CVE-2018-8729: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-03-15T17:29Z
Repository: https://github.com/pojome/activity-log
Language: PHP
Files changed: classes/class-aal-activity-log-list-table.php, hooks/class-aal-hook-attachment.php, hooks/class-aal-hook-comments.php, hooks/class-aal-hook-posts.php
Commit date: 2018-03-08 13:37:03 +0200
Commit message: Fix potential security issue

Diff: diff --git a/classes/class-aal-activity-log-list-table.php b/classes/class-aal-activity-log-list-table.php
index 187d84d..f0b5436 100644
--- a/classes/class-aal-activity-log-list-table.php
+++ b/classes/class-aal-activity-log-list-table.php
@@ -200,20 +200,20 @@ class AAL_Activity_Log_List_Table extends WP_List_Table {
 		$return = apply_filters( 'aal_table_list_column_label', $return, $item );
 		return $return;
 	}
 	
 	public function column_description( $item ) {
-		$return = $item->object_name;
+		$return = esc_html( $item->object_name );
 		
 		switch ( $item->object_type ) {
 			case 'Post' :
-				$return = sprintf( '<a href="%s">%s</a>', get_edit_post_link( $item->object_id ), $item->object_name );
+				$return = sprintf( '<a href="%s">%s</a>', get_edit_post_link( $item->object_id ), esc_html( $item->object_name ) );
 				break;
 			
 			case 'Taxonomy' :
 				if ( ! empty( $item->object_id ) )
-					$return = sprintf( '<a href="%s">%s</a>', get_edit_term_link( $item->object_id, $item->object_subtype ), $item->object_name );
+					$return = sprintf( '<a href="%s">%s</a>', get_edit_term_link( $item->object_id, $item->object_subtype ), esc_html( $item->object_name ) );
 				break;
 			
 			case 'Comments' :
 				if ( ! empty( $item->object_id ) && $comment = get_comment( $item->object_id ) ) {
 					$return = sprintf( '<a href="%s">%s #%d</a>', get_edit_comment_link( $item->object_id ), $item->object_name, $item->object_id );
@@ -222,11 +222,11 @@ class AAL_Activity_Log_List_Table extends WP_List_Table {
 			
 			case 'Export' :
 				if ( 'all' === $item->object_name ) {
 					$return = __( 'All', 'aryo-activity-log' );
 				} else {
-					$pt     = get_post_type_object( $item->object_name );
+					$pt = get_post_type_object( $item->object_name );
 					$return = ! empty( $pt->label ) ? $pt->label : $item->object_name;
 				}
 				break;
 
 			case 'Options' :
diff --git a/hooks/class-aal-hook-attachment.php b/hooks/class-aal-hook-attachment.php
index a0a9af8..3644cc9 100644
--- a/hooks/class-aal-hook-attachment.php
+++ b/hooks/class-aal-hook-attachment.php
@@ -9,11 +9,11 @@ class AAL_Hook_Attachment extends AAL_Hook_Base {
 		aal_insert_log( array(
 			'action'         => $action,
 			'object_type'    => 'Attachment',
 			'object_subtype' => $post->post_type,
 			'object_id'      => $attachment_id,
-			'object_name'    => get_the_title( $post->ID ),
+			'object_name'    => esc_html( get_the_title( $post->ID ) ),
 		) );
 	}
 
 	public function hooks_delete_attachment( $attachment_id ) {
 		$this->_add_log_attachment( 'deleted', $attachment_id );
@@ -33,6 +33,6 @@ class AAL_Hook_Attachment extends AAL_Hook_Base {
 		add_action( 'delete_attachment', array( &$this, 'hooks_delete_attachment' ) );
 		
 		parent::__construct();
 	}
 
-}
\ No newline at end of file
+}
diff --git a/hooks/class-aal-hook-comments.php b/hooks/class-aal-hook-comments.php
index ff084bf..fc15d8c 100644
--- a/hooks/class-aal-hook-comments.php
+++ b/hooks/class-aal-hook-comments.php
@@ -9,11 +9,11 @@ class AAL_Hook_Comments extends AAL_Hook_Base {
 		
 		aal_insert_log( array(
 			'action'         => $action,
 			'object_type'    => 'Comments',
 			'object_subtype' => get_post_type( $comment->comment_post_ID ),
-			'object_name'    => get_the_title( $comment->comment_post_ID ),
+			'object_name'    => esc_html( get_the_title( $comment->comment_post_ID ) ),
 			'object_id'      => $id,
 		) );
 	}
 	
 	public function handle_comment_log( $comment_ID, $comment = null ) {
@@ -69,6 +69,6 @@ class AAL_Hook_Comments extends AAL_Hook_Base {
 		add_action( 'transition_comment_status', array( &$this, 'hooks_transition_comment_status' ), 10, 3 );
 		
 		parent::__construct();
 	}
 	
-}
\ No newline at end of file
+}
diff --git a/hooks/class-aal-hook-posts.php b/hooks/class-aal-hook-posts.php
index 4312920..644bfaf 100644
--- a/hooks/class-aal-hook-posts.php
+++ b/hooks/class-aal-hook-posts.php
@@ -2,11 +2,11 @@
 if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
 
 class AAL_Hook_Posts extends AAL_Hook_Base {
 	
 	protected function _draft_or_post_title( $post = 0 ) {
-		$title = get_the_title( $post );
+		$title = esc_html( get_the_title( $post ) );
 		
 		if ( empty( $title ) )
 			$title = __( '(no title)', 'aryo-activity-log' );
 		
 		return $title;

Vulnerable code: 		$return = $item->object_name;
				$return = sprintf( '<a href="%s">%s</a>', get_edit_post_link( $item->object_id ), $item->object_name );
					$return = sprintf( '<a href="%s">%s</a>', get_edit_term_link( $item->object_id, $item->object_subtype ), $item->object_name );
					$pt     = get_post_type_object( $item->object_name );
			'object_name'    => get_the_title( $post->ID ),
}
			'object_name'    => get_the_title( $comment->comment_post_ID ),
}
		$title = get_the_title( $post );
Fixed code: 		$return = esc_html( $item->object_name );
				$return = sprintf( '<a href="%s">%s</a>', get_edit_post_link( $item->object_id ), esc_html( $item->object_name ) );
					$return = sprintf( '<a href="%s">%s</a>', get_edit_term_link( $item->object_id, $item->object_subtype ), esc_html( $item->object_name ) );
					$pt = get_post_type_object( $item->object_name );
			'object_name'    => esc_html( get_the_title( $post->ID ) ),
}
			'object_name'    => esc_html( get_the_title( $comment->comment_post_ID ) ),
}
		$title = esc_html( get_the_title( $post ) );