7.1 – fix: Security issues

What type of security issues did you fix in v7.1?

well not everybody have updated their theme so this question should never be answered

well not everybody have updated their theme so this question should never be answered

That’s their fault, not ours. We (with larger pages) have to make sure we investigate the issue, analyze if somebody used the hole and inserted some bad stuff… so no valid argument.

Security fixes for WordPress sites are fairly well documented online via changelogs for WordPress itself and sites like Securi which announce flaws in the base elements of WordPress, certain plugins, etc.

So, to stay on top of “what’s going on” it’s good to familiarize yourself with those and other resources.

Often if a security patch is listed as applied to a theme, it’s in response to one of those announced vulnerabilities, like a cross-site-scripting issue (XSS) or similar.

e.g.,
https://wordpress.org/news/2016/05/wordpress-4-5-2/

https://blog.sucuri.net/category/wordpress-security/

https://blog.sucuri.net/category/vulnerability-disclosure/

Generally the best way to ask about a specific detail not outlined explicitly in the changelog is to send a private email to tagdiv support and ask what was impacted. Often, looking at “which files changed” is a pretty good hint, in relation to things like the recent BBpress exploit announced this month or similar.

Disclosing a flaw in a theme publicly should never be done here.