update to visual composer secure version? 4.7.4

hi guys and thanks in advance for your great work.

I got this mail from enbato

We are getting in touch to let you know about multiple XSS security vulnerabilities in the Visual Composer WordPress plugin versions prior to 4.7.4 (releases prior to October 2, 2015). This plugin was included in items you’ve purchased (listed below).

We have been working with WP Bakery, the creators of Visual Composer, who have addressed all identified vulnerabilities and undertaken a code audit to ensure that it is as secure as possible. Theme authors whose items include Visual Composer have been instructed to make sure their items accommodate this upgrade. Items that include older versions of Visual Composer will be disabled from the market until this change is made.

Affected Items
Your items that include Visual Composer:

What You Should Do
In order to secure your item from these vulnerabilities we strongly encourage you to update to version 4.7.4 or later as soon as possible. We recommend you take the following steps to secure your sites immediately, after first backing up your WordPress site.

Visual Composer Plugin Update Steps
Log in to codecanyon.net and proceed to download the latest version of Visual Composer to your computer from this URL: http://codecanyon.net/item/visual-composer-page-builder-for-wordpress/242431
Locate and unzip the downloaded plugin file.
Connect to your server using an FTP client and upload the js_composer directory (from the downloaded zip file) to the wp-content/plugins/ directory. (Note: This will overwrite the old Visual Composer files with the secure versions.)
Log into WordPress and navigate to the Plugins page to confirm the Visual Composer plugin is version 4.7.4
The link to the latest version, provided above, will be live for 3 weeks from the time this email was sent. After this period, you will need to access the latest version via your theme zip file.

Please note: This replaces the existing plugin under the licensing of the theme(s) you’ve purchased and is only licensed for use in these themes.

Your Security is Our Priority
We take security seriously at Envato. When we receive security vulnerability reports for items sold on our marketplaces, we work as quickly as possible to validate the report, investigate risk and determine the best course of action for the security of our community.

On behalf of the plugin creator and Envato, we’d like to apologize for this inconvenience and assure you that security is and always will be our priority.

Regards,
The Envato Team

when will the theme be updated? do we need to update? should be wait for you?

Thanks in advance!

S

You should have gotten email already showing the update which was posted last week; do a download of all files from your account for theme; open on your PC/Mac; in the plugins open the js-composer plugin and look at the changelog/version info to see it’s been updated to a secure version.

Is the latest version of the theme bundled visual composer 4.7.1.1 from the October 6th email? The change log for 4.7.1.1 doesn’t seem to mention addressing security vulnerabilities.

I’ve upgraded to the newest version of Newspaper and the “About”-Section of Visual Composer says version 4.7.1 – which seems to have the security issues addressed in the email by Envato. I tend to follow instructions of Envato to take the upgrade to version 4.7.4 but it would be nice to hear directly from Tagdiv if we all should do so or not.

Have a nice Sunday everybody.

I also have a question about it. I’m using Newspaper 4.6, not Newspaper 6, so can i use VC 4.7.4 with it? And how can i get it?

AGAIN:
for those who don’t know how to read changelogs …
if using Newspaper 6x ..

a) go to your Envato/Themeforest account,
b) download the “all files” for Newspaper, extract to the “Newspaper-tf” folder
c) in the /plugins folder note the file “js_composer”
d) extract the zip
e) in the ‘js_composer’ plugin folder, note the file “changes.txt”

note it’s 4.7.4 🙂

2.10.2015 – ver 4.7.4
– Fixed: Bug in grid builder presets
– Added extra ajax check

29.09.2015 – ver 4.7.3
– Re: Backwards compatibility for images with custom link
– Added border for single image with external source
– Width of vc icon in “Add element” window fixed
– Presets saving mechanism optimized

22.09.2015 – ver 4.7.2
– “Undefined index” notice in tabs, tour, accordion removed (for cases when vc_remove_param() was called)
– Bottom border in image gallery fixed
– <br> now works in mobile view tabs
– Backwards compatibility for images with custom link
– Minor css improvements and fixes

• This reply was modified 10 years by simchris.

I’ve updated the plugin this morning after reading that same email from Envato and left my computer the whole day, only to find my website to be completely crippled this evening.

In Safari: Fatal error: Unknown: Cannot use output buffering in output buffering display handlers in Unknown on line 0

In Chrome: the website looks like a (erroneous) mobile site.

On my iPhone 6s it seems to work normally.

Under plugins it says VC is changed to 4.7.4.

Any help is much appreciated!

Hi there,

After updating the theme and Visual Composer to 4.7.4 I get an unusual deprecated Visual Composer message and collection of icons at the base of every article and page. I am also prevented from editing or adding any block.

My page building has completely stopped. This does not seem to effect the front end performance or structure.

I upgraded the theme via FTP as the envato updater has not been working for some time. I deleted visual composer then added via FTP. The site is: http://coconutoilpost.com/ Can you please advise on how to restore the Visual Composer functionality?

I am going through plugin conflict testing but all looks OK so far.

Regards
Peter

I restored an old backup and now the site is online. But I want to prevent the same error again, so the help is still appreciated 🙂

Visual Composer sucks, You are great team guys and you should need fix your own. I have update to version 6.5.1 and my site was dramatically slow…

Thank you

Hi Alin. Thank you for your answer, but i don’t want to update to Newspaper 6. I’m totally ok with version 4, i’ve done a lot of custom work for it and i don’t want to start it again, coz for me it’s kind of a different theme, not just another version.
But as i remember it was said that Newspaper 4 will be always supported so could you test VC with it please?

Ok, thank you very much. How will we know about that, will it be sent in e-mail like new version of theme or something?