The recently patched REST API Endpoint vulnerability in WordPress could be leveraged to pull off stored cross-site scripting attacks.

WordPress security experts said that 1.5M sites have been defaced following the disclosure of a silently fixed content injection vulnerability.

WordPress silently fixed a serious content injection vulnerability when it pushed out its latest security release, 4.7.2, last week