne-height-rule:exactly" data-hs-link-id=3D"0">
        <img alt=3D"wf-stacked-free-1" src=3D"https://email.wordfence.com/h=
s-fs/hubfs/wf-stacked-free-1.jpg?width=3D200&amp;upscale=3Dtrue&amp;name=3D=
wf-stacked-free-1.jpg" style=3D"outline:none; text-decoration:none; -ms-int=
erpolation-mode:bicubic; border:none; max-width:100%; font-size:16px" width=
=3D"100" align=3D"middle" srcset=3D"https://email.wordfence.com/hs-fs/hubfs=
/wf-stacked-free-1.jpg?upscale=3Dtrue&amp;width=3D200&amp;upscale=3Dtrue&am=
p;name=3Dwf-stacked-free-1.jpg 100w, https://email.wordfence.com/hs-fs/hubf=
s/wf-stacked-free-1.jpg?upscale=3Dtrue&amp;width=3D400&amp;upscale=3Dtrue&a=
mp;name=3Dwf-stacked-free-1.jpg 200w" sizes=3D"(max-width: 100px) 100vw, 10=
0px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
<!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:200px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"200" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:200px">
<![endif]-->
<div id=3D"column-4-1" class=3D"hse-column hse-size-4">
  <div id=3D"hs_cos_wrapper_module-4-1-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMV=
WfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FQR3qgyTW7Y8-PT6lZ3pVW6cdjmj2jCpVhW2nfb=
tf1B8QVQW1M9fxr2LF3T_W2VY3TV4qY8vHW1882sl37HJR7W1NTHgY30Fql5VMRhHb7btgZWW3F=
XXkv8sb4hXW3sWg2z1vKQf9W95HlpP2HXkj8V4BRLN2f1FVKW1PgM166K-wp2W2sXPvt4yBgh-W=
4Mh83-854jhwW54r4Lp4r-hPLW8ZKrGC6x52DRW4HMDLH3M8sBbW4H_FQD6GcGk1MzBCLQQSTlM=
W7wYp5T91GX9RW5XZFQx5l7gjVW5v9x3q95pCt2N33x63k_bTYLW2zPYy06Mcz_9W6bK5J47TNV=
nWN185mHCxV8KydpQY0C04" target=3D"_blank" style=3D"color:#00a4bd; mso-line-=
height-rule:exactly" data-hs-link-id=3D"0">
        <img alt=3D"wf-stacked-premium-1" src=3D"https://email.wordfence.co=
m/hs-fs/hubfs/wf-stacked-premium-1.jpg?width=3D200&amp;upscale=3Dtrue&amp;n=
ame=3Dwf-stacked-premium-1.jpg" style=3D"outline:none; text-decoration:none=
; -ms-interpolation-mode:bicubic; border:none; max-width:100%; font-size:16=
px" width=3D"100" align=3D"middle" srcset=3D"https://email.wordfence.com/hs=
-fs/hubfs/wf-stacked-premium-1.jpg?upscale=3Dtrue&amp;width=3D200&amp;upsca=
le=3Dtrue&amp;name=3Dwf-stacked-premium-1.jpg 100w, https://email.wordfence=
.com/hs-fs/hubfs/wf-stacked-premium-1.jpg?upscale=3Dtrue&amp;width=3D400&am=
p;upscale=3Dtrue&amp;name=3Dwf-stacked-premium-1.jpg 200w" sizes=3D"(max-wi=
dth: 100px) 100vw, 100px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
<!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:200px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"200" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:200px">
<![endif]-->
<div id=3D"column-4-2" class=3D"hse-column hse-size-4">
  <div id=3D"hs_cos_wrapper_module-4-2-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMV=
WfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FQR3qgyTW7Y8-PT6lZ3kKW8CS62D1km3qXW41pM=
fT7zFZRLW51Kd1v4W6_BjW3G--nQ6Wkf_7W8kbjGJ8JQrfQN5n0lgjt2Jh5W1rm3Bm5fgX5wW1y=
yqgp1MRc0PF56WK3X-ftZW8sTbnt1vwDTzW2M7BMP7WMxJcW4SnrK16Skv9XW8lcQSj4Y-vwnN5=
mqX93xn5jnW3HqgL_96VmG4W2pqHjK6M6xT9W5h4yXb2xftq9F8vNFm9XksDW3X-YNp1tFl3fW8=
TzM0F2R9t8VW5sLyVK3LhXF3W1Qy7Pt7KkdpkW3YXlyf6zyfZWW287TrW6F9clqW7p-s139195S=
PW1PlNXw5mD1MBf4vZjTH04" target=3D"_blank" style=3D"color:#00a4bd; mso-line=
-height-rule:exactly" data-hs-link-id=3D"0">
        <img alt=3D"wf-stacked-care-3" src=3D"https://email.wordfence.com/h=
