v9.0.21
LatestVerified SafeReleased 1.1 MB
Other
- SECURITY: Fix a non-persistent reflected XSS vulnerability due to a missing validation and output escaping on the "paged" URL argument. This could allow an attacker, who persuaded you to click a personally-crafted link to your site's dashboard whilst you were logged in, to once run harmful JavaScript code. Thanks to Dmitrii Ignatyev for finding and responsibly disclosing this issue.
Improved
- Improved the delay updates feature to record the timestamp of the first occurrence of available plugin, theme, or core updates early, when their associated transient option is updated.
- Corrected improper usage of esc_html_e() when preceded by echo
- Added missing direct file access protection check for 'ABSPATH' to prevent unauthorized access.
- Get rid of the "implicitly marking parameter $logger as nullable is deprecated" deprecation warning
- Suppress false positive WordPress.WP.I18n.TextDomainMismatch warning due to different plugin slugs in free and premium versions.