[Zed]

I’m not seeing anything obviously bad about the images, but they do get processed (resized and cropped) by WordPress according to the dimensions set/obtained in the theme configuration.

If you don’t want this to happen and would rather use the full sized images (at the expense of bandwidth/load speed/score in crawlers/seo) you can disable cropping in the theme’s options.

Note that you will need to regenerate the thumbnails/featured images to reflect this change.

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

Hi Magnus,

Thank you for your support and for your kind words. They were exactly what was needed to push us out of the laziness chair and get some things done. So in the past 7 days all four of our legacy themes received updates to address the (highly talked but lowly graded) XSS vulnerability. And some social icons.

The settings plugin is just a workaround solution that re-enables functionality already available in the themes (before WordPress.org changed the functionality rules applied onto themes) so we never considered hiding existing functionality behind a paywall.

And unless the rules change entirely to ban non-block/non-FSE themes from the repository, we don’t intend to abandon our themes (except for Zombie Apocalypse… but that one was born already dead).

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

Hi,

This is now fixed in the 1.8.3 update.

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

Hi,

The theme’s fonts file appears to be handled (filtered/minified) by something identifying as “OMGF” and this causes the files to be loaded through plain http, which the browsers refuse.

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

Hi,

Could you provide a link to your site where this issue is visible?

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

Hi,

We’ll definitely be adding those two (and more) in the next theme update, hopefully within a week or two for Verbosa.

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

Hi,

Does the editor work fine for other (theme/plugin) files?

It may be helpful to check through the log for more detailed information.

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

If you’re only seeing the warnings logged at odd times and not when you’re for example browsing the site and testing it, those may be due to your host using WP-CLI funtionality to perform administrative tasks (such as updates, backups).

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

Hi,

Is your site somehow running WordPress through WP-CLI? Is it using a regular hosting service or is it a (managed/dedicated) WordPress service?

Our classic themes are not compatible with and generate PHP warnings related to some of their global variables on sites relying on WP-CLI. Are those warning visible on the site or just present in the log file?

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

Hi,

That happens due to excessive sanitization of input data in the current plugin release, for which we already have a fix prepared which should become available soon.

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

Hi and sorry about that.

Mr. Kay was so anxious to add a new personality/child theme to Bravada that he integrated some cloning directly in the theme.

Today’s 1.1.3.1 update should take care of (some of) those pesky clones.

The Plus is neither affected by the issue nor does it include the fix since we haven’t yet synchronized it with the free edition. I just checked the changelogs and we did sync and release Bravada Plus 1.1.3 which created the duplication issue. Sorry about the confusion, we’ll have this sorted out as soon as possible with a new Plus update.

Edit: Update 1.1.4 for both Bravada and Bravada Plus is available to sort out the content cloning issue and brings the two editions back in sync.

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

Hi everyone and sorry about the delay with a clarification.

As the warning message displayed by the security plugin itself reads,
this makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages

Due to sub-optimal/missing sanitization to the get_the_author() calls used by the theme, this issue can affect (larger) websites if rogue registered users (contributor/editor levels and above are needed) decide to insert unwanted content in their user name fields.

 

Personally, I find it weird that it’s the theme’s responsibility for sanitizing this data since it’s a core WordPress function returning database-stored content. If that field is not expected to store advanced HTML markup then WordPress should perform the proper level of sanitization/filtering on save.

To be clear, the theme does not handle any saving or input processing for this data, it only displays whatever WordPress already has saved in the database for the user name field, which has passed WordPress existing sanitization rules when that data was saved through the dashboard by users with sufficient permissions on the site.

 

This code has been in our themes in the same or very similar form since their launch (starting with Mantra back in 2009) and we have yet to have any kind of reports about XSS exploits through this route – frankly, if a rogue registered user with sufficient access decides to embed bad content on the site, the user name field is the least of your worries (and most likely not the first target).

This is only now popping up now because a security tester bulk reported the insufficient sanitization to patchstack.com (a large vulnerabilities testing/disclosing database which also offers paid security services), and several security plugins are taking inspiration for their lists of things to monitor from there.

 

Regardless of circumstances, we’ll be hardening the sanitization around the several get_the_author() function calls used in our themes, but since this issue is considered low severity/priority even by the patchstack.com report, we’ll be addressing it in the regular¹ theme updates cycle as we get to them¹ – for example, the correction is already present in the Bravada 1.1.3 update released yesterday.

¹ Mr. Kay had a different plan so you may already notice updates out there addressing this.

 

Status update: As of January 24th 2025, all our themes received updates to harden sanitization on author name output function calls.