s-fs/hubfs/wf-stacked-care-3.jpg?width=3D200&amp;upscale=3Dtrue&amp;name=3D=
wf-stacked-care-3.jpg" style=3D"outline:none; text-decoration:none; -ms-int=
erpolation-mode:bicubic; border:none; max-width:100%; font-size:16px" width=
=3D"100" align=3D"middle" srcset=3D"https://email.wordfence.com/hs-fs/hubfs=
/wf-stacked-care-3.jpg?upscale=3Dtrue&amp;width=3D200&amp;upscale=3Dtrue&am=
p;name=3Dwf-stacked-care-3.jpg 100w, https://email.wordfence.com/hs-fs/hubf=
s/wf-stacked-care-3.jpg?upscale=3Dtrue&amp;width=3D400&amp;upscale=3Dtrue&a=
mp;name=3Dwf-stacked-care-3.jpg 200w" sizes=3D"(max-width: 100px) 100vw, 10=
0px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
    <!--[if (mso)|(IE)]></tr></table><![endif]-->
    </div>
  =20
  </div>
  <div id=3D"section-5" class=3D"hse-section" style=3D"padding-left:10px; p=
adding-right:10px">
   =20
   =20
    <!--[if !((mso)|(IE))]><!-- -->
      <div class=3D"hse-column-container hse-border" style=3D"min-width:280=
px; max-width:600px; Margin-left:auto; Margin-right:auto; border-collapse:c=
ollapse; border-spacing:0; border-left:0px solid #008cc1; border-right:0px =
solid #008cc1; box-sizing:border-box; background-color:#FFFFFF" bgcolor=3D"=
#FFFFFF">
    <!--<![endif]-->
   =20
    <!--[if (mso)|(IE)]>
      <div class=3D"hse-column-container" style=3D"min-width:280px;max-widt=
h:600px;width:100%;Margin-left:auto;Margin-right:auto;border-collapse:colla=
pse;border-spacing:0;">
      <table align=3D"center" style=3D"border-collapse:collapse;mso-table-l=
space:0pt;mso-table-rspace:0pt;width:600px;border-left:0px solid #008CC1;bo=
rder-right:0px solid #008CC1" cellpadding=3D"0" cellspacing=3D"0" role=3D"p=
resentation" class=3D"hse-border" width=3D"600" bgcolor=3D"#FFFFFF">
      <tr style=3D"background-color:#FFFFFF;">
    <![endif]-->
    <!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:200px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"200" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:200px">
<![endif]-->
<div id=3D"column-5-0" class=3D"hse-column hse-size-4">
  <div id=3D"hs_cos_wrapper_module-5-0-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMV=
WfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FQR3qgyTW7Y8-PT6lZ3q5W55wGXk4_rPt0Vm1w_=
l9lD3M6N6T4CYF1W_pzN5b7gk2YDzF1W3ZkDTS17zrRRW6Ts8PM4Q_qP9W2CLzLY6dDKNyW6GpR=
-s6ZmHtxW8rfjfx49HFSZW5dM7kB9m1GysW7ntT1d99-4w5W20Cl817JmT4VW3wQygG6TtqtBW1=
Kw04m6lGgblW46MvBv69vsr1W69qDM65j0n0tW70y6HV1-k9pYVlmHfH1SnxRzW3pvD4v6TXKvV=
VSmkXz4h9mP5VS2jgg2y1rMBW4w-MJh4fC_dHW2v4xCy3d-_BMW6XMy4N3fc8vtW2G5Gyk8CLvN=
8VP8ws86tXcL0f8czMln04" target=3D"_blank" style=3D"color:#00a4bd; mso-line-=
height-rule:exactly" data-hs-link-id=3D"2">
        <img alt=3D"wf-stacked-response-2" src=3D"https://email.wordfence.c=
om/hs-fs/hubfs/wf-stacked-response-2.jpg?width=3D200&amp;upscale=3Dtrue&amp=
;name=3Dwf-stacked-response-2.jpg" style=3D"outline:none; text-decoration:n=
one; -ms-interpolation-mode:bicubic; border:none; max-width:100%; font-size=
:16px" width=3D"100" align=3D"middle" srcset=3D"https://email.wordfence.com=
/hs-fs/hubfs/wf-stacked-response-2.jpg?upscale=3Dtrue&amp;width=3D200&amp;u=
pscale=3Dtrue&amp;name=3Dwf-stacked-response-2.jpg 100w, https://email.word=
fence.com/hs-fs/hubfs/wf-stacked-response-2.jpg?upscale=3Dtrue&amp;width=3D=
