Page Builder: PageLayer – Drag and Drop website builder - Version 1.1.8

Version Description

(July 02, 2020) = * [Security-Fix] Our internal security audit revealed XSS vulnerabilities. This is fixed. Please upgrade to this version ASAP ! * [Bug-fix] When an image was clicked, the image gallery was opened to choose the image. This was a bug introduced in the last version and is fixed now. * [Bug-fix] In certain cases, the rich text content was not rendered properly. This is fixed. * [Bug-fix] On turning on the error report in PHP, some PHP error notice was shown. This is fixed.

Download this release

Release Info

Developer pagelayer
Plugin Icon 128x128 Page Builder: PageLayer – Drag and Drop website builder
Version 1.1.8
Comparing to
See all releases

Code changes from version 1.1.7 to 1.1.8

Files changed (11) hide show
  1. init.php +1 -1
  2. js/properties.js +5 -3
  3. js/widgets.js +0 -12
  4. languages/en.json +3 -1
  5. main/ajax.php +23 -0
  6. main/functions.php +53 -10
  7. main/settings.php +5 -0
  8. main/shortcode_functions.php +5 -2
  9. main/template.php +1 -0
  10. pagelayer.php +1 -1
  11. readme.txt +7 -1
init.php CHANGED
@@ -5,7 +5,7 @@ if (!defined('ABSPATH')) exit;
5
 
6
  define('PAGELAYER_BASE', plugin_basename(PAGELAYER_FILE));
7
  define('PAGELAYER_PRO_BASE', 'pagelayer-pro/pagelayer-pro.php');
8
- define('PAGELAYER_VERSION', '1.1.7');
9
  define('PAGELAYER_DIR', dirname(PAGELAYER_FILE));
10
  define('PAGELAYER_SLUG', 'pagelayer');
11
  define('PAGELAYER_URL', plugins_url('', PAGELAYER_FILE));
5
 
6
  define('PAGELAYER_BASE', plugin_basename(PAGELAYER_FILE));
7
  define('PAGELAYER_PRO_BASE', 'pagelayer-pro/pagelayer-pro.php');
8
+ define('PAGELAYER_VERSION', '1.1.8');
9
  define('PAGELAYER_DIR', dirname(PAGELAYER_FILE));
10
  define('PAGELAYER_SLUG', 'pagelayer');
11
  define('PAGELAYER_URL', plugins_url('', PAGELAYER_FILE));
js/properties.js CHANGED
@@ -1768,12 +1768,13 @@ function pagelayer_elp_slider(row, prop){
1768
  function pagelayer_elp_editor(row, prop){
1769
 
1770
  var div = '<div class="pagelayer-elp-editor-div">'+
1771
- '<textarea class="pagelayer-elp-editor">'+prop.c['val']+'</textarea>'+
1772
  '</div>';
1773
 
1774
  row.append(div);
1775
 
1776
  var editor = row.find('.pagelayer-elp-editor');
 
1777
 
1778
  // No SVG Icons for now
1779
  jQuery.trumbowyg.svgPath = false;
@@ -1838,11 +1839,12 @@ function pagelayer_elp_textarea(row, prop){
1838
  var rows = prop.rows ? 'rows="'+prop.rows+' "' : '';
1839
 
1840
  var div = '<div class="pagelayer-elp-textarea-div">'+
1841
- '<textarea '+rows+'class="pagelayer-elp-textarea">'+prop.c['val']+'</textarea>'+
1842
  '</div>';
1843
 
1844
  row.append(div);
1845
-
 
1846
  // Handle on change
1847
  row.find('.pagelayer-elp-textarea').on('input', function(){
1848
  _pagelayer_set_atts(row, pagelayer_trim(jQuery(this).val()));// Save and Render
1768
  function pagelayer_elp_editor(row, prop){
1769
 
1770
  var div = '<div class="pagelayer-elp-editor-div">'+
1771
+ '<textarea class="pagelayer-elp-editor"></textarea>'+
1772
  '</div>';
1773
 
1774
  row.append(div);
1775
 
1776
  var editor = row.find('.pagelayer-elp-editor');
1777
+ editor.val(prop.c['val']);
1778
 
1779
  // No SVG Icons for now
1780
  jQuery.trumbowyg.svgPath = false;
1839
  var rows = prop.rows ? 'rows="'+prop.rows+' "' : '';
1840
 
