Share

We have released Avada 7.15,  fixing five minor security issues:

  • SECURITY: Fixed a vulnerability in the ToC Element cache that allowed arbitrary content injection, which could be indexed by search engines or shown in social media previews.
  • SECURITY: Fixed an issue where Contributor+ users could create, edit, delete, or access layouts via custom code.
  • SECURITY: Fixed an issue where Contributor+ users could inject JavaScript into the Content Box and Portfolio Elements.
  • SECURITY: Fixed JavaScript execution on the critical CSS page (administrator level only) when code was appended to the URL.
  • SECURITY: Fixed a minor CSRF issue where a user could be tricked into having their privacy consent cookie modified.

This is disclosed in our Changelog and our Important Update Info help file.

Like WordPress and any entity that develops software, we understand that security is not absolute and is a continuous process managed as such. We do our best to prevent security issues as proactively as possible, as we do not assume they’ll never come up. Our responsibility is to quickly take care of them and work to get our customers notified and prepared. This is why we recommend keeping your website and plugins up-to-date and maintained at all times.

What Should I Do Next?

We cannot stress enough the importance of ensuring that your website is kept up to date and maintained at all times. Please update to ensure that your installation is issue-free and the fix detailed above is applied. These are our detailed update instructions:

We would like to extend our gratitude and thanks to Patchstack.

Subscribe To Our Newsletter

Receive all of the latest news and updates fresh from ThemeFusion!

Related Articles

Leave a comment