 

PS: I’ve split this topic from the original post as that one was about mixed http/https content in the page, which is a different matter.

• This reply was modified 4 months ago by Zed. Reason: updated for updates status
• This reply was modified 1 week ago by Zed. Reason: status update

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

Hi,

We are aware of that issue and we’ll correct it as soon as possible with a theme update. WordPress 6.3 changed how a core hook we filter in the theme is used.

In the meantime you can hide the erroneous text by disabling the comment count visibility through the theme options.

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

Hi,

Please apply the following CSS to resolve the error messages getting cropped at the edge of the content:

body article.hentry {
  overflow: visible;
}

The theme does not employ z-index on its sidebars. The overlapping happens simply because of the order of elements in the markup.

#main {
   z-index: 1;
}

This wouldn’t be a problem if the form had a limited width within the content.

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

Hi,

That functionality is not available in either of the theme’s editions, but should be achievable with CSS.
Can you include a link to your site and the URL for the alternative logo?

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

Hi,

If you use enter in the visual editor, that’s encoded to specific markup which WordPress then stores on save and uses on the frontend. If you enter spaces in the source/code editor, those are filtered out on the frontend. In the source/code editor you need to manually enter <br> line breaks.

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

Hi,

Both the site title and page (section) titles have their individual configurable typography controls in the theme’s options:
https://www.cryoutcreations.eu/docs/themes/options/typography/header/?theme=bravada#site-title
https://www.cryoutcreations.eu/docs/themes/options/typography/content/?theme=bravada#header-titles

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

Hi,

Could you include a link to your site for me to see what you’re trying to achieve?

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

Hi,

We always test with latest WordPress versions and I was unable to observe any issues between our Serious Settings plugin (current version 0.5.14) and WordPress 6.2.

Do you have any specific error messages with 0.5.14?

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

Hi,

The theme’s layout is configurable in the settings page. This layout applies throughout the site (except the presentation page feature, when that is used).

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

Hi,

That’s caused by the sensei-lms plugin applying its styling to broadly and overlapping the theme. Try using the following CSS to correct it:

#nav-below .nav-previous, #nav-below .nav-next {
  width: 50% !important;
}

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

Hi,

That effect is usually obtained with JavaScript libraries that have expanded on one another and share similar names: fancybox, lightbox, colorbox. There are multiple WordPress plugins that implement them for WordPress sites.

Animation happen when triggered (on click/hover, other user interaction) so the animations/popup themselves add no extra drag on the performance of the site. However, the scripts/resources needed to add the effects need to be loaded on the site, and depending on the solution chosen they may be lighter or heavier on the site.

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

@deKay, your issue is different and looks to be caused by the theme failing to retrieve in-content images to use a featured images from your posts.
This happens because the function checking for such images is told by WordPress that the posts have images attached (inserted in) to them when in fact they don’t appear to (maybe they had them in the past?).

We’ll add some extra logic checks in the next update to not trust WordPress’ returned data blindly and to avoid this condition.

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

@Draky, there are no lines 36 or 299 in Tempera’s functions.php file, so you must have edited it.

The Warning: Trying to access array offset on value of type bool ... error will hopefully get fixed in a future theme update, making Tempera usable with WP CLI.

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

Hi,

The theme’s presentation page sections are designed to be used with different background colors (in which case the extra spacing makes sense).

With a uniform background, these spaces add up. To reduce them, try the following styling:

#front-text1, #front-text2, #front-text5 {
  padding-bottom: 0px;
}
#pp-texttop, #pp-textmiddle, #pp-textbottom,
#front-columns-box, .presentation-page #content {
  padding-top: 25px;
  padding-bottom: 15px;
}

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

Hi,

Mantra and WooCommerce is a combination we haven’t really ever thoroughly tested or looked into.

Customizing appearance to make things fit/match will most likely need some amount of custom styling.
A link to your site would be very useful to look at current state and test the necessary tweaks.

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

Hi,

Try the following custom styling:

#content .woocommerce-loop-product__title {
  font-size: 1.2em;
  line-height: 1.2em;
}

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

Hi,

Our slider plugin uses the standard posts editor screen to manage slides. To publish (activate) slides at a specific date/time simply enter the desired options in the publishing panel:

WordPress doesn’t also have an unpublish feature, so such a thing is not available for slides either.

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

Hi,

Check if your posts use post formats as those are always displayed in full regardless of excerpt length options.

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Zed]

Hi,

The bar holding the socials is configurable in the theme’s options. The socials’ visibility is also separately configurable.

---

If you like our creations, help us share by rating them on WordPress.org.
Please check the available documentation and search the forums before starting a topic.

[Author]

Posts