Wordfence Security – Firewall & Malware Scan - Version 6.0.22

Version Description

  • Security Fix: Fixed stored XSS vulnerability discovered internally (thanks to Matt Rusnak).
  • Enhancement: Added additional Sucuri scanner IP to our whitelist.
Download this release

Release Info

Developer wfmatt
Plugin Icon 128x128 Wordfence Security – Firewall & Malware Scan
Version 6.0.22
Comparing to
See all releases

Code changes from version 6.0.21 to 6.0.22

Files changed (7) hide show
  1. lib/wfIssues.php +1 -0
  2. lib/wfLog.php +2 -2
  3. lib/wfScanEngine.php +10 -10
  4. lib/wordfenceConstants.php +1 -1
  5. lib/wordfenceScanner.php +19 -20
  6. readme.txt +7 -3
  7. wordfence.php +2 -2
lib/wfIssues.php CHANGED
@@ -157,6 +157,7 @@ class wfIssues {
157
  foreach($q1 as $i){
158
  $i['data'] = unserialize($i['data']);
159
  $i['timeAgo'] = wfUtils::makeTimeAgo(time() - $i['time']);
 
160
  if($i['status'] == 'new'){
161
  $ret['new'][] = $i;
162
  } else if($i['status'] == 'ignoreP' || $i['status'] == 'ignoreC'){
157
  foreach($q1 as $i){
158
  $i['data'] = unserialize($i['data']);
159
  $i['timeAgo'] = wfUtils::makeTimeAgo(time() - $i['time']);
160
+ $i['longMsg'] = wp_kses($i['longMsg'], 'post');
161
  if($i['status'] == 'new'){
162
  $ret['new'][] = $i;
163
  } else if($i['status'] == 'ignoreP' || $i['status'] == 'ignoreC'){
lib/wfLog.php CHANGED
@@ -178,7 +178,7 @@ class wfLog {
178
  return true;
179
  }
180
  //These belong to sucuri's scanning servers which will get blocked by Wordfence as a false positive if you try a scan. So we whitelisted them.
181
- $externalWhite = array('97.74.127.171', '69.164.203.172', '173.230.128.135', '66.228.34.49', '66.228.40.185', '50.116.36.92', '50.116.36.93', '50.116.3.171', '198.58.96.212', '50.116.63.221', '192.155.92.112', '192.81.128.31', '198.58.106.244', '192.155.95.139', '23.239.9.227', '198.58.112.103', '192.155.94.43', '162.216.16.33', '173.255.233.124', '173.255.233.124', '192.155.90.179', '50.116.41.217', '192.81.129.227', '198.58.111.80');
182
  if (in_array($IP, $externalWhite)) {
183
  return true;
184
  }
@@ -219,7 +219,7 @@ class wfLog {
219
  }
220
 
221
  // These belong to sucuri's scanning servers which will get blocked by Wordfence as a false positive if you try a scan. So we whitelisted them.
222
- $white_listed_ips = array_merge($white_listed_ips, array_map(array('wfUtils', 'inet_pton'), array('97.74.127.171', '69.164.203.172', '173.230.128.135', '66.228.34.49', '66.228.40.185', '50.116.36.92', '50.116.36.93', '50.116.3.171', '198.58.96.212', '50.116.63.221', '192.155.92.112', '192.81.128.31', '198.58.106.244', '192.155.95.139', '23.239.9.227', '198.58.112.103', '192.155.94.43', '162.216.16.33', '173.255.233.124', '173.255.233.124', '192.155.90.179', '50.116.41.217', '192.81.129.227', '198.58.111.80')));
223
 
