Contributor+ stored XSS in the Post Date block

Skrevet den 12. august 2026 af i WordPress

PHP Object Injection via Unsafe Deserialization of POST Parameters in Formidable Forms

6. november 2026

Formidable Forms passed every POST…

Authenticated Local File Inclusion in RTMKit get_content AJAX Action

6. november 2026

RTMKit's get_content AJAX action built…

SQL Injection in Form Maker by 10Web Submissions Sorting

6. november 2026

Form Maker by 10Web concatenated…

Render_block_core_post_date() interpolated the raw and formatted post date directly into a element and, when the block is configured as a link, the permalink into an . The href moreover used the malformed %1s / %2s placeholders instead of %1$s / %2$s, so the substitution did not behave as intended. The fix escapes each value at the point of output — esc_attr() on the datetime attribute, esc_html() on the visible date, esc_url() on the permalink — and corrects the sprintf() placeholders.

This vulnerability affects the following application versions:

Skriv et svar Annuller svar

Om os

Standoutmedia er et webbureau dedikeret til WordPress platformen.
Vi driver egne hostingløsninger, hvor tusindvis af kunder hver dag modtager sikkerhedsopdateringer.

Læs mere om os her: https://standoutmedia.dk/