Oc-admin use different version of jquery-ui then front. That's a trick. Backoffice is accessible by password so it's not expected to see any vulnerability here.
Also forgot to put changelog for 8.1.2:
Osclass 8.1.2
------------------------
- Backoffice translation "Share" function will only send translation to Osclass team if it contains all required files.
It will also not include irrelevant files to this translation.
- Osclass will now throw warning message on translation page, if "max_input_vars" variable is high enough to complete full translation.
- Translation share button was re-positioned and renamed.
- When core translation is saved, related index.php file of this translation is updated with correct Osclass version and new fields added into array.
- When using language code in URL, changing language will now not redirect user to home page, but will remain on same page in selected locale.
- Premium listings (osc_get_premiums) are now cached for specific user/session separatelly.
- Added folders permission check when saving or updating translations from source code.
- Updated conversion of Greek alphabet to Latin in URLs.
- Updated conversion of Turkish alphabet to Latin in URLs.
- Improvements in auto-upgrade process to avoid extra clicks after upgrade has finished.
- Required custom fields now contains star (*) in label name on publish page.
- Added descriptive details on publish page related to custom field ID, type etc.
- Log file in Tools > Debug/Error log section can now be removed (remove button added).
- Theme functions has been added into CRON and can be executed by CRON as well (they were not included until now).
- jQuery UI library used in backoffice reverted to 1.12 because of compatibility issues. Front-end still use latest 1.13 version of jQuery UI.
- Updated sigma_default_direction function to first check RTL setup on language field.
- Added hooks user_pre_login_form & user_pre_register_form into Sigma theme.
- Added PHPMAILER_DEBUG_LEVEL contstant (value 1 - 4) that allows to debug PHP mailer.
- Excluded pages for CSS & JS optimization now consider page Location & Section (ie: item-item_add, item, home, register-register, login-recover, user-profile, ...).
Default exclusion list will now continue item-item_add, item-item_edit. If you want to minify/optimize on these pages as well, update these settings after Osclass update.
- Improved error reporting when image could not be loaded on publish page.
- Added latitude & longitude fields into backoffice - edit listing form. Created also standardized inputs for latitude and longitude.
- Added "Refresh images" option besides "Regenerate images", that will do the same except images building (will skip images generation and just call hooks).
- Fixed major bug when using language code in URL, plugin routes were corrupted.
- Fixed recaptcha verifcation on login page. Now recaptcha is verified against google services on background.
- Fixed PHP deprecated notices (PHP 8+).
- Fixed and improved minor design issues on Sigma theme.
- Fixes and improvements in hUser helper functions.
- Fixed missing resource_thumbnail_url filter across multiple files in Osclass core and backoffice.