224
  if ($user_whitelisted === null) {
225
  $user_whitelisted = wfConfig::get('whitelisted');
178
  return true;
179
  }
180
  //These belong to sucuri's scanning servers which will get blocked by Wordfence as a false positive if you try a scan. So we whitelisted them.
181
+ $externalWhite = array('97.74.127.171', '69.164.203.172', '173.230.128.135', '66.228.34.49', '66.228.40.185', '50.116.36.92', '50.116.36.93', '50.116.3.171', '198.58.96.212', '50.116.63.221', '192.155.92.112', '192.81.128.31', '198.58.106.244', '192.155.95.139', '23.239.9.227', '198.58.112.103', '192.155.94.43', '162.216.16.33', '173.255.233.124', '173.255.233.124', '192.155.90.179', '50.116.41.217', '192.81.129.227', '198.58.111.80', '162.216.19.183');
182
  if (in_array($IP, $externalWhite)) {
183
  return true;
184
  }
219
  }
220
 
221
  // These belong to sucuri's scanning servers which will get blocked by Wordfence as a false positive if you try a scan. So we whitelisted them.
222
+ $white_listed_ips = array_merge($white_listed_ips, array_map(array('wfUtils', 'inet_pton'), array('97.74.127.171', '69.164.203.172', '173.230.128.135', '66.228.34.49', '66.228.40.185', '50.116.36.92', '50.116.36.93', '50.116.3.171', '198.58.96.212', '50.116.63.221', '192.155.92.112', '192.81.128.31', '198.58.106.244', '192.155.95.139', '23.239.9.227', '198.58.112.103', '192.155.94.43', '162.216.16.33', '173.255.233.124', '173.255.233.124', '192.155.90.179', '50.116.41.217', '192.81.129.227', '198.58.111.80', '162.216.19.183')));
223
 