400&amp;upscale=3Dtrue&amp;name=3Dwf-stacked-response-2.jpg 200w" sizes=3D"=
(max-width: 100px) 100vw, 100px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
<!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:200px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"200" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:200px">
<![endif]-->
<div id=3D"column-5-1" class=3D"hse-column hse-size-4">
  <div id=3D"hs_cos_wrapper_module-5-1-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMV=
WfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FQR3qgyTW7Y8-PT6lZ3lmVS_NH_7j3w-MW36kGS=
06qRBxSW5TtT-14Gm8vRW3xLyKy62GPm5W3JCzwm3FKDrRW5WwwjW88pk-JW7Mkf_H4gXRk-W6k=
CZlf1lF-twW1pyV6T4SHT2mW6MYtkk4D_d4vW57K77w1xfG1NW3svwjH4d1lXhVMsVcX4RW_jFW=
76Qjc92L5ly1N3Zf9T86_8n9Vv1RSQ4_gBK4W7qlHTg9k7VRCW7mfxLc7B7bjWV-ZgHj8MY1T8W=
8hZtjV6XbVw0W3wktLN2cSk90W3H_0tG9klXv7W8g3pgR85ZFKLW6M9LRD8NybHKN2LFKmP1FL7=
-W44F7fg5lhBcGf6ry8js04" target=3D"_blank" style=3D"color:#00a4bd; mso-line=
-height-rule:exactly" data-hs-link-id=3D"0">
        <img alt=3D"wf-stacked-cli" src=3D"https://email.wordfence.com/hs-f=
s/hubfs/wf-stacked-cli.png?width=3D200&amp;upscale=3Dtrue&amp;name=3Dwf-sta=
cked-cli.png" style=3D"outline:none; text-decoration:none; -ms-interpolatio=
n-mode:bicubic; border:none; max-width:100%; font-size:16px" width=3D"100" =
align=3D"middle" srcset=3D"https://email.wordfence.com/hs-fs/hubfs/wf-stack=
ed-cli.png?upscale=3Dtrue&amp;width=3D200&amp;upscale=3Dtrue&amp;name=3Dwf-=
stacked-cli.png 100w, https://email.wordfence.com/hs-fs/hubfs/wf-stacked-cl=
i.png?upscale=3Dtrue&amp;width=3D400&amp;upscale=3Dtrue&amp;name=3Dwf-stack=
ed-cli.png 200w" sizes=3D"(max-width: 100px) 100vw, 100px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
<!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:200px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"200" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:200px">
<![endif]-->
<div id=3D"column-5-2" class=3D"hse-column hse-size-4">
  <div id=3D"hs_cos_wrapper_module-5-2-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMV=
WfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FQx3qgyTW7lCdLW6lZ3njW5bqPwX3dzcYZW8B1b=
Xm2J35szW1GK52H4GDlW0W3jRHPr7rgP8YW2n0Jjz1pLHjRW2qbP2b51QV1BW6Vgs3L9k_p55W4=
G--5D13_0DCW8YhQxZ5pKVYQF8ZxK0xrTSDW9j85_n4PJwqbW1TwQC731GKLDW1yBtz65WZHxJW=
5xjvW36vgxCyW234qb06J1PKcW3G_sm939L747W8VWZSt6tPm5BW3HsjlN8Jn4yBW2pDv172JBS=
wKW1zwxcs95Fjr6W2YLM1V3dmFtcW8j3ZDs4HFYVPW3pkv--39mHwDW1qLM4896BGlFf7cTtpT0=
4" target=3D"_blank" style=3D"color:#00a4bd; mso-line-height-rule:exactly" =
data-hs-link-id=3D"0">
        <img alt=3D"wf-stacked-intelligence" src=3D"https://email.wordfence=
.com/hs-fs/hubfs/wf-stacked-intelligence.png?width=3D200&amp;upscale=3Dtrue=
&amp;name=3Dwf-stacked-intelligence.png" style=3D"outline:none; text-decora=
tion:none; -ms-interpolation-mode:bicubic; border:none; max-width:100%; fon=
t-size:16px" width=3D"100" align=3D"middle" srcset=3D"https://email.wordfen=
ce.com/hs-fs/hubfs/wf-stacked-intelligence.png?upscale=3Dtrue&amp;width=3D2=
00&amp;upscale=3Dtrue&amp;name=3Dwf-stacked-intelligence.png 100w, https://=
email.wordfence.com/hs-fs/hubfs/wf-stacked-intelligence.png?upscale=3Dtrue&=
amp;width=3D400&amp;upscale=3Dtrue&amp;name=3Dwf-stacked-intelligence.png 2=
00w" sizes=3D"(max-width: 100px) 100vw, 100px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