1841
  var div = '<div class="pagelayer-elp-textarea-div">'+
1842
+ '<textarea '+rows+'class="pagelayer-elp-textarea"></textarea>'+
1843
  '</div>';
1844
 
1845
  row.append(div);
1846
+ row.find('.pagelayer-elp-textarea').val(prop.c['val']);
1847
+
1848
  // Handle on change
1849
  row.find('.pagelayer-elp-textarea').on('input', function(){
1850
  _pagelayer_set_atts(row, pagelayer_trim(jQuery(this).val()));// Save and Render
js/widgets.js CHANGED
@@ -280,18 +280,6 @@ function pagelayer_preDAndD_image(jEle){
280
 
281
  // Making page image clickable to open media library
282
  jEle.css('cursor', 'pointer');
283
- jEle.find('.pagelayer-img').on('click', function(){
284
- jEle.click();
285
-
286
- // Getting Id of jEle
287
- var widgetid = pagelayer_id(jEle);
288
-
289
- // Finding widget image setting using id of jEle. Finding image editor setting from all of the other settings.
290
- var rowImage = pagelayer.$$('[pagelayer-element-id='+widgetid+']').find('.pagelayer-elp-image').first();
291
-
292
- rowImage.click();
293
-
294
- });
295
 
296
  dropzoneParent = jEle.find('.pagelayer-img').parent();
297
 
280
 
281
  // Making page image clickable to open media library
282
  jEle.css('cursor', 'pointer');
 
 
 
 
 
 
 
 
 
 
 
 
283
 
284
  dropzoneParent = jEle.find('.pagelayer-img').parent();
285
 
languages/en.json CHANGED
@@ -1749,5 +1749,7 @@
1749
  "template_update_success" : "Template was updated successfully!",
1750
  "trig_beforeLoad" : "Before Page Load",
1751
  "popup_load_desc" : "Show popup till the page has loaded",
1752
- "stop_loop" : "Stop Looping"
 
 
1753
  }
1749
  "template_update_success" : "Template was updated successfully!",
1750
  "trig_beforeLoad" : "Before Page Load",
1751
  "popup_load_desc" : "Show popup till the page has loaded",
1752
+ "stop_loop" : "Stop Looping",
1753
+ "usr_field_desc" : "You can use a field name with a prefix $ to print your field value e.g. if the field name is <b>fieldname</b> then use the variable <b>$fieldname</b>",
1754
+ "xss_found" : "Following not allowed content found : "
1755
  }
main/ajax.php CHANGED
@@ -161,6 +161,13 @@ function pagelayer_save_content(){
161
  'post_content' => $content,
162
  );
163
 
 
 
 
 
 
 
 
164
  // Any properties ?
165
  if(!empty($_REQUEST['page_props'])){
166
 
@@ -250,6 +257,12 @@ function pagelayer_save_templ_content($echo = false){
250
  // Some AJAX security
251
  check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
252
 
 
 
 
 
 
 
253
  // Are you allowed to edit ?
254
  if(!pagelayer_user_can_edit($_REQUEST['postID'])){
255
  $msg['error'][] = __pl('no_permission');
@@ -277,6 +290,13 @@ function pagelayer_save_templ_content($echo = false){
277
  continue;
278
  }
279
 
 
 
 
 
 
 
 
280
  // We need to create the post
281
  if(empty($value['post_id'])){
282
 
@@ -365,6 +385,9 @@ function pagelayer_givejs(){
365
  // Load shortcodes
366
  pagelayer_load_shortcodes();
367
 
 
 
 
368
  // Pagelayer Template Loading Mechanism
369
  include_once(PAGELAYER_DIR.'/js/givejs.php');
370
 
161
  'post_content' => $content,
162
  );
163
 
164
+ $is_xss = pagelayer_xss_content($content);
165
+
166
+ if(!current_user_can('manage_options') && strlen($is_xss) > 0){
167
+ $msg['error'][] = __pl('xss_found').' - '.$is_xss;
168
+ pagelayer_json_output($msg);
169
+ }
170
+
171
  // Any properties ?
172
  if(!empty($_REQUEST['page_props'])){
173
 
257
  // Some AJAX security
258
  check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
259
 
260
+ if ( ! current_user_can( get_post_type_object( 'pagelayer-template' )->cap->create_posts ) ) {
261
+ $ret['error'][$g_post_id] = __pl('no_permission');
262
+ pagelayer_json_output($ret);
263
+ return false;
264
+ }
265
+
266
  // Are you allowed to edit ?
267
  if(!pagelayer_user_can_edit($_REQUEST['postID'])){
268
  $msg['error'][] = __pl('no_permission');
290
  continue;
291
  }
292
 
