Vulnerability stems from insecure use of two WordPress functions called add_query_arg and remove_Query_arg. The vulnerability was discovered recently by researchers from code auditing company Scrutinizer. The official WordPress documentation for those functions has also been updated to better reflect the need to escape user input. The plug-ins found to be vulnerable so far have received patches, so WordPress users are strongly encouraged to check their administrative dashboards for any available plug-in updates. There are likely many more vulnerable plug-ings and themes that haven’t been identified yet.”]