    <!--[if (mso)|(IE)]></tr></table><![endif]-->
    </div>
  =20
  </div>
  <div id=3D"section-6" class=3D"hse-section" style=3D"padding-left:10px; p=
adding-right:10px">
   =20
   =20
    <!--[if !((mso)|(IE))]><!-- -->
      <div class=3D"hse-column-container hse-border" style=3D"min-width:280=
px; max-width:600px; Margin-left:auto; Margin-right:auto; border-collapse:c=
ollapse; border-spacing:0; border-left:0px solid #008cc1; border-right:0px =
solid #008cc1; box-sizing:border-box; background-color:#FFFFFF" bgcolor=3D"=
#FFFFFF">
    <!--<![endif]-->
   =20
    <!--[if (mso)|(IE)]>
      <div class=3D"hse-column-container" style=3D"min-width:280px;max-widt=
h:600px;width:100%;Margin-left:auto;Margin-right:auto;border-collapse:colla=
pse;border-spacing:0;">
      <table align=3D"center" style=3D"border-collapse:collapse;mso-table-l=
space:0pt;mso-table-rspace:0pt;width:600px;border-left:0px solid #008CC1;bo=
rder-right:0px solid #008CC1" cellpadding=3D"0" cellspacing=3D"0" role=3D"p=
resentation" class=3D"hse-border" width=3D"600" bgcolor=3D"#FFFFFF">
      <tr style=3D"background-color:#FFFFFF;">
    <![endif]-->
    <!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:600px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"600" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:600px">
<![endif]-->
<div id=3D"column-6-0" class=3D"hse-column hse-size-12">
  <table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D=
"100%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-=
table-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" =
style=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-famil=
y:Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; =
padding:10px 20px"><div id=3D"hs_cos_wrapper_module-6-0-0" class=3D"hs_cos_=
wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"color: i=
nherit; font-size: inherit; line-height: inherit;" data-hs-cos-general-type=
=3D"widget" data-hs-cos-type=3D"module"><!--[if gte mso 9]>
<div style=3D"line-height: 0; font-size: 0px">
  <v:rect xmlns:v=3D"urn:schemas-microsoft-com:vml" fill=3D"true" stroke=3D=
"false" style=3D"width:560px; height:2pt;" fillcolor=3D"none">
    <v:fill type=3D"tile"/>
    <v:textbox inset=3D"0,0,0,0">
      <div>
<![endif]-->
<table role=3D"presentation" width=3D"100%" align=3D"center" border=3D"0" s=
tyle=3D"position:relative; top:-1px; min-width:20px; width:100%; max-width:=
100%; border-spacing:0; mso-table-lspace:0pt; mso-table-rspace:0pt; border-=
collapse:collapse; font-size:1px">
  <tbody><tr><td width=3D"100%" valign=3D"middle" style=3D"border-collapse:=
collapse; mso-line-height-rule:exactly; font-family:Arial, sans-serif; font=
-size:15px; color:#525355; word-break:break-word; line-height:0; border:tra=
nsparent; border-bottom:2px solid #EEEEEE; mso-border-bottom-alt:2pt solid =
#EEEEEE; border-bottom-width:2px"><!--[if mso 16]>&nbsp;<![endif]--></td></=
tr>
</tbody></table>
<!--[if gte mso 9]>
      </div>
    </v:textbox>
  </v:rect>
</div>
<![endif]--></div></td></tr></tbody></table>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
    <!--[if (mso)|(IE)]></tr></table><![endif]-->
    </div>
  =20
  </div>
  <div id=3D"section-7" class=3D"hse-section" style=3D"padding-left:10px; p=
adding-right:10px">
   =20
   =20
    <!--[if !((mso)|(IE))]><!-- -->
