BlogSecurity an organization that deals with web blog security recently posted a list of the top 10 WordPress themes that are vulnerable to Cross-Site Scripting due to template flaws.

1. field-of-dreams
2. tarski
3. mandigo-14,1.22
4. connections
5. default
6. freshy
7. redoable
8. k2
9. vistered-little-1.6a
10. wp-multiflex-3

Some of the themes on the list are popular WordPress themes, like freshy, k2 and redoable. I hope that the theme authors would look into this and make the necessary changes and fix the template flaws.

If you want to perform the same test for your blog or WordPress themes that you’ve created, you can use the same method used by BlogSecurity team. All you need to do is follow the installation instructions:

• Download the wp-scanner activator plugin.
• Upload the plugin file to your wp-contents/plugin folder.
• Activate the plugin from the admin panel.
• Launch the wp-scanner and perform the test.
• As soon as you’re done, de-activate the plugin so other people can’t to scan your blog.

Btw, I performed the test for JaypeeOnline and I’m happy with the result:

I strongly recommend that you also perform this test so you can find out if the WordPress theme you’re using is vulnerable or not. It would only take a few minutes of your time. If you’ve also performed the test, please share your test results or your thoughts regarding this matter. Thank you!

Oh yeah, I almost forgot. Make it a habit to download WordPress themes or plugins from reliable sources or directly from the author’s site. Better safe than sorry!

Have a good weekend everyone! :)

Screenshot:

Bug fixes:

• Fixed the spacing problems between sidebar modules.
• Fixed the problem that was causing the wrong comments to be displayed with each post (yay!)
• Corrected the behaviour of links in the sidenotes column to closer reflect my initial intentions.
• Fixed the margins to remove scroll bars when viewed at 1024×768 resolution.

Added features:

• Added Technorati ‘blog reactions’ to posts.
• The dynamic style option allowing you to choose between 16 different colour combinations for your blog right from the admin area. Both light and dark schemes are available.
• Several new admin options including the ability to turn off the ‘Get Firefox’ banner, to use a custom logo in the header, and to configure your badge farm.
• The sidenotes column (only visible on the homepage) is now widgetised!
• There is now an alternate page menu that can be displayed in a row below the header instead of in the top right corner.

New plugin support:

• WordPress Download Monitor – since switching to this plugin my downloads have been working brilliantly.
• Twitt-Twoo – update and display your twitter status in the sidebar of your blog.

My Take:
Dean Robinson did a really great job with Redoable 1.1 but he has outdone himself with this latest version 1.2. Not only has he fixed most if not all the known bugs, but he has also added several cool features. But the feature that stands out is the option to change color schemes with 16 different color schemes to choose from.

Check out the changelog.txt for full details. Or if you wanna know more about installing and upgrading, visit the Redoable homepage.

Preview or download the Redoable 1.2 WordPress theme.

I was expecting BinaryBonsai‘s K2 to be one of the themes in that list but it wasn’t. However, the list does include two modified versions of K2 – 3k2redux klein and 3k2redux klee.

Among the WordPress themes listed, I counted 10 themes that I’ve downloaded and tried on my sandbox. And from those 10 themes, the only one I used for JaypeeOnline was the Freshy theme. I’m sure most of you who have been visiting my blog for quite a while remember that. What I like most about that theme is the option to easily change color schemes within the WordPress admin panel, which you don’t see in most WordPress themes.

Check out Hongkiat’s list of the 49 Most Downloaded WordPress Themes.

Redoable is a 3 column, widget and module ready free WordPress theme created by Dean J. Robinson. Redoable was built using the code of the popular WordPress theme K2 with a lot of modifications making it a totally different theme on it’s own. This theme’s sidebar is widget and module ready with over 20 different available modules to choose from. A default installation would display the calendar, categories, tags, blogroll and listen & watch modules as long as the necessary plugins are installed. You can add more modules or widgets to your liking.

Redoable has a feature called Sidenotes which is based on Matt’s Asides technique used in K2. You can set the category and number of sidenotes that you want to display from the Redoable options panel. Sidenotes are displayed in the homepage. Like in K2, you can setup the Extended Live Archives from the Redoable options pane and an option to add the Archives page. Redoable also supports Alex King’s Articles plugin.

Redoable is compatible for both WordPress 2.0.x and WordPress 2.1 installations.

Screenshot:

Supported plugins:

The following plugins are supported by Redoable “out-of-the-box”. Just download them, add them to your plugins folder, activate and your good to go.

• Alex King’s Articles v1.1
• Brian’s Latest Comments v1.5.10
• Extended Live Archives v0.10beta-r18
• Semiologic’s Google Analytics Plugin v1.9
• Gregarious v1.5.2 and v2 beta
• Noteworthy v1.0
• Random Quotes v1.3
• Rechuked Buttons v1.0 (Based on Sawchuck Buttons) Not WP2.1 compatible
• Related Posts v2.04
• Share This v1.4
• Ultimate Tag Warrior v3.1415926
• Ultimate Category Cloud v2.0 (Based on Weighted Categories plugin)
• Word Count v0.01
• WP-PostRatings v1.04
• WP-PostViews v1.1
• iMP Download Manager v1.2
• Quoter v1.1
• Subscribe to Comments v2.0.8
• Spam Karma 2
• wp-recent-links v2.0

Known Issues

• Some people are experiencing a problem where the comments and the permalinks are all referring to the incorrect posts. As yet I have been unable to replicate this problem, and it doesn’t seem to happen on everyones blog. It could be related to the use of different permalink structures, but as yet I don’t have a solution for it.
• Sidebar overlap issue. This hasn’t been completely fixed but the sidebar will now overlap on top of the footer instead of disappearing behind it when there is only a small amount of page contents.
• LiveSearch doesn’t seem to work with custom permalinks. This has also been reported by other users of K2 (which Redoable is based on), but as yet no-one has had a good answer.

My Take:

I like this theme inspite of it’s issues. Redoable has a simple and neat layout. It offers a lot of functionality and customization with widgets and it’s ready-to-use modules. Redoable also supports a lot of the commonly used plugins. The color scheme is okay but not appealing to some users. What I want to see is the Redoable theme to be available in a different color scheme or to have the option to change color schemes from the Redoable Options panel.

To know more or to download a copy, visit the Redoable homepage.