293
+ $is_xss = pagelayer_xss_content($value['content']);
294
+
295
+ if(!current_user_can('manage_options') && strlen($is_xss) > 0){
296
+ $ret['error'][$g_post_id] = __pl('xss_found').' - '.$is_xss;
297
+ pagelayer_json_output($ret);
298
+ }
299
+
300
  // We need to create the post
301
  if(empty($value['post_id'])){
302
 
385
  // Load shortcodes
386
  pagelayer_load_shortcodes();
387
 
388
+ // Load font options
389
+ //pagelayer_load_font_options();
390
+
391
  // Pagelayer Template Loading Mechanism
392
  include_once(PAGELAYER_DIR.'/js/givejs.php');
393
 
main/functions.php CHANGED
@@ -915,6 +915,45 @@ function pagelayer_unescapeHTML($str){
915
  return $str;
916
  }
917
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
918
  // Show promo notice on dashboard
919
  function pagelayer_show_promo(){
920
 
@@ -1280,7 +1319,7 @@ function pagelayer_posts($params, $args = []){
1280
  <div class="pagelayer-wposts-featured">';
1281
  $data .= '<a href="'. get_the_permalink() .'">';
1282
 
1283
- if(isset($params['show_thumb']) && has_post_thumbnail( $postsquery->ID )){
1284
  $data .= '<div class="pagelayer-wposts-thumb"'.(has_post_thumbnail() ? ' style="background:url('.get_the_post_thumbnail_url($postsquery->ID,$params['thumb_size']).')"' : '').'></div>';
1285
  }
1286
  /* if($params['show_thumb'] && has_post_thumbnail( $postsquery->ID )){
@@ -1289,22 +1328,22 @@ function pagelayer_posts($params, $args = []){
1289
  $data .= '</a></div>
1290
  <div class="pagelayer-wposts-content">';
1291
 
1292
- if(isset($params['show_title'])){
1293
  $data .= '<a href="'.esc_url( get_permalink() ).'" rel="bookmark"><div class="pagelayer-wposts-title">'. get_the_title().'</div></a>';
1294
  }
1295
 
1296
  $data .= '<div class="pagelayer-wposts-meta">';
1297
  $sep = '';
1298
- if(isset($params['meta_sep'])){
1299
  $sep = '<b class="pagelayer-wposts-sep">'.$params['meta_sep'].'</b>';
1300
  }
1301
- if(isset($params['author'])){
1302
  $data .= '<span class="pagelayer-wposts-author">By <a class="pagelayer-wposts-author-url" href="'.esc_url(get_author_posts_url(get_the_author_meta('ID'))).'">'.esc_html(get_the_author()).'</a></span>'.$sep;
1303
  }
1304
- if(isset($params['date'])){
1305
  $data .= '<span class="pagelayer-wposts-date"><time class="pagelayer-wposts-entry-date published updated" datetime="'.get_the_date('c').'"><span class="date-d">'.get_the_date('j').'</span><span class="date-my">'.get_the_date('M, y').'</span></time></span>'.$sep;
1306
  }
1307
- if(isset($params['category'])){
1308
  $category = get_the_category();
1309
  $singlecategory = '';
1310
  foreach( $category as $cat ){
@@ -1312,7 +1351,7 @@ function pagelayer_posts($params, $args = []){
1312
  }
1313
  $data .= '<span class="pagelayer-wposts-category">' . $singlecategory . '</span>'.$sep;
1314
  }
1315
- if(isset($params['tags'])){
1316
  $tags = get_the_tags();
1317
  $singletag = '';
1318
  if(!empty($tags)){
@@ -1325,13 +1364,13 @@ function pagelayer_posts($params, $args = []){
1325
  }
1326
 
1327
  }
1328
- if(isset($params['comments'])){
1329
  $data .= '<span class="pagelayer-wposts-comments"><i class="far fa-comment"></i><a href="' . esc_url( get_permalink() ) . '">' . esc_html(get_comments_number()) . '</a></span>'.$sep;
1330
  }
1331
 
1332
  $data .= '</div>';
1333
 
1334
- if(isset($params['show_content'])){
1335
  $data .= '<div class="pagelayer-wposts-excerpt">';
1336
  if($params['show_content'] == 'excerpt'){
1337
  $data .= do_shortcode(get_the_excerpt());
@@ -1341,7 +1380,7 @@ function pagelayer_posts($params, $args = []){
1341
  $data .= '</div>';
1342
  }
1343
 
