CVE-2015-10013: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in WebDevStudios taxonomy-switcher Plugin up to 1.0.3 on WordPress. It has been classified as problematic. Affected is the function taxonomy_switcher_init of the file taxonomy-switcher.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.4 is able to address this issue. It is recommended to upgrade the affected component. VDB-217446 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-05T10:15Z
Repository: https://github.com/WebDevStudios/taxonomy-switcher
Language: PHP
Files changed: README.md, readme.txt, taxonomy-switcher.php
Commit date: 2015-04-20 14:49:30 -0400
Commit message: Update for xss vulnerability, https://make.wordpress.org/plugins/2015/04/20/fixing-add_query_arg-and-remove_query_arg-usage

Diff: diff --git a/README.md b/README.md
index 8bdca96..8f09f06 100755
--- a/README.md
+++ b/README.md
@@ -20,10 +20,13 @@ If parent isn't set, or you don't specify a comma-separated list of term ids to
 
 Compatible with [wp-cli](http://wp-cli.org/). `wp taxonomy-switcher` for instructions.
 
 ## Changelog
 
+#### 1.0.2
+* Update for xss vulnerability, https://make.wordpress.org/plugins/2015/04/20/fixing-add_query_arg-and-remove_query_arg-usage
+
 #### 1.0.1
 * Add ability to switch comma-separated list of term IDs.
 
 #### 1.0.0
 * Release
diff --git a/readme.txt b/readme.txt
index 57f0dac..6a0cf5b 100644
--- a/readme.txt
+++ b/readme.txt
@@ -2,11 +2,11 @@
 Contributors: webdevstudios, sc0ttkclark, jtsternberg
 Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=3084056
 Tags: taxonomy, taxonomies, term, terms, category, categories, convert, converter, tag, tags, custom taxonomy, custom taxonomies, switch taxonomies
 Requires at least: 3.5
 Tested up to: 3.8.1
-Stable tag: 1.0.1
+Stable tag: 1.0.2
 License: GNU AGPLv3
 License URI: http://www.gnu.org/licenses/agpl-3.0.html
 
 Switch the taxonomy for all terms or only child terms of a specified parent term.
 
@@ -40,10 +40,13 @@ Please keep in mind, if parent isn't set, or you don't specify a comma-separated
 1. Admin page
 2. Live-searching for a parent term
 
 == Changelog ==
 
+= 1.0.2 =
+* Update for xss vulnerability, https://make.wordpress.org/plugins/2015/04/20/fixing-add_query_arg-and-remove_query_arg-usage
+
 = 1.0.1 =
 * Add ability to switch comma-separated list of term IDs.
 
 = 1.0.0 =
 * Release
diff --git a/taxonomy-switcher.php b/taxonomy-switcher.php
index 4d0fb86..abd5798 100755
--- a/taxonomy-switcher.php
+++ b/taxonomy-switcher.php
@@ -1,11 +1,11 @@
 <?php
 /*
 Plugin Name: Taxonomy Switcher
 Plugin URI: https://github.com/WebDevStudios/taxonomy-switcher
 Description: Switches the Taxonomy of terms to a different Taxonomy
-Version: 1.0.1
+Version: 1.0.2
 Author: WebDevStudios
 Author URI: http://webdevstudios.com
 */
 
 /**
@@ -69,11 +69,11 @@ class Taxonomy_Switcher_Init {
 		}
 
 		// Save notices
 		add_option( 'taxonomy-switcher-notices', $success_notices, null, 'no' );
 		// Redirect and strip query string
-		wp_redirect( add_query_arg( 'page', $this->ui->admin_slug, admin_url( '/tools.php' ) ) );
+		wp_redirect( esc_url_raw( add_query_arg( 'page', $this->ui->admin_slug, admin_url( '/tools.php' ) ) ) );
 
 	}
 
 	/**
 	 * Show Notices for taxonomy switch

Vulnerable code: Stable tag: 1.0.1
Version: 1.0.1
		wp_redirect( add_query_arg( 'page', $this->ui->admin_slug, admin_url( '/tools.php' ) ) );
Fixed code: #### 1.0.2
* Update for xss vulnerability, https://make.wordpress.org/plugins/2015/04/20/fixing-add_query_arg-and-remove_query_arg-usage

Stable tag: 1.0.2
= 1.0.2 =
* Update for xss vulnerability, https://make.wordpress.org/plugins/2015/04/20/fixing-add_query_arg-and-remove_query_arg-usage

Version: 1.0.2
		wp_redirect( esc_url_raw( add_query_arg( 'page', $this->ui->admin_slug, admin_url( '/tools.php' ) ) ) );