Newspaper Theme

Newspaper Theme

Author: Julio

Date: June 3, 2020 

Category: Ecommerce, Maintenance, Plugin development, Security

wprssaggregator Newspaper Theme

Newspaper is a famous theme from TagDiv on themeforest, with about 95,000 sells.

Reflected XSS

We found in the file functions.php a XSS vulnerability, allowing an attacker to push JavaScript code into the admin dashboard.

Check the code:

add_action( 'current_screen', function() { $current_screen = get_current_screen(); if ( 'update-core' === $current_screen->id && isset( $_REQUEST['update_theme'] )) { add_action('admin_head', function() { $theme_name = $_REQUEST['update_theme']; ob_start(); ?> <script> jQuery(window).ready(function() { 'use strict'; var $formUpgradeThemes = jQuery('form[name="upgrade-themes"]'); if ( $formUpgradeThemes.length ) { var $input = $formUpgradeThemes.find('input[type="checkbox"][value="<?php echo $theme_name ?>"]'); if ($input.length) { $input.attr( 'checked', true ); $formUpgradeThemes.submit(); } } }); </script> <?php echo

This is the first part of the original article by Julio.
Click here to read the full article in a new tab!

Newspaper Theme

World of WordPress is hosted by:

Servebolt: next level high performance hosting.

While others try to add more components to their hosting to make it go faster, we decided to build our hosting cloud fast from the ground up. We did so by stripping out everything we knew was deadweight.

toolset logo tag line white Newspaper Theme