1344
- if(isset($params['show_more'])){
1345
  $data .= '<div class="pagelayer-wposts-mdiv"><a class="pagelayer-wposts-more pagelayer-btn-holder pagelayer-ele-link '.$params['btn_type'].' '.$params['size'].' '.$params['icon_position'].'" href="'. get_the_permalink().'">';
1346
 
1347
  if($params['icon']){
@@ -2175,4 +2214,8 @@ function pagelayer_captcha_verify(){
2175
  }
2176
 
2177
  return false;
 
 
 
 
2178
  }
915
  return $str;
916
  }
917
 
918
+ // Check for XSS codes in our shortcodes submitted
919
+ function pagelayer_xss_content($data){
920
+ $data = pagelayer_unescapeHTML($data);
921
+ $data = preg_split('/\s/', $data);
922
+ $data = implode('', $data);
923
+ //echo $data;
924
+
925
+ if(preg_match('/["\']javascript\:/is', $data)){
926
+ return 'javascript';
927
+ }
928
+
929
+ if(preg_match('/["\']vbscript\:/is', $data)){
930
+ return 'vbscript';
931
+ }
932
+
933
+ if(preg_match('/\-moz\-binding\:/is', $data)){
934
+ return '-moz-binding';
935
+ }
936
+
937
+ if(preg_match('/expression\(/is', $data)){
938
+ return 'expression';
939
+ }
940
+
941
+ if(preg_match('/\<(iframe|frame|script|style|link|applet|embed|xml|svg|object|layer|ilayer|meta)/is', $data, $matches)){
942
+ return $matches[1];
943
+ }
944
+
945
+ $not_allowed = array('onclick', 'ondblclick', 'onmousedown', 'onmousemove', 'onmouseout', 'onmouseover', 'onmouseup', 'onload', 'onunload', 'onchange', 'onsubmit', 'onreset', 'onselect', 'onblur', 'onfocus', 'onkeydown', 'onkeypress', 'onkeyup', 'onafterprint', 'onbeforeprint', 'onbeforeunload', 'onerror', 'onhashchange', 'onmessage', 'onoffline', 'ononline', 'onpagehide', 'onpageshow', 'onpopstate', 'onresize', 'onstorage', 'oncontextmenu', 'oninput', 'oninvalid', 'onsearch', 'onkeydown', 'onmousewheel', 'onwheel', 'ondrag', 'ondragend', 'ondragenter', 'ondragleave', 'ondragover', 'ondragstart', 'ondrop', 'onscroll', 'oncopy', 'oncut', 'onpaste', 'onabort', 'oncanplay', 'oncanplaythrough', 'oncuechange', 'ondurationchange', 'onemptied', 'onended', 'onloadeddata', 'onloadedmetadata', 'onloadstart', 'onpause', 'onplay', 'onplaying', 'onprogress', 'onratechange', 'onseeked', 'onseeking', 'onstalled', 'onsuspend', 'ontimeupdate', 'onvolumechange', 'onwaiting', 'ontoggle');
946
+
947
+ $not_allowed = implode('|', $not_allowed);
948
+
949
+ if(preg_match('/('.($not_allowed).')=/is', $data, $matches)){
950
+ return $matches[1];
951
+ }
952
+
953
+ return;
954
+
955
+ }
956
+
957
  // Show promo notice on dashboard
958
  function pagelayer_show_promo(){
959
 
1319
  <div class="pagelayer-wposts-featured">';
1320
  $data .= '<a href="'. get_the_permalink() .'">';
1321
 
1322
+ if(!empty($params['show_thumb']) && has_post_thumbnail( $postsquery->ID )){
1323
  $data .= '<div class="pagelayer-wposts-thumb"'.(has_post_thumbnail() ? ' style="background:url('.get_the_post_thumbnail_url($postsquery->ID,$params['thumb_size']).')"' : '').'></div>';
1324
  }
1325
  /* if($params['show_thumb'] && has_post_thumbnail( $postsquery->ID )){
1328
  $data .= '</a></div>
1329
  <div class="pagelayer-wposts-content">';
1330
 
1331
+ if(!empty($params['show_title'])){
1332
  $data .= '<a href="'.esc_url( get_permalink() ).'" rel="bookmark"><div class="pagelayer-wposts-title">'. get_the_title().'</div></a>';
1333
  }
1334
 