      <div class=3D"hse-column-container hse-border" style=3D"min-width:280=
px; max-width:600px; Margin-left:auto; Margin-right:auto; border-collapse:c=
ollapse; border-spacing:0; border-left:0px solid #008cc1; border-right:0px =
solid #008cc1; box-sizing:border-box; background-color:#FFFFFF" bgcolor=3D"=
#FFFFFF">
    <!--<![endif]-->
   =20
    <!--[if (mso)|(IE)]>
      <div class=3D"hse-column-container" style=3D"min-width:280px;max-widt=
h:600px;width:100%;Margin-left:auto;Margin-right:auto;border-collapse:colla=
pse;border-spacing:0;">
      <table align=3D"center" style=3D"border-collapse:collapse;mso-table-l=
space:0pt;mso-table-rspace:0pt;width:600px;border-left:0px solid #008CC1;bo=
rder-right:0px solid #008CC1" cellpadding=3D"0" cellspacing=3D"0" role=3D"p=
resentation" class=3D"hse-border" width=3D"600" bgcolor=3D"#FFFFFF">
      <tr style=3D"background-color:#FFFFFF;">
    <![endif]-->
    <!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:400px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"400" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:400px">
<![endif]-->
<div id=3D"column-7-0" class=3D"hse-column hse-size-8">
  <div id=3D"hs_cos_wrapper_module-7-0-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"left" valign=3D"top" style=3D"border=
-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans-s=
erif; color:#525355; word-break:break-word; text-align:left; padding:20px 2=
0px 0px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMV=
WfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FQd3qgyTW6N1vHY6lZ3m2W10Yqxr99PY4fW3-cm=
5t6YJRVDVYRG_f9hV-RyN6wZgW68jGRtN34KlBWHKs9CW56nXLc491wYcW8q3n8r3pfntBV7DM7=
P9fHltyN4g56Nh8m0yzN7YR_rC89wKLW13H3wr3tzQF9W5GQSt94lxTm_N44cWPKCvfXMN4k4bH=
PRfXmGW7m-1sw81THj1W8rRc2P6ZTkJdW5d8C9y8bpbFKW1ZQMxG96rFz0W8PvV7F8mZQhNW8KC=
MH_5gLCF3W1Vvjxp1HlR3GN3Lhzfw1m8h3f1ntLNK04" target=3D"_blank" style=3D"col=
or:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"0">
        <img alt=3D"logo-defiant" src=3D"https://email.wordfence.com/hs-fs/=
hubfs/logo-defiant.png?width=3D200&amp;upscale=3Dtrue&amp;name=3Dlogo-defia=
nt.png" style=3D"outline:none; text-decoration:none; -ms-interpolation-mode=
:bicubic; border:none; max-width:100%; font-size:16px" width=3D"100" align=
=3D"middle" srcset=3D"https://email.wordfence.com/hs-fs/hubfs/logo-defiant.=
png?upscale=3Dtrue&amp;width=3D200&amp;upscale=3Dtrue&amp;name=3Dlogo-defia=
nt.png 100w, https://email.wordfence.com/hs-fs/hubfs/logo-defiant.png?upsca=
le=3Dtrue&amp;width=3D400&amp;upscale=3Dtrue&amp;name=3Dlogo-defiant.png 20=
0w" sizes=3D"(max-width: 100px) 100vw, 100px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
<div id=3D"hs_cos_wrapper_module-7-0-1" class=3D"hs_cos_wrapper hs_cos_wrap=
per_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size: =
inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-hs=
-cos-type=3D"module"><table role=3D"presentation" class=3D"hse-footer hse-s=
econdary" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"borde=
r-spacing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso=
-table-rspace:0pt; font-family:Arial, sans-serif; font-size:12px; line-heig=
ht:135%; color:#23496d; margin-bottom:0; padding:0">
  <tbody>
    <tr>
      <td align=3D"left" valign=3D"top" style=3D"border-collapse:collapse; =
