WraithKenny

Just for your info, the original reporters have marked this as fixed on their site, you shouldn’t see any warnings anymore.

Not completely solved, but the company that reported the vulnerability has reached out to me.

closing

I’ve release 3.5.3, which disables the plugin completely if DISALLOW_UNFILTERED_HTML is set to true, and also disables the old code for upgrading meta data with the old key.

This should remove any surface for the reported vulnerability.

I’ve release 3.5.3, which disables the plugin completely if DISALLOW_UNFILTERED_HTML is set to true, and also disables the old code for upgrading meta data with the old key.

This should remove any surface for the reported vulnerability.

“This only impacts multi-site installations and installations where unfiltered_html has been disabled.”

As noted on the other thread, this is certainly a false positive, since the admin code is completely disabled when unfiltered_html is disabled. Thanks for linking to that, much appreciated.

I appreciate you giving me that link, since I wasted a whole 8 hrs trying to refactor my code to find a vulnerability that’s certainly a false positive.

“This only impacts multi-site installations and installations where unfiltered_html has been disabled.”

This is a weird report, since the code in my plugin entire admin code is completely disabled when unfiltered_html is disabled.

Hello,

I don’t work on this plugin that often anymore, but if there’s details on how I can patch the issue, I will certainly do so.

I’ll need more details however, since there’s nothing here to go on. Is there a specific note about what exactly the vulnerability is supposed to be?

I had forgotten that we figured out the workaround 2 years prior.

because it’s still a problem.

https://www.ads-software.com/support/topic/bug-select2-v3-js-errors-with-acf/

The draw back is it disables page by page controls, but most of us are only using the site wide option anyway.

You can put this in your functions.php file.

// Fix WP Notification Bars bug.
add_filter( 'mtsnb_force_bar_post_types', function() {
	if ( is_admin() ) {
		return [];
	}
	return [ 'post', 'page' ];
}, 10, 3 );

This is still a problem.

Either way, it’s causing a javascript error, and that error is causing other errors

Or, maybe it’s an error in ACF.