Update Feed

ClassicPress 1.1.3

7 May 2020

ClassicPress version 1.1.3 is now available (security release).

Upgrading to ClassicPress 1.1.3

ClassicPress 1.1.3 can be upgraded to (or installed) using any of Installatron's products. Use Installatron's optional Automatic Update feature to automatically apply ClassicPress updates as new versions are released, or use Installatron's Clone feature to duplicate an existing ClassicPress install to test the 1.1.3 upgrade prior to applying it live. Get started managing your ClassicPress installations with Installatron

What's New in ClassicPress 1.1.3

1.1.3

ClassicPress 1.1.3 is a security release to match the security changes in WordPress versions 5.4.1 and 4.9.14 (both released on April 29, 2020).

If your ClassicPress site has automatic updates enabled (the default configuration), then the new version will be installed automatically. Otherwise, we strongly recommend applying this update from your site’s dashboard as soon as possible.

Security

fixed an issue where password reset tokens were not properly invalidated
fixed an issue where certain private posts can be viewed unauthenticated
fixed an XSS issue in the Customizer
fixed an XSS issue in wp-object-cache
fixed an XSS issue in file uploads.

1.1.2

ClassicPress 1.1.2 is a security release to match the security changes in WordPress versions 5.3.1 and 4.9.13 (both released on December 12, 2019).

Security

fixed an issue where an unprivileged user could make a post sticky via the REST API.
fixed an issue where cross-site scripting (XSS) could be stored in well-crafted links.
hardened wp_kses_bad_protocol() to ensure that it is aware of the named colon attribute.