Freetag plugin updated to prevent XSS

The Freetag plugin has been updated to version 2.96 to fix a possible XSS to the tagcloud output.

XSS attacks can be used by visitors to display foreign HTML or JavaScript to visitors of the blog, if they visit specially crafted URLs. This attack basically allows for cookie stealing.

Users of the freetag plugin should upgrade to the latest version; upgrading via Spartacus-Plugin or is just a matter of a few minutes. Thanks to Alex from for reporting this issue to us.


Trackback specific URI for this entry

  • No Trackbacks


Display comments as (Linear | Threaded)

reinhard on at :

user or owner can steal cookies?

aa on at :

atcore6 on at :

Garvin on at :

If someone can trick you into clicking a link to your own blog, it does not matter if he's an owner, user or visitor of the blog.

This upgrade is mandatory for users of the freetag plugin.

Add Comment

E-Mail addresses will not be displayed and will only be used for E-Mail notifications.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.

BBCode format allowed
Markdown format allowed