Those on Wordpress. Visual Composer XSS vulnerabilities

[built]

We are getting in touch to let you know about multiple XSS security vulnerabilities in the Visual Composer WordPress plugin versions prior to 4.7.4 (releases prior to October 2, 2015).

What You Should Do
In order to secure your item from these vulnerabilities we strongly encourage you to update to version 4.7.4 or later as soon as possible. We recommend you take the following steps to secure your sites immediately, after first backing up your WordPress site.

Visual Composer Plugin Update Steps

• Log in to codecanyon.net and proceed to download the latest version of Visual Composer to your computer from this URL:http://codecanyon.net/item/visual-composer-page-builder-for-wordpress/242431
• Locate and unzip the downloaded plugin file.
• Connect to your server using an FTP client and upload the js_composer directory (from the downloaded zip file) to the wp-content/plugins/ directory. (Note: This will overwrite the old Visual Composer files with the secure versions.)
• Log into WordPress and navigate to the Plugins page to confirm the Visual Composer plugin is version 4.7.4

The link to the latest version, provided above, will be live for 3 weeks from the time this email was sent. After this period, you will need to access the latest version via your theme zip file.

Please note: This replaces the existing plugin under the licensing of the theme(s) you've purchased and is only licensed for use in these themes.

 

[Romac]

Ruh roh thanks for this. Saw this thread before I saw the email.