224
  if ($user_whitelisted === null) {
225
  $user_whitelisted = wfConfig::get('whitelisted');
lib/wfScanEngine.php CHANGED
@@ -465,11 +465,11 @@ class wfScanEngine {
465
  $type = $this->scanData[$idString]['type'];
466
  foreach($hresults as $result){
467
  if($result['badList'] == 'goog-malware-shavar'){
468
- $shortMsg = "$uctype contains a suspected malware URL: " . $this->scanData[$idString]['title'];
469
- $longMsg = "This $type contains a suspected malware URL listed on Google's list of malware sites. The URL is: " . $result['URL'] . " - More info available at <a href=\"http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=" . urlencode($result['URL']) . "&client=googlechrome&hl=en-US\" target=\"_blank\">Google Safe Browsing diagnostic page</a>.";
470
  } else if($result['badList'] == 'googpub-phish-shavar'){
471
- $shortMsg = "$uctype contains a suspected phishing site URL: " . $this->scanData[$idString]['title'];
472
- $longMsg = "This $type contains a URL that is a suspected phishing site that is currently listed on Google's list of known phishing sites. The URL is: " . $result['URL'];
473
  } else {
474
  //A list type that may be new and the plugin has not been upgraded yet.
475
  continue;
@@ -558,11 +558,11 @@ class wfScanEngine {
558
  $type = $this->scanData[$idString]['type'];
559
  foreach($hresults as $result){
560
  if($result['badList'] == 'goog-malware-shavar'){
561
- $shortMsg = "$uctype with author " . $this->scanData[$idString]['author'] . " contains a suspected malware URL.";
562
- $longMsg = "This $type contains a suspected malware URL listed on Google's list of malware sites. The URL is: " . $result['URL'] . " - More info available at <a href=\"http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=" . urlencode($result['URL']) . "&client=googlechrome&hl=en-US\" target=\"_blank\">Google Safe Browsing diagnostic page</a>.";
563
  } else if($result['badList'] == 'googpub-phish-shavar'){
564
  $shortMsg = "$uctype contains a suspected phishing site URL.";
565
- $longMsg = "This $type contains a URL that is a suspected phishing site that is currently listed on Google's list of known phishing sites. The URL is: " . $result['URL'];
566
  } else {
567
  //A list type that may be new and the plugin has not been upgraded yet.
568
  continue;
@@ -719,12 +719,12 @@ class wfScanEngine {
719
  $this->status(4, 'info', "Checking password strength of user '" . $userDat->user_login . "'");
720
  $highCap = $this->highestCap($userDat->wp_capabilities);
721
  if($this->isEditor($userDat->wp_capabilities)){
722
- $shortMsg = "User \"" . $userDat->user_login . "\" with \"" . $highCap . "\" access has an easy password.";
723
- $longMsg = "A user with the a role of '" . $highCap . "' has a password that is easy to guess. Please change this password yourself or ask the user to change it.";
724
  $level = 1;
725
  $words = $this->dictWords;
726
  } else {
727
- $shortMsg = "User \"" . $userDat->user_login . "\" with 'subscriber' access has a very easy password.";
728
  $longMsg = "A user with 'subscriber' access has a password that is very easy to guess. Please either change it or ask the user to change their password.";
729
  $level = 2;
730
  $words = array($userDat->user_login);
465
  $type = $this->scanData[$idString]['type'];
466
  foreach($hresults as $result){
467
  if($result['badList'] == 'goog-malware-shavar'){
468
+ $shortMsg = "$uctype contains a suspected malware URL: " . esc_html($this->scanData[$idString]['title']);
469
+ $longMsg = "This $type contains a suspected malware URL listed on Google's list of malware sites. The URL is: " . esc_html($result['URL']) . " - More info available at <a href=\"http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=" . urlencode($result['URL']) . "&client=googlechrome&hl=en-US\" target=\"_blank\">Google Safe Browsing diagnostic page</a>.";
