Version 7.15 – March 3rd, 2026
—————————————————————————————–
Security hardening
– SECURITY: Fixed a vulnerability in the ToC element cache that allowed arbitrary content injection, which could be indexed by search engines or shown in social media previews
– SECURITY: Fixed an issue where Contributor+ users could create, edit, delete, or access layouts via custom code
– SECURITY: Fixed an issue where Contributor+ users could inject JavaScript into the Content Box and Portfolio elements
– SECURITY: Fixed JavaScript execution on the critical CSS page (administrator level only) when code was appended to the URL