1335
  $data .= '<div class="pagelayer-wposts-meta">';
1336
  $sep = '';
1337
+ if(!empty($params['meta_sep'])){
1338
  $sep = '<b class="pagelayer-wposts-sep">'.$params['meta_sep'].'</b>';
1339
  }
1340
+ if(!empty($params['author'])){
1341
  $data .= '<span class="pagelayer-wposts-author">By <a class="pagelayer-wposts-author-url" href="'.esc_url(get_author_posts_url(get_the_author_meta('ID'))).'">'.esc_html(get_the_author()).'</a></span>'.$sep;
1342
  }
1343
+ if(!empty($params['date'])){
1344
  $data .= '<span class="pagelayer-wposts-date"><time class="pagelayer-wposts-entry-date published updated" datetime="'.get_the_date('c').'"><span class="date-d">'.get_the_date('j').'</span><span class="date-my">'.get_the_date('M, y').'</span></time></span>'.$sep;
1345
  }
1346
+ if(!empty($params['category'])){
1347
  $category = get_the_category();
1348
  $singlecategory = '';
1349
  foreach( $category as $cat ){
1351
  }
1352
  $data .= '<span class="pagelayer-wposts-category">' . $singlecategory . '</span>'.$sep;
1353
  }
1354
+ if(!empty($params['tags'])){
1355
  $tags = get_the_tags();
1356
  $singletag = '';
1357
  if(!empty($tags)){
1364
  }
1365
 
1366
  }
1367
+ if(!empty($params['comments'])){
1368
  $data .= '<span class="pagelayer-wposts-comments"><i class="far fa-comment"></i><a href="' . esc_url( get_permalink() ) . '">' . esc_html(get_comments_number()) . '</a></span>'.$sep;
1369
  }
1370
 
1371
  $data .= '</div>';
1372
 
1373
+ if(!empty($params['show_content'])){
1374
  $data .= '<div class="pagelayer-wposts-excerpt">';
1375
  if($params['show_content'] == 'excerpt'){
1376
  $data .= do_shortcode(get_the_excerpt());
1380
  $data .= '</div>';
1381
  }
1382
 
1383
+ if(!empty($params['show_more'])){
1384
  $data .= '<div class="pagelayer-wposts-mdiv"><a class="pagelayer-wposts-more pagelayer-btn-holder pagelayer-ele-link '.$params['btn_type'].' '.$params['size'].' '.$params['icon_position'].'" href="'. get_the_permalink().'">';
1385
 
1386
  if($params['icon']){
2214
  }
2215
 
2216
  return false;
2217
+ }
2218
+
2219
+ function pagelayer_load_font_options(){
2220
+ include_once(PAGELAYER_DIR.'/main/font-options.php');
2221
  }
main/settings.php CHANGED
@@ -644,6 +644,11 @@ function pagelayer_settings_page(){
644
  </div>
645
  <div class="pagelayer-tab-panel pagelayer-cf" id="contactform">
646
  <table>
 
 
 
 
 
647
  <tr>
648
  <th scope="row">To Email:</th>
649
  <td>
644
  </div>
645
  <div class="pagelayer-tab-panel pagelayer-cf" id="contactform">
646
  <table>
647
+ <tr>
648
+ <td colspan="2" style="align:middle;">
649
+ <p>You can use a field name with a prefix $ to print your field value e.g. if the field name is <b>fieldname</b> then use the variable <b>$fieldname</b></p>
650
+ </td>
651
+ </tr>
652
  <tr>
653
  <th scope="row">To Email:</th>
654
  <td>
main/shortcode_functions.php CHANGED
@@ -85,8 +85,9 @@ function pagelayer_render_shortcode($atts, $content = '', $tag = ''){
85
 
86
  $innerHTML = @$pagelayer->shortcodes[$tag]['innerHTML'];
87
  if(!empty($innerHTML) && !empty($content)){
88
- $el['oAtts'][$innerHTML] = $content;
89
- $el['atts'][$innerHTML] = $content;
 
90
  }
91
 
92
  // The default class
@@ -570,6 +571,7 @@ function pagelayer_create_sc(&$el){
570
  if(!empty($el['oAtts'])){
571
 
572
  foreach($el['oAtts'] as $k => $v){
 
573
  $el['attr'][] = 'pagelayer-a-'.$k.'="'.$v.'"';
574
  }
575
 
@@ -579,6 +581,7 @@ function pagelayer_create_sc(&$el){
579
  if(!empty($el['tmp'])){
580
 
