Autosoft B.V.

Updated to the latest version 4.4.7.1
Enabled the ‘run shortcodes’ function

Divi visual editor seems to be working as intended.
Looks like the problem is resolved.

Thank you for the quick fix!

Same problem here.

latest version DIVI (4.22.2)
Latest AIOSEO (4.4.7)

Quickfix disable shortcodes works for now.
Would love to see a real fix.

Thank you for the fix.
Everything seems to be working properly.

Thank you for the really fast fix!

Any updates on this? @nielorit

Awesome job Rolf!

Thanks for fixing it so fast..

Nice one Rolf!
Let’s hope this fixes things.

The WP toolkit running on Plesk isalso reporting the vulnerability.

@cageehv as far as i could find,
these types of issues can be prevented by using “nonces” and validating, sanitizing and escaping your code where possible,

https://wpvip.com/2023/02/28/how-to-protect-against-csrf-attacks-with-wordpress-nonces/

It was also just reported by Wordfence.
Supposedly it’s caused by Freemius SDK

Your plugin uses version 2.4.3 of the SDK
it should at least be version 2.5.10 according to Freemius

https://www.wordfence.com/threat-intel/vulnerabilities/detail/freemius-sdk-259-reflected-cross-site-scripting-via-fs-request-get

• This reply was modified 1 year, 4 months ago by Autosoft B.V..

Unfortunately I dont have any more detailed info about this issue,
it was automatically reported by our Plesk server WordPress Toolkit.

If you can point me in any direction how to create the logs and/or info you need, I will try to provide it to you.

The only info i have right now:

“WordPress Date Picker by Input WP – Sync bookings with external Calendars (.ics) plugin <= 2.2 – Reflected Cross Site Scripting (XSS) vulnerability”

Same here, blank popup, no posibillity to force download new reviews.
Please fix. Would be a shame if the free version no longer does anything.

thanks for the quick reply!

Same problem here.

Your plugin picks up the fonts used in the child theme as supposed to.
So far so good.

but it ignores the google fonts that are used in the parent theme
(imported into in the parent theme .css file)

No output buffers used.

• This reply was modified 2 years, 1 month ago by Autosoft B.V..

will do!

We’ve tested a couple of sites just now, and it looks like it’s working properly again!

All settings and selections are still there and also working on both the dashboard and the front-end.

Thank you very much for this lovely plugin and the quick fix!

• This reply was modified 3 years, 4 months ago by Autosoft B.V..