Cross-site scripting vulnerability in admin-ajax.js

Hi,

We’ve received reports of a XSS (cross-site scripting) vulnerability in our installation of Newspaper from last year. It involves admin-ajax.js; probably safer not to give the details here in cased used maliciously.

How can I give the developers additional information and determine whether this has been fixed in the latest version?

Thanks,
Russell

what files specifically address the exploits, without having to update to 9.7? Because of the way that 9.7 is structured it nukes all of the customizations that are in my child theme.

https://forum.tagdiv.com/topic/child-theme-and-9-7/

also, in the last version of 9.6.1 there is a directory labeled patch_9.6_9.6.1. what are those for and do those need to be uploaded separately to overwrite what is already in the existing Newspaper directory?

• This reply was modified 7 years by pmats777.

@Calin we have determined the vulnerability is not fixed in 9.7. How can I report it to you outside of a public forum? Would you then be able to send us a patch?

@Calin thanks, I’ve sent the details to that email address. Can you reply with next steps?

@Calin I reported the issue to that email address 3 days ago but have not received any reply. Can you ensure that the email is read and answered?

I think tagdiv should release patch for Newspaper 9.6.1 users. Because a lot of users, include me, use old version 9.6.1 because in 9.7.* cannot save current customization from child theme.