581
  foreach($el['tmp'] as $k => $v){
 
582
  $el['attr'][] = 'pagelayer-tmp-'.$k.'="'.$v.'"';
583
  }
584
 
85
 
86
  $innerHTML = @$pagelayer->shortcodes[$tag]['innerHTML'];
87
  if(!empty($innerHTML) && !empty($content)){
88
+ $_content = htmlentities($content, ENT_HTML5);
89
+ $el['oAtts'][$innerHTML] = $_content;
90
+ $el['atts'][$innerHTML] = $_content;
91
  }
92
 
93
  // The default class
571
  if(!empty($el['oAtts'])){
572
 
573
  foreach($el['oAtts'] as $k => $v){
574
+ $v = str_replace('&', '&amp;', $v);
575
  $el['attr'][] = 'pagelayer-a-'.$k.'="'.$v.'"';
576
  }
577
 
581
  if(!empty($el['tmp'])){
582
 
583
  foreach($el['tmp'] as $k => $v){
584
+ $v = str_replace('&', '&amp;', $v);
585
  $el['attr'][] = 'pagelayer-tmp-'.$k.'="'.$v.'"';
586
  }
587
 
main/template.php CHANGED
@@ -333,6 +333,7 @@ function pagelayer_get_header($name) {
333
  </head>
334
 
335
  <body <?php body_class(); ?>>
 
336
  <?php
337
 
338
  // Output our content
333
  </head>
334
 
335
  <body <?php body_class(); ?>>
336
+ <?php if(function_exists('wp_body_open')) { wp_body_open(); } ?>
337
  <?php
338
 
339
  // Output our content
pagelayer.php CHANGED
@@ -3,7 +3,7 @@
3
  Plugin Name: PageLayer
4
  Plugin URI: http://wordpress.org/plugins/pagelayer/
5
  Description: PageLayer is a WordPress page builder plugin. Its very easy to use and very light on the browser.
6
- Version: 1.1.7
7
  Author: Pagelayer Team
8
  Author URI: https://pagelayer.com/
9
  License: LGPL v2.1
3
  Plugin Name: PageLayer
4
  Plugin URI: http://wordpress.org/plugins/pagelayer/
5
  Description: PageLayer is a WordPress page builder plugin. Its very easy to use and very light on the browser.
6
+ Version: 1.1.8
7
  Author: Pagelayer Team
8
  Author URI: https://pagelayer.com/
9
  License: LGPL v2.1
readme.txt CHANGED
@@ -4,7 +4,7 @@ Tags: page builder, editor, landing page, drag-and-drop, pagelayer, form-builder
4
  Requires at least: 4.7
5
  Tested up to: 5.4
6
  Requires PHP: 5.5
7
- Stable tag: 1.1.7
8
  License: LGPL v2.1
9
  License URI: http://www.gnu.org/licenses/lgpl-2.1.html
10
 
@@ -109,6 +109,12 @@ Do you have questions related to PageLayer ? Use the following links :
109
 
110
  == Changelog ==
111
 
 
 
 
 
 
 
112
  = 1.1.7 (June 26, 2020) =
113
  * [Feature] Now you can open the media library by clicking the images and choosing or uploading the same.
114
  * [Tasks] Added Mute and Looping options in background video in rows and columns.
4
  Requires at least: 4.7
5
  Tested up to: 5.4
6
  Requires PHP: 5.5
7
+ Stable tag: 1.1.8
8
  License: LGPL v2.1
9
  License URI: http://www.gnu.org/licenses/lgpl-2.1.html
10
 
109
 
110
  == Changelog ==
111
 
112
+ = 1.1.8 (July 02, 2020) =
113
+ * [Security-Fix] Our internal security audit revealed XSS vulnerabilities. This is fixed. Please upgrade to this version ASAP !
114
+ * [Bug-fix] When an image was clicked, the image gallery was opened to choose the image. This was a bug introduced in the last version and is fixed now.
115
+ * [Bug-fix] In certain cases, the rich text content was not rendered properly. This is fixed.
116
+ * [Bug-fix] On turning on the error report in PHP, some PHP error notice was shown. This is fixed.
117
+
118
  = 1.1.7 (June 26, 2020) =
119
  * [Feature] Now you can open the media library by clicking the images and choosing or uploading the same.
120
  * [Tasks] Added Mute and Looping options in background video in rows and columns.