Just bumping to say we got a similar notice from Blogvault. Expediting this as a hotfix would be ideal if possible.

“The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 5.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link”

Hi Bettina,

Can you look a little deeper into this?

1. Yes I understand the child theme is not overwritten, I’m asking for guidance about why we would get a critical error from this line of code in it’s header.php – perhaps related to #2? It is related to general issue of the update breaking the site, child theme or not.

This is the code:

/*
* loads the header template set in Theme Panel -> Header area
* the template files are located in ../parts/header
*/
td_api_header_style::_helper_show_header();

This is the error:

PHP Fatal error: Uncaught Error: Class “td_util” not found in /srv/htdocs/wp-content/themes/Newspaper/includes/wp-booster/wp-admin/tagdiv-view-header.php:19 Stack trace: #0 /srv/htdocs/wp-content/themes/Newspaper/includes/wp-booster/wp-admin/tagdiv-view-theme-plugins.php(59): require_once() #1 /srv/htdocs/wp-content/themes/Newspaper/includes/wp-booster/tagdiv-wp-booster-functions.php(499): require_once(‘/srv/htdocs/wp-…’) #2 /wordpress/core/6.3.1/wp-includes/class-wp-hook.php(310): {closure}(”) #3 /wordpress/core/6.3.1/wp-includes/class-wp-hook.php(334): WP_Hook->apply_filters(”, Array) #4 /wordpress/core/6.3.1/wp-includes/plugin.php(517): WP_Hook->do_action(Array) #5 /wordpress/core/6.3.1/wp-admin/admin.php(259): do_action(‘newspaper_page_…’) #6 {main} thrown in /srv/htdocs/wp-content/themes/Newspaper/includes/wp-booster/wp-admin/tagdiv-view-header.php on line 19

#2. We have all dependent plugins. Below is what the shortcodes look like that are appaering everywhere – they look related to the composer, which we have installed & activated, and the new version from the theme update. My theory is that because we are making such a jump in theme versions, we’re missing one of the intermediate updates that performed some sort of action that converted them in td composer during a previous update. Can you please ask your dev team?

[td_block_9 custom_title=”Breaking News” custom_url=”/category/breaking-news/” category_id=”24″ limit=”10″ el_class=”breaking-news-block” header_color=”#d90000″]

• This reply was modified 2 years by FreshySites.

* please disregard 2nd message – wrong forum! Original post still needs addressed.

Hi Michael,

I spoke with Jackson who originally set up this server – he said this server config is supposed to have a managed firewall/load balancer in front of it already.

Can you look into this? Thank you!

Any update on this? It’s basically not possible to use the Weather widget in the top bar, if there is more than one city in the US with the same name…

They say:

“Call API by city ID instead of city name, city coordinates or zip code. In this case you get precise respond exactly for your city.”

https://openweathermap.org/current

Additionally, I think it would be beneficial to allow us to add Lat and Long options instead of the exact city ID. For example, the API allows for:

api.openweathermap.org/data/2.5/weather?lat=35&lon=139

Or even ZIP Code:
api.openweathermap.org/data/2.5/weather?zip={zip code},{country code}

It would be cool if there was a radio button option in the theme options for us to choose from:

• City Name
• City ID
• Lat, Long
• ZIP Code

Because right now, your use of City Name is too limiting.

Ah, good to know. I didn’t realize the theme came with Visual Composer. I think that should be more obvious, since this area would ideally let you install from here: https://gyazo.com/e86359548379c12ae358a8fe51fce17e

This appears to be a bug in Visual Composer itself in their 5.4.3 version.

It seems to be OK at first, but after editing text and then re-updating the page, the issue occurs.

I did try deactivating all plugins. The only plugins enabled are now:

• tagDiv Composer (v1.0)
• tagDiv Social Counter (v4.2)
• WPBakery Page Builder (v5.4.3)

I also had a child theme installed (that was provided). So I am not longer using that, but the issue still exists.

Here is the page: https://newzjunky.dev.freshysites.com/contact/

Note, a Raw HTML element seems to keep the <br> tag, but the Text element doesn’t seem to keep and line breaks.

• This reply was modified 8 years by FreshySites.

Is this fixed? I am on the latest version, with a newly generated API Key, and am getting:

Weather API error: Invalid API key. Please see http://openweathermap.org/faq#error401 for more info.

in the header top bar

Edit: nevermind, I see this: “Activation of an API key for Free and Startup accounts takes 10 minutes. For other accounts it takes from 10 to 60 minutes.”

So I will continue to wait.

• This reply was modified 8 years by FreshySites.