flyzilla

I received another email from Wordfence 3+ hours ago.

“SVG Support <= 2.5.6 – Authenticated (Author+) Cross-Site Scripting via SVG” on wordfence.com

• This reply was modified 7 months, 3 weeks ago by flyzilla.
• This reply was modified 7 months, 3 weeks ago by flyzilla.

I also received the Wordfence warning email yesterday. This plugin’s page says it was closed on July 16—it’s been three days now.

I’ll be looking for a replacement. If I remember correctly, SVG files are already quite “exploitable” by nature, so this issue still being unresolved at this point is a huge red flag. (Correct me if I’m wrong.)

Solved by updating PHP to version 7.4.

I already posted an issue about that on Github—sorry for not mentioning it earlier! Thanks.

Done and thanks again!

For those following, I edited it for brevity and posted it there.

Found out about this on Ars Technica. I just deleted this plugin as the article recommends. I’m also using Spacious theme. What’s disturbing to me is the fact that the vulnerability has been around for three years. I like the minimalist design of Spacious but I don’t think I could deal with this kind of security threat on my sites. I may know the security basics (which probably saved my site) but still…

@jbt-csm, where can I find “Design/Appearance”? I’m not so savvy on the backend side of WordPress.

I never knew this plugin should be deleted once it has done its job, or should just be re-installed “on call.”

Themegrill, are you considering dropping the demo importer plugin all in all? Why not make Spacious (among others, maybe) available without the need to install the plugin?

Thanks, Anders.

I just started using the Gutenberg editor and discovered the Code Editor. Didn’t change anything, but the setup I was looking for is already there.

Thanks for creating cool themes, especially the ones with a minimalist feel. And for the support!

Hi, just adding the screenshot: https://i.redd.it/dzw2z07pplz21.png

Thanks.