470
  } else if($result['badList'] == 'googpub-phish-shavar'){
471
+ $shortMsg = "$uctype contains a suspected phishing site URL: " . esc_html($this->scanData[$idString]['title']);
472
+ $longMsg = "This $type contains a URL that is a suspected phishing site that is currently listed on Google's list of known phishing sites. The URL is: " . esc_html($result['URL']);
473
  } else {
474
  //A list type that may be new and the plugin has not been upgraded yet.
475
  continue;
558
  $type = $this->scanData[$idString]['type'];
559
  foreach($hresults as $result){
560
  if($result['badList'] == 'goog-malware-shavar'){
561
+ $shortMsg = "$uctype with author " . esc_html($this->scanData[$idString]['author']) . " contains a suspected malware URL.";
562
+ $longMsg = "This $type contains a suspected malware URL listed on Google's list of malware sites. The URL is: " . esc_html($result['URL']) . " - More info available at <a href=\"http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=" . urlencode($result['URL']) . "&client=googlechrome&hl=en-US\" target=\"_blank\">Google Safe Browsing diagnostic page</a>.";
563
  } else if($result['badList'] == 'googpub-phish-shavar'){
564
  $shortMsg = "$uctype contains a suspected phishing site URL.";
565
+ $longMsg = "This $type contains a URL that is a suspected phishing site that is currently listed on Google's list of known phishing sites. The URL is: " . esc_html($result['URL']);
566
  } else {
567
  //A list type that may be new and the plugin has not been upgraded yet.
568
  continue;
719
  $this->status(4, 'info', "Checking password strength of user '" . $userDat->user_login . "'");
720
  $highCap = $this->highestCap($userDat->wp_capabilities);
721
  if($this->isEditor($userDat->wp_capabilities)){
722
+ $shortMsg = "User \"" . esc_html($userDat->user_login) . "\" with \"" . esc_html($highCap) . "\" access has an easy password.";
723
+ $longMsg = "A user with the a role of '" . esc_html($highCap) . "' has a password that is easy to guess. Please change this password yourself or ask the user to change it.";
724
  $level = 1;
725
  $words = $this->dictWords;
726
  } else {
727
+ $shortMsg = "User \"" . esc_html($userDat->user_login) . "\" with 'subscriber' access has a very easy password.";
728
  $longMsg = "A user with 'subscriber' access has a password that is very easy to guess. Please either change it or ask the user to change their password.";
729
  $level = 2;
730
  $words = array($userDat->user_login);
lib/wordfenceConstants.php CHANGED
@@ -1,5 +1,5 @@
1
  <?php
2
- define('WORDFENCE_API_VERSION', '2.19');
3
  define('WORDFENCE_API_URL_SEC', 'https://noc1.wordfence.com/');
4
  define('WORDFENCE_API_URL_NONSEC', 'http://noc1.wordfence.com/');
5
  define('WORDFENCE_HACKATTEMPT_URL', 'http://noc3.wordfence.com:9050/');
1
  <?php
2
+ define('WORDFENCE_API_VERSION', '2.20');
3
  define('WORDFENCE_API_URL_SEC', 'https://noc1.wordfence.com/');
4
  define('WORDFENCE_API_URL_NONSEC', 'http://noc1.wordfence.com/');
5
  define('WORDFENCE_HACKATTEMPT_URL', 'http://noc3.wordfence.com:9050/');
lib/wordfenceScanner.php CHANGED
@@ -186,15 +186,14 @@ class wordfenceScanner {
186
  'severity' => 1,
187
  'ignoreP' => $this->path . $file,
188
  'ignoreC' => $fileSum,
189
- 'shortMsg' => "File appears to be malicious: " . $file,
190
- 'longMsg' => "This file appears to be installed by a hacker to perform malicious activity. If you know about this file you can choose to ignore it to exclude it from future scans. The text we found in this file that matches a known malicious file is: <strong style=\"color: #F00;\">\"" . $matches[1] . "\"</strong>.",
191
  'data' => array(
192
  'file' => $file,
193
  'canDiff' => false,
194
  'canFix' => false,
195
  'canDelete' => true
196
- )
197
- ));
198
  break;
199
  }
200
 