mso-line-height-rule:exactly; font-family:Arial, sans-serif; font-size:15px=
; color:#525355; word-break:break-word; text-align:left; margin-bottom:0; l=
ine-height:135%; padding:10px 20px">
          <p style=3D"mso-line-height-rule:exactly">Defiant, Inc., 1700 Wes=
tlake Ave N STE 200&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly">Seattle, WA &nbsp;98109&nbsp;Unit=
ed States</p>
<p style=3D"mso-line-height-rule:exactly"><a href=3D"https://email.wordfenc=
e.com/hs/manage-preferences/unsubscribe-all?languagePreference=3Den&amp;d=
=3DVnbshC892TtnVCnbkg45v0QyW3_X4wv3SXQ-tW4h29fm6J4V3WVmWcPn6Wq6D9N6TK9Lv25C=
RQW8H-j1P7F0kT0W5kngBL7c4317V1yf0N30ghpMW6W_cJS1YtzpfW62tmL67JhQyV23W3&amp;=
v=3D3&amp;utm_campaign=3DWordfence%20Intelligence%20Marketing&amp;utm_sourc=
e=3Dhs_email&amp;utm_medium=3Demail&amp;utm_content=3D286209999&amp;_hsenc=
=3Dp2ANqtz-_kLbC98Dra9m79XIwnhIFLp5GBmLE77wcHLtVYT4eVvbgA5fgyeqGTSUO3kU38iv=
-yH0YDNrKXcr4MMWhwJixi9k2aTQ&amp;_hsmi=3D286209999" data-unsubscribe=3D"tru=
e" style=3D"color:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D=
"0" target=3D"_blank">Unsubscribe</a> <a href=3D"https://email.wordfence.co=
m/hs/manage-preferences/unsubscribe?languagePreference=3Den&amp;d=3DVnbshC8=
92TtnVCnbkg45v0QyW3_X4wv3SXQ-tW4h29fm6J4V3WVmWcPn6Wq6D9N6TK9Lv25CRQW8H-j1P7=
F0kT0W5kngBL7c4317V1yf0N30ghpMW6W_cJS1YtzpfW62tmL67JhQyV23W3&amp;v=3D3&amp;=
utm_campaign=3DWordfence%20Intelligence%20Marketing&amp;utm_source=3Dhs_ema=
il&amp;utm_medium=3Demail&amp;utm_content=3D286209999&amp;_hsenc=3Dp2ANqtz-=
_kLbC98Dra9m79XIwnhIFLp5GBmLE77wcHLtVYT4eVvbgA5fgyeqGTSUO3kU38iv-yH0YDNrKXc=
r4MMWhwJixi9k2aTQ&amp;_hsmi=3D286209999" data-unsubscribe=3D"true" style=3D=
"color:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"0" target=
=3D"_blank">Manage Preferences</a></p>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
<!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:200px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"200" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:200px">
<![endif]-->
<div id=3D"column-7-1" class=3D"hse-column hse-size-4">
  <div id=3D"hs_cos_wrapper_module-7-1-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/MVXMV=
WfTg7ZW92pV3h7_3C90W3Z50n156-6DHN5j5FQx3qgyTW7lCdLW6lZ3nfW8cWbfH7SpVZ4W15p4=
bQ2n4mXLW4JXcKv53Kvj9W2dwTjl36by3lVDQzTt95_N87VN4X-j3t8qPBN473N3s-7h4BW65r3=
0k8Kbt8WN6922qj3BCvYW2r97sw2Zt10DW94s4-03bT0CVW4yw1fk5h3fKsW3WH78l1HV_51W5Z=
S76y4g9sVvW5mnH_-85WNdLN48rM_b1MllkN95KPtgc56N6W8R3Jbb4j22SyW6v3txL19gJNNW2=
wpyPg56CzrjVXrJ7J6ljVsKW4QzWbW2dtb8hW8wlVVQ665gfXW3kLy5f5F3tDGf4QJRQq04" ta=
rget=3D"_blank" style=3D"color:#00a4bd; mso-line-height-rule:exactly" data-=
hs-link-id=3D"0">
        <img alt=3D"ISO_27001" src=3D"https://email.wordfence.com/hs-fs/hub=
fs/ISO_27001.png?width=3D140&amp;upscale=3Dtrue&amp;name=3DISO_27001.png" s=
tyle=3D"outline:none; text-decoration:none; -ms-interpolation-mode:bicubic;=
 border:none; max-width:100%; font-size:16px" width=3D"70" align=3D"middle"=
 srcset=3D"https://email.wordfence.com/hs-fs/hubfs/ISO_27001.png?upscale=3D=
true&amp;width=3D140&amp;upscale=3Dtrue&amp;name=3DISO_27001.png 70w, https=
://email.wordfence.com/hs-fs/hubfs/ISO_27001.png?upscale=3Dtrue&amp;width=
=3D280&amp;upscale=3Dtrue&amp;name=3DISO_27001.png 140w" sizes=3D"(max-widt=
h: 70px) 100vw, 70px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
