thanks to dear member @theresa updated Avada | Best Website Builder For WordPress & WooCommerce with a new update entry:
March 19th, 2024
Read the rest of this update entry...
March 19th, 2024
Read the rest of this update entry...
- SECURITY: Fixed Contributor+-level-only XSS vulnerability, allowing site Contributors to add custom script code certain element link options
- SECURITY: Fixed Contributor+-level-only SSRF vulnerability, allowing Contributors to set Avada Form submission type to unsafe web requests
- SECURITY: Fixed Admin+-level-only SQL injection vulnerability, where SQL code could be injected into an Avada Forms submissions entry removal request
- SECURITY: Fixed possibility of Avada Forms upload folder...
- NEW: Added a completely revamped role manager version to allow better control over different Avada areas for different WP user roles
- NEW: Submission view access for Avada Forms can now be set to give read-only access for different user roles
- NEW: Added an option to Avada Forms, for easy resetting of form submission and view count
- NEW: Added video start and end times to YouTube, Vimeo, and Video elements
- NEW: Added an alignment option to the Audio element
- NEW: Added options to...
- SECURITY: Fixed Contributor+-level-only XSS vulnerability, allowing site Contributors to add event attributes to link attributes options
- FIXED: Conditional rendering logic not working correctly in Containers on some specific setups
- FIXED: Some Global Options and Page Options not correctly triggering page changed actions in Live Editor
- FIXED: Bulk removal of Avada Form enrties not working
- SECURITY: Additional security hardening for Button element attributes (This is only relevant when saving through a different page builder)
- NEW: Added 29 different dynamic data endpoints for The Events Calendar, making it easy to create custom single event layouts using the Layout Builder
- NEW: Added possibility to assign a layout to single Events Calendar events
- NEW: Added Event Venue Name, Event Organizer Name, Event Address and Event Cost to Post Meta element
- NEW: Added post type...
- SECURITY: Avada's WooCommerce quick view setup is vulnerable to Broken Access Control (BAC). Worst case: drafted or private products could be obtained through quick view.
- SECURITY: Deprecated custom colors are vulnerable to Cross Site Request Forgery (CSRF). Worst case: An admin user could be tricked into creating a new color.
- IMPROVEMENT: Removed a few unnecessary cache clearing hooks
- UPDATED: Option description for OSM element Map Style to include link to the Wiki
- FIXED...
- NEW: Added publishing status and date scheduling options to Off-Canvas
- NEW: Added playback rate options to the Audio element
- NEW: Added WooCommerce product's last purchase date and total purchase count to the dynamic data engine
- NEW: Added WooCommerce product purchased / not purchased checks to the rendering logic engine
- NEW: Added feature to dynamic data engine to pull images directly from a FileBird folder in the media library
- NEW: Added an option to Lightbox settings to allow...
- IMPROVEMENT: Limited scroll to notice to WooCommerce single product pages on add to cart Ajax complete
- UPDATED: Compatibility with WooCommerce 9.5.1
- FIXED: Data attributes not always being set in Counter element, Gallery element, and Lightboxes leading to display issues due to JS error
- FIXED: Menu elements being misplaced when used together with collapsed mobile menus in some setups
- FIXED: Border radius not working in Chrome for the to-top button when using scroll progress...
- NEW: Added custom code fields to single posts and pages
- NEW: Added code field to Off Canvas
- NEW: Added custom CSS field to Mega Menu library elements
- NEW: Added Threads, Bluesky, Mastodon, and Github to Social Links, Person, and Sharing Box elements
- NEW: Added an option to set a custom lightbox ID in the Gallery element, for easy connecting an Image element to it
- NEW: Added option to include WooCommere SKUs in the global search and also the Search element
- NEW: Added options to...
- SECURITY: Fixed Contributor+ level XSS issue, allowing authenticated users to use "javascript:" in element link fields
- FIXED: Privacy embed notices not correctly showing on some installs