I am currently experiencing an XSS attack on my website. According to a security scan, the cross-site scripting vulnerability lies in my Newspaper theme.
“The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks. The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user’s browser in context of vulnerable website. Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.”
Would be great if we can get some quick assistance on this.
Hi,
From what I know at the moment there aren’t such vulnerabilities in the theme that we have identified or where reported.
The last fix was in update 10.3.6 https://tagdiv.com/newspaper/ -> https://prnt.sc/ubg8zf
Are you using the latest theme version? If you do, please let us know some more details about it if possible. With what tool are you scanning that identifies an issue with the theme, and what it detects exactly.
Let me know.
Thank you!
