WPTavern: Avada Theme Version 5.1.5 Patches Stored XSS and CSRF Vulnerabilities
Theme Fusion’s Avada WordPress Theme, the highest selling theme on Themeforest for the past four years, has fixed stored XSS and CSRF vulnerabilities in its 5.1.5 release. The security issues were discovered by WP Hütte, a WordPress security blog, and the site published details of the vunlnerabilities after Theme Fusion patched its theme.
Although the patched version has been available since early April, a notification was only recently sent out to Avada customers from Envato via email, urging them to update. Avada announced the release of 5.1.5 but did not publish anything publicly on the security issues that it fixes. Customers started learning about the vulnerabilities from the WPScan Vulnerability Database, WP Hütte, and posts on Twitter.
Avada 5.1.5 is out and is compatible with the new WooCommerce 3.0!
— ThemeFusion (@Theme_Fusion) April 4, 2017
I love it, when I only discover information about security fixes by accident. #Avada https://t.co/DPZFiuEVzO
— Jan-Peter Lambeck (@jplambeck) May 18, 2017
@Theme_Fusion any public release on the #avada security issues?
— Val Vesa (@adspedia) May 18, 2017
Theme Fusion left the security issues buried in the changelog until today when customers began receiving email notices about it. A fix was available for more than a month while customers who were unaware and had not updated were left vulnerable. Envato’s email encourages all users to update, as the release is for all previous versions of Avada.
If you have purchased Avada for clients or for yourself, you can update to the latest version by downloading it from your Envato Market account and reinstalling it. Customers with the Envato Market WordPress plugin installed can access automatic updates within the WordPress admin.
Source: WordPress
