[Resolved] Toolset Blocks plugin <= 1.6.26 – Cross Site Scripting (XSS) vulnerability

[Author]

Posts

[garyY-2]

Hi Guys

Patchstack say there is a fix for this but I can't see it in my account.

Cheers

Gary

[garyY-2]

Hi Guys

Is there any update on this please?

I have literally had to buy Patchstack to protect my clients sites as a direct result of this issue.

Cheers

Gary

[Minesh]

Hello. Thank you for contacting the Toolset support.

I would like to inform you that the the issue is already fixed and we suppose to release hotfix version very soon, hopefully by today.

I'll keep you informed. Please hold on for further updates.

[Minesh]

I've good news for you. The security issue you reported with this ticket is been fixed and you can download the latest Toolset Blocks/Views plugins from your account's Downloads page:
=> https://toolset.com/account/downloads/

The new hotfix version for:
(you can visit the changelog to know other fix included with this release):
- Toolset Blocks v1.6.27
=> https://toolset.com/download/toolset-blocks/#changelog

- Toolset Views v3.6.27
=> https://toolset.com/download/toolset-views/#changelog

You can download the latest version and manually replace with your existing Blocks/Views plugin after login to admin using the plugins page.

Please note that:
- if you are using Blocks then Download and install the Blocks plugin.
- If you are using Views then Download and install the Views plugin.

[garyY-2]

Thanks Minesh, that's great!