    <!--[if (mso)|(IE)]></tr></table><![endif]-->
    </div>
  =20
  </div>
  <div id=3D"section-8" class=3D"hse-section hse-section-last" style=3D"pad=
ding-left:10px; padding-right:10px; padding-bottom:20px">
   =20
   =20
    <!--[if !((mso)|(IE))]><!-- -->
      <div class=3D"hse-column-container hse-border-bottom hse-border" styl=
e=3D"min-width:280px; max-width:600px; Margin-left:auto; Margin-right:auto;=
 border-collapse:collapse; border-spacing:0; border-left:0px solid #008cc1;=
 border-right:0px solid #008cc1; box-sizing:border-box; border-bottom:0px s=
olid #008cc1; background-color:#FFFFFF" bgcolor=3D"#FFFFFF">
    <!--<![endif]-->
   =20
    <!--[if (mso)|(IE)]>
      <div class=3D"hse-column-container" style=3D"min-width:280px;max-widt=
h:600px;width:100%;Margin-left:auto;Margin-right:auto;border-collapse:colla=
pse;border-spacing:0;">
      <table align=3D"center" style=3D"border-collapse:collapse;mso-table-l=
space:0pt;mso-table-rspace:0pt;width:600px;border-bottom:0px solid #008CC1;=
border-left:0px solid #008CC1;border-right:0px solid #008CC1" cellpadding=
=3D"0" cellspacing=3D"0" role=3D"presentation" class=3D"hse-border-bottom h=
se-border" width=3D"600" bgcolor=3D"#FFFFFF">
      <tr style=3D"background-color:#FFFFFF;">
    <![endif]-->
    <!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:600px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"600" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:600px">
<![endif]-->
<div id=3D"column-8-0" class=3D"hse-column hse-size-12">
  <table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D=
"100%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-=
table-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" =
style=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-famil=
y:Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; =
padding:10px 20px"><div id=3D"hs_cos_wrapper_module-8-0-0" class=3D"hs_cos_=
wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"color: i=
nherit; font-size: inherit; line-height: inherit;" data-hs-cos-general-type=
=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapper_module-8-=
0-0_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_ric=
h_text" style=3D"color: inherit; font-size: inherit; line-height: inherit;"=
 data-hs-cos-general-type=3D"widget" data-hs-cos-type=3D"rich_text"><p styl=
e=3D"mso-line-height-rule:exactly; font-size:11px; line-height:175%; text-a=
lign:center" align=3D"center">You're receiving this email because you signe=
d up to the Wordfence WordPress security mailing list.</p></div></div></td>=
</tr></tbody></table>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
    <!--[if (mso)|(IE)]></tr></table><![endif]-->
    </div>
  =20
  </div></div>
          </td>
        </tr>
      </tbody></table>
    </div>
 =20
<img src=3D"https://email.wordfence.com/e3t/Cto/GC+113/cwG7R04/MVXMVWfTg7ZW=
92pV3h7_3C90W3Z50n156-6DHW5j5Fzk3D2Fr7122" alt=3D"" width=3D"1" height=3D"1=
" border=3D"0" style=3D"display:none!important;min-height:1px!important;wid=
th:1px!important;border-width:0!important;margin-top:0!important;margin-bot=
tom:0!important;margin-right:0!important;margin-left:0!important;padding-to=
p:0!important;padding-bottom:0!important;padding-right:0!important;padding-=
left:0!important"></body></html>
------=_Part_20917128_1451627436.1702406103119--

