The common vulnerability that triggered a coordinated plugin update of many popular plugins on 22nd April is caused by a lack of escaping of two WordPress functions, add_query_arg() and remove_query_arg(). For the past week, security firm Sucuri has worked with the WordPress core security team to address a cross site