Millions of websites running WordPress are at risk of hijacking attacks thanks to a vulnerability that is actively being exploited in the wild and is present in the default installation of the widely used content management system, security researchers warned Wednesday.

The cross-site scripting (XSS) vulnerability resides in genericons, a package that's part of a WordPress theme known as Twenty Fifteen that's installed by default, according to a blog post published Wednesday by security firm Sucuri. The XSS vulnerability is "DOM based," meaning it resides in the document object model that's responsible for how text, images, headers, and links are represented in a browser. The Open Web Application Security Project has much more about DOM-based XSS vulnerabilities here.

DOM-based XSS attacks require the target to click a malicious link, a limitation that greatly lowers their severity. Still, once an administrator takes bait while logged into a vulnerable WordPress installation, the attackers can gain full control of the site. Sucuri researcher David Dede wrote:

What is interesting about this attack is that we detected it in the wild days before disclosure. We got a report about it and some of our clients were also getting reports saying they were vulnerable and pointing to: http:// site.com/wp-content/themes/twentyfifteen/genericons/example.html#1 In this proof of concept, the XSS printed a javascript alert, but could be used to execute javascript in your browser and take over the site if you are logged in as admin.

Anyone responsible for administering a WordPress site should check if it's running the genericons package. If it is, they should immediately remove the example.html file that's included with the package, or at the very least, make sure a Web application firewall or intrusion detection system is blocking access to it. Sucuri has notified almost a dozen Web hosts who have already virtually patched the security hole on the sites they host. The hosts include: