https://blog.sucuri.net/2017/12/javascript-injection-creates-rogue-wordpress-admin-user.html
Is this anything to be concerned about running NewsMag Version 4.1 ?
If you’re using an outdated TagDiv themes like Newspaper or Newsmag and you suspect that your website might be infected, you can verify through our free SiteCheck scanner. Update the themes to patch the vulnerability, then inspect your blog for suspicious users. We also advise that you test your settings, change your passwords, and scan your server for any backdoors that may have been left behind.
Also, worth checking the changelog for each new version of Newsmag to check what has been patched, including any security fix.
Much like updating WordPress to fix security flaw in core WP code.
But, check your site with the Securi free scanner, and that way you will know you’re okay 🙂
CHANGELOG:
Version 4.2 – November 17, 2017
misc: Visual Composer plugin updated to the latest version
misc: Compatibility with WordPress 4.9
fix: Weather forecast
Version 4.1 – November 1st, 2017
misc: Visual Composer plugin updated to the latest version
misc: Revolution Slider plugin updated to the latest version
fix: Weather widget
fix: XSS Security issue
fix: Background click ad
Version 4.0 – July 13th, 2017
new: Challenging you to be more creative and productive, we’ve added the first page builder ever created for blogs, news and magazine websites. Newsmag 4 brings you tagDiv Composer – a lighter, faster and more efficient way to build your site. Ready to be used right on the frontend, easier than ever, seeing every change instantly.
new: Live frontend LESS and CSS editor. This allows you to quickly add CSS or LESS quick to any page of your site
new: News Magazine demo
new: Clear Voice demo
new: Sound Square demo
new: Buttons that are available in the format menu
The list of modified files
Version 3.3.1 – January 26th, 2017
fix: We modified the login modal window code to only appear on the page when front page login is enabled. This makes sure that some versions of Chrome browser will not mark the site as “Not Secure”.