@@ -206,15 +205,15 @@ class wordfenceScanner {
206
  'severity' => 1,
207
  'ignoreP' => $this->path . $file,
208
  'ignoreC' => $fileSum,
209
- 'shortMsg' => "This file may contain malicious executable code: " . $this->path . $file,
210
- 'longMsg' => "This file is a PHP executable file and contains an " . $this->patterns['word1'] . " function and " . $this->patterns['word2'] . " decoding function on the same line. This is a common technique used by hackers to hide and execute code. If you know about this file you can choose to ignore it to exclude it from future scans.",
211
  'data' => array(
212
  'file' => $file,
213
  'canDiff' => false,
214
  'canFix' => false,
215
  'canDelete' => true
216
  )
217
- ));
218
  break;
219
  }
220
  }
@@ -235,15 +234,15 @@ class wordfenceScanner {
235
  'severity' => 1,
236
  'ignoreP' => $this->path . $file,
237
  'ignoreC' => $fileSum,
238
- 'shortMsg' => "This file may contain malicious executable code: " . $this->path . $file,
239
- 'longMsg' => "This file is a PHP executable file and contains the word 'eval' (without quotes) and the word '" . $badStringFound . "' (without quotes). The eval() function along with an encoding function like the one mentioned are commonly used by hackers to hide their code. If you know about this file you can choose to ignore it to exclude it from future scans.",
240
  'data' => array(
241
  'file' => $file,
242
  'canDiff' => false,
243
  'canFix' => false,
244
  'canDelete' => true
245
  )
246
- ));
247
  break;
248
  }
249
  }
@@ -290,8 +289,8 @@ class wordfenceScanner {
290
  'severity' => 1,
291
  'ignoreP' => $this->path . $file,
292
  'ignoreC' => md5_file($this->path . $file),
293
- 'shortMsg' => "File contains suspected malware URL: " . $this->path . $file,
294
- 'longMsg' => "This file contains a suspected malware URL listed on Google's list of malware sites. Wordfence decodes " . $this->patterns['word3'] . " when scanning files so the URL may not be visible if you view this file. The URL is: " . $result['URL'] . " - More info available at <a href=\"http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=" . urlencode($result['URL']) . "&client=googlechrome&hl=en-US\" target=\"_blank\">Google Safe Browsing diagnostic page</a>.",
295
  'data' => array(
296
  'file' => $file,
297
  'badURL' => $result['URL'],
@@ -299,8 +298,8 @@ class wordfenceScanner {
299
  'canFix' => false,
300
  'canDelete' => true,
301
  'gsb' => 'goog-malware-shavar'
302
- )
303
- ));
304
  }
305
  } else if($result['badList'] == 'googpub-phish-shavar'){
306
  if(! $this->isSafeFile($this->path . $file)){
@@ -309,8 +308,8 @@ class wordfenceScanner {
309
  'severity' => 1,
310
  'ignoreP' => $this->path . $file,
311
  'ignoreC' => md5_file($this->path . $file),
312
- 'shortMsg' => "File contains suspected phishing URL: " . $this->path . $file,
313
- 'longMsg' => "This file contains a URL that is a suspected phishing site that is currently listed on Google's list of known phishing sites. The URL is: " . $result['URL'],
314
  'data' => array(
315
  'file' => $file,
316
  'badURL' => $result['URL'],
@@ -318,8 +317,8 @@ class wordfenceScanner {
318
  'canFix' => false,
319
  'canDelete' => true,
320
  'gsb' => 'googpub-phish-shavar'
321
- )
322
- ));
323
  }
324
  }
325
  }
@@ -386,8 +385,8 @@ class wordfenceDBScanner extends wordfenceScanner {
386
  'severity' => 1,
387
  'ignoreP' => "{$db->prefix()}option.{$row['option_name']}",
388
  'ignoreC' => md5($row['option_value']),
389
- 'shortMsg' => "This option may contain malicious executable code: {$row['option_name']}",
390
- 'longMsg' => "This option appears to be inserted by a hacker to perform malicious activity. If you know about this option you can choose to ignore it to exclude it from future scans. The text we found in this file that matches a known malicious file is: <strong style=\"color: #F00;\">\"{$matches[1]}\"</strong>.",
391
  'data' => array(
392
  'option_name' => $row['option_name'],
393
  'site_id' => $blog['blog_id'],
186
  'severity' => 1,
187
  'ignoreP' => $this->path . $file,
188
  'ignoreC' => $fileSum,
189
+ 'shortMsg' => "File appears to be malicious: " . esc_html($file),
190
+ 'longMsg' => "This file appears to be installed by a hacker to perform malicious activity. If you know about this file you can choose to ignore it to exclude it from future scans. The text we found in this file that matches a known malicious file is: <strong style=\"color: #F00;\">\"" . esc_html($matches[1]) . "\"</strong>.",
191
  'data' => array(
192
  'file' => $file,
193
  'canDiff' => false,
194
  'canFix' => false,
195
  'canDelete' => true
196
+ )));
 
