ClassicPress 1.0.2 Release Notes

Announcements Release Notes
1

This is no longer the latest release of ClassicPress!
You can find the latest release at the top of the Release Notes subforum.

ClassicPress 1.0.2 is a security release to match the security changes in WordPress versions 5.2.3 and 4.9.11 (both released yesterday). It is available now.

Security fixes from 1.0.1

  • Props to Simon Scannell of RIPS Technologies for finding and disclosing two issues. The first, a cross-site scripting (XSS) vulnerability found in post previews by contributors. The second was a cross-site scripting vulnerability in stored comments.
  • Props to Tim Coen for disclosing an issue where validation and sanitization of a URL could lead to an open redirect.
  • Props to Anshul Jain for disclosing reflected cross-site scripting during media uploads.
  • Props to Zhouyuan Yang of Fortinet’s FortiGuard Labs who disclosed a vulnerability for cross-site scripting (XSS) in shortcode previews.
  • Props to Ian Dunn of the Core Security Team for finding and disclosing a case where reflected cross-site scripting could be found in the dashboard.
  • Props to Soroush Dalili (@irsdl) from NCC Group for disclosing an issue with URL sanitization that can lead to cross-site scripting (XSS) attacks.
  • In addition to the above changes, we are also updating jQuery on older versions of WordPress. This change was added in 5.2.1 and is now being brought to older versions.

For more information about the security changes in this release, see the WordPress 5.2.3 release notes post.

Download this release

New sites Download
ClassicPress-release-1.0.2.zip (9.9 MB)
and follow the installation instructions.
Existing WordPress sites Download the migration plugin and follow the migration instructions.
Existing ClassicPress sites Use the built-in update mechanism (more info).

Full changelog

The full changelog is available on GitHub.

11 Likes
2

So cool to get emails saying ‘Your site has updated to ClassicPress 1.0.2’! :heart_eyes:

9 Likes
3

2 posts were split to a new topic: jQuery patch in 1.0.2 did not receive a new version number

4

Yes, been getting those all day.

What’s really cool though is that I don’t have to worry about an update doing something totally weird to my sites. I can trust ClassicPress updates to be “no nasty surprises”.

8 Likes