Any updates on this topic? Newspaper has TD Composer 4.1, so I tried to use that and update TagDiv Composer to 4.1 on Newsmag but the theme is not compatible with 4.1 version. I had to switch back to 3.9 version.

Different sources state that the vulnerability is almost a month old. We need the update asap or at least a disclaimer from tagDiv about how to prevent getting targeted by this attack.

As far as I can tell, we should not click any URL if it has td_video_url parameter in it. Is this correct?

References;
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/td-composer/tagdiv-composer-40-reflected-cross-site-scripting-via-td-video-url
https://wpscan.com/vulnerability/cada9be9-522a-4ce8-847d-c8fff2ddcc07
https://patchstack.com/database/vulnerability/td-composer/wordpress-tagdiv-composer-plugin-4-0-reflected-cross-site-scripting-vulnerability?_a_id=350

I’ll try to give more details. 🙂 English is not my native language so bear with me here.

I’m a theme/plugin developer myself. I do lots of WordPress jobs for my customers. I understand child theme concept very well. No problems there, I assure you.

What I’m suggesting is, “you”, as tagDiv, could you please add filters to your internal functions? I’ll try to explain with an example.

There are 14 different (13 + default) single post styles in Newspaper theme. All of them have this line for author box;

<?php echo $td_mod_single->get_author_box();?>

This is great, so if I want to change author box, I can copy td_module_single_base.php from /includes/wp_booster/ to my child theme with the same folder structure and do necessary modifications. And voila, all of the author boxes are updated. But (there is a huge but here) now I have to inspect every changelog that if td_module_single_base.php file changed or not during version bumps. And I had to copy a whole file despite I want to change only one function.

Here comes my solution; Filters

If tagDiv could apply filters just before returning that cuddly $buffy, developers can add a hook to that filter and without copying whole td_module_single_base.php file, they can change the output of get_author_box() function.

I hope this time I explained my self much better. 🙂 Thanks for your responses.

Hello Bogdan,

I know that I can modify original theme files but I don’t want to. 🙂 What I’m asking is you doing this, not me. So the theme gets more functionality and I don’t have to track some modifications which each theme update. It’s not something special to me, it may be useful for all Newspaper users.