WordPress patches dangerous XSS, SQL injection bugs