197
  break;
198
  }
199
 
205
  'severity' => 1,
206
  'ignoreP' => $this->path . $file,
207
  'ignoreC' => $fileSum,
208
+ 'shortMsg' => "This file may contain malicious executable code: " . esc_html($this->path . $file),
209
+ 'longMsg' => "This file is a PHP executable file and contains an " . esc_html($this->patterns['word1']) . " function and " . esc_html($this->patterns['word2']) . " decoding function on the same line. This is a common technique used by hackers to hide and execute code. If you know about this file you can choose to ignore it to exclude it from future scans.",
210
  'data' => array(
211
  'file' => $file,
212
  'canDiff' => false,
213
  'canFix' => false,
214
  'canDelete' => true
215
  )
216
+ ));
217
  break;
218
  }
219
  }
234
  'severity' => 1,
235
  'ignoreP' => $this->path . $file,
236
  'ignoreC' => $fileSum,
237
+ 'shortMsg' => "This file may contain malicious executable code: " . esc_html($this->path . $file),
238
+ 'longMsg' => "This file is a PHP executable file and contains the word 'eval' (without quotes) and the word '" . esc_html($badStringFound) . "' (without quotes). The eval() function along with an encoding function like the one mentioned are commonly used by hackers to hide their code. If you know about this file you can choose to ignore it to exclude it from future scans.",
239
  'data' => array(
240
  'file' => $file,
241
  'canDiff' => false,
242
  'canFix' => false,
243
  'canDelete' => true
244
  )
245
+ ));
246
  break;
247
  }
248
  }
289
  'severity' => 1,
290
  'ignoreP' => $this->path . $file,
291
  'ignoreC' => md5_file($this->path . $file),
292
+ 'shortMsg' => "File contains suspected malware URL: " . esc_html($this->path . $file),
293
+ 'longMsg' => "This file contains a suspected malware URL listed on Google's list of malware sites. Wordfence decodes " . esc_html($this->patterns['word3']) . " when scanning files so the URL may not be visible if you view this file. The URL is: " . esc_html($result['URL']) . " - More info available at <a href=\"http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=" . urlencode($result['URL']) . "&client=googlechrome&hl=en-US\" target=\"_blank\">Google Safe Browsing diagnostic page</a>.",
294
  'data' => array(
295
  'file' => $file,
296
  'badURL' => $result['URL'],
298
  'canFix' => false,
299
  'canDelete' => true,
300
  'gsb' => 'goog-malware-shavar'
301
+ )
302
+ ));
303
  }
304
  } else if($result['badList'] == 'googpub-phish-shavar'){
305
  if(! $this->isSafeFile($this->path . $file)){
308
  'severity' => 1,
309
  'ignoreP' => $this->path . $file,
310
  'ignoreC' => md5_file($this->path . $file),
311
+ 'shortMsg' => "File contains suspected phishing URL: " . esc_html($this->path . $file),
312
+ 'longMsg' => "This file contains a URL that is a suspected phishing site that is currently listed on Google's list of known phishing sites. The URL is: " . esc_html($result['URL']),
313
  'data' => array(
314
  'file' => $file,
315
  'badURL' => $result['URL'],
317
  'canFix' => false,
318
  'canDelete' => true,
319
  'gsb' => 'googpub-phish-shavar'
320
+ )
321
+ ));
322
  }
323
  }
324
  }
385
  'severity' => 1,
386
  'ignoreP' => "{$db->prefix()}option.{$row['option_name']}",
387
  'ignoreC' => md5($row['option_value']),
388
+ 'shortMsg' => "This option may contain malicious executable code: " . esc_html($row['option_name']),
389
+ 'longMsg' => "This option appears to be inserted by a hacker to perform malicious activity. If you know about this option you can choose to ignore it to exclude it from future scans. The text we found in this file that matches a known malicious file is: <strong style=\"color: #F00;\">\"" . esc_html($matches[1]). "\"</strong>.",
390
  'data' => array(
391
  'option_name' => $row['option_name'],
392
  'site_id' => $blog['blog_id'],
readme.txt CHANGED
@@ -2,8 +2,8 @@
2
  Contributors: mmaunder
3
  Tags: wordpress, security, performance, speed, caching, cache, caching plugin, wordpress cache, wordpress caching, wordpress security, security plugin, secure, anti-virus, malware, firewall, antivirus, virus, google safe browsing, phishing, scrapers, hacking, wordfence, securty, secrity, secure, two factor, cellphone sign-in, cellphone signin, cellphone, twofactor, security, secure, htaccess, login, log, users, login alerts, lock, chmod, maintenance, plugin, private, privacy, protection, permissions, 503, base64, injection, code, encode, script, attack, hack, hackers, block, blocked, prevent, prevention, RFI, XSS, CRLF, CSRF, SQL Injection, vulnerability, website security, WordPress security, security log, logging, HTTP log, error log, login security, personal security, infrastructure security, firewall security, front-end security, web server security, proxy security, reverse proxy security, secure website, secure login, two factor security, maximum login security, heartbleed, heart bleed, heartbleed vulnerability, openssl vulnerability, nginx, litespeed, php5-fpm, woocommerce support, woocommerce caching, IPv6, IP version 6
4
  Requires at least: 3.9
5
- Tested up to: 4.3.1
6
- Stable tag: 6.0.21
7
 
8
  The Wordfence WordPress security plugin provides free enterprise-class WordPress security, protecting your website from hacks and malware.
9
  == Description ==
@@ -183,8 +183,12 @@ fully compatible with both IPv4 and IPv6 whether you run both or only one addres
183
 
184
  == Changelog ==
185
 
 
 
 
 
186
  = 6.0.21 =
187
- * Enhancement: Added better handling of Googlebot verification.
188
 
189
  = 6.0.20 =
190
  * Fix: Fixed bug with options that are enabled by default but disabled by the user are reset to defaults.
2
  Contributors: mmaunder
3
  Tags: wordpress, security, performance, speed, caching, cache, caching plugin, wordpress cache, wordpress caching, wordpress security, security plugin, secure, anti-virus, malware, firewall, antivirus, virus, google safe browsing, phishing, scrapers, hacking, wordfence, securty, secrity, secure, two factor, cellphone sign-in, cellphone signin, cellphone, twofactor, security, secure, htaccess, login, log, users, login alerts, lock, chmod, maintenance, plugin, private, privacy, protection, permissions, 503, base64, injection, code, encode, script, attack, hack, hackers, block, blocked, prevent, prevention, RFI, XSS, CRLF, CSRF, SQL Injection, vulnerability, website security, WordPress security, security log, logging, HTTP log, error log, login security, personal security, infrastructure security, firewall security, front-end security, web server security, proxy security, reverse proxy security, secure website, secure login, two factor security, maximum login security, heartbleed, heart bleed, heartbleed vulnerability, openssl vulnerability, nginx, litespeed, php5-fpm, woocommerce support, woocommerce caching, IPv6, IP version 6
4
  Requires at least: 3.9
5
+ Tested up to: 4.4
6
+ Stable tag: 6.0.22
7
 
8
  The Wordfence WordPress security plugin provides free enterprise-class WordPress security, protecting your website from hacks and malware.
9
  == Description ==
183
 
184
  == Changelog ==
185
 
186
+ = 6.0.22 =
187
+ * Security Fix: Fixed stored XSS vulnerability discovered internally (thanks to Matt Rusnak).
188
+ * Enhancement: Added additional Sucuri scanner IP to our whitelist.
189
+
190
  = 6.0.21 =
191
+ * Enhancement: Added better handling of Googlebot verification.
192
 
193
  = 6.0.20 =
194
  * Fix: Fixed bug with options that are enabled by default but disabled by the user are reset to defaults.
wordfence.php CHANGED
@@ -4,13 +4,13 @@ Plugin Name: Wordfence Security
4
  Plugin URI: http://www.wordfence.com/
5
  Description: Wordfence Security - Anti-virus, Firewall and High Speed Cache
6
  Author: Wordfence
7
- Version: 6.0.21
8
  Author URI: http://www.wordfence.com/
9
  */
10
  if(defined('WP_INSTALLING') && WP_INSTALLING){
11
  return;
12
  }
13
- define('WORDFENCE_VERSION', '6.0.21');
14
  if(get_option('wordfenceActivated') != 1){
15
  add_action('activated_plugin','wordfence_save_activation_error'); function wordfence_save_activation_error(){ update_option('wf_plugin_act_error', ob_get_contents()); }
16
  }
4
  Plugin URI: http://www.wordfence.com/
5
  Description: Wordfence Security - Anti-virus, Firewall and High Speed Cache
6
  Author: Wordfence
7
+ Version: 6.0.22
8
  Author URI: http://www.wordfence.com/
9
  */
10
  if(defined('WP_INSTALLING') && WP_INSTALLING){
11
  return;
12
  }
13
+ define('WORDFENCE_VERSION', '6.0.22');
14
  if(get_option('wordfenceActivated') != 1){
15
  add_action('activated_plugin','wordfence_save_activation_error'); function wordfence_save_activation_error(){ update_option('wf_plugin_act_error', ob_get_contents()); }
16
  }