CVE-2014-125103: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in BestWebSoft Twitter Plugin up to 1.3.2 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function twttr_settings_page of the file twitter.php. The manipulation of the argument twttr_url_twitter/bws_license_key/bws_license_plugin leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.3.7 is able to address this issue. The patch is named e04d59ab578316ffeb204cf32dc71c0d0e1ff77c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230155.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-05-31T03:15Z
Repository: https://github.com/wp-plugins/twitter-plugin
Language: PHP
Files changed: bws_menu/bws_menu.php, bws_menu/css/style.css, readme.txt, twitter.php
Commit date: 2014-08-07 15:47:35 +0000
Commit message: V2.37 - Security Exploit was fixed.

git-svn-id: https://plugins.svn.wordpress.org/twitter-plugin/trunk@961807 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/bws_menu/bws_menu.php b/bws_menu/bws_menu.php
index 82e4fad..826ee44 100755
--- a/bws_menu/bws_menu.php
+++ b/bws_menu/bws_menu.php
@@ -1,9 +1,9 @@
 <?php
 /*
 * Function for displaying BestWebSoft menu
-* Version: 1.3.2
+* Version: 1.3.7
 */
 
 if ( ! function_exists( 'bws_add_menu_render' ) ) {
 	function bws_add_menu_render() {
 		global $wpdb, $wpmu, $wp_version, $bws_plugin_info;
@@ -117,11 +117,11 @@ if ( ! function_exists( 'bws_add_menu_render' ) ) {
 				'wp_install'	=> '/wp-admin/plugin-install.php?tab=search&type=term&s=Custom+Fields+Search+bestwebsoft&plugin-search-input=Search+Plugins',
 				'settings'		=> 'admin.php?page=custom_fields_search.php'
 			),
 			'google-one/google-plus-one.php' => array(
 				'name'			=> 'Google +1',
-				'description'	=> 'Allows you to celebrate liked the article.',
+				'description'	=> 'Allows you to see how many times your page has been liked on Google Search Engine as well as who has liked the article.',
 				'link'			=> 'http://bestwebsoft.com/plugin/google-plus-one/?k=ce7a88837f0a857b3a2bb142f470853c&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version,
 				'download'		=> 'http://bestwebsoft.com/plugin/google-plus-one/?k=ce7a88837f0a857b3a2bb142f470853c&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version . '#download',
 				'wp_install'	=> '/wp-admin/plugin-install.php?tab=search&type=term&s=Google+%2B1+bestwebsoft&plugin-search-input=Search+Plugins',
 				'settings'		=> 'admin.php?page=google-plus-one.php',
 				'pro_version'	=> 'google-one-pro/google-plus-one-pro.php'
@@ -246,13 +246,38 @@ if ( ! function_exists( 'bws_add_menu_render' ) ) {
 			'user-role/user-role.php' => array(
 				'name'			=> 'User Role',
 				'description'	=> 'Allows to change wordpress user role capabilities.',
 				'link'			=> 'http://bestwebsoft.com/plugin/user-role/?k=dfe2244835c6fbf601523964b3f34ccc&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version,
 				'download'		=> 'http://bestwebsoft.com/plugin/user-role/?k=dfe2244835c6fbf601523964b3f34ccc&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version . '#download',
-				'wp_install'	=> 'http://bestwebsoft.com/plugin/user-role/?k=dfe2244835c6fbf601523964b3f34ccc&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version . '#download',
+				'wp_install'	=> '/wp-admin/plugin-install.php?tab=search&s=User+Role+BestWebSoft&plugin-search-input=Search+Plugins',
 				'settings'		=> 'admin.php?page=user-role.php',
 				'pro_version'	=> 'user-role-pro/user-role-pro.php'
+			),
+			'email-queue/email-queue.php' => array(
+				'name'			=> 'Email Queue',
+				'description'	=> 'Allows to manage email massages sent by BestWebSoft plugins.',
+				'link'			=> 'http://bestwebsoft.com/plugin/email-queue/?k=e345e1b6623f0dca119bc2d9433b130b&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version,
+				'download'		=> 'http://bestwebsoft.com/plugin/email-queue/?k=e345e1b6623f0dca119bc2d9433b130b&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version . '#download',
+				'wp_install'	=> '/wp-admin/plugin-install.php?tab=search&s=Email+Queue+BestWebSoft&plugin-search-input=Search+Plugins',
+				'settings'		=> 'admin.php?page=mlq_settings'
+			),
+			'limit-attempts/limit-attempts.php' => array(
+				'name'			=> 'Limit Attempts',
+				'description'	=> 'Allows you to limit rate of login attempts by the ip, and create whitelist and blacklist.',
+				'link'			=> 'http://bestwebsoft.com/plugin/limit-attempts/?k=b14e1697ee4d008abcd4bd34d492573a&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version,
+				'download'		=> 'http://bestwebsoft.com/plugin/limit-attempts/?k=b14e1697ee4d008abcd4bd34d492573a&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version . '#download',
+				'wp_install'	=> '/wp-admin/plugin-install.php?tab=search&s=Limit+Attempts+BestWebSoft&plugin-search-input=Search+Plugins',
+				'settings'		=> 'admin.php?page=limit-attempts.php',
+				'pro_version'	=> 'limit-attempts-pro/limit-attempts-pro.php'
+			),
+			'job-board/job-board.php' => array(
+				'name'			=> 'Job board',
+				'description'	=> 'Allows to create a job-board page on your site.',
+				'link'			=> 'http://bestwebsoft.com/plugin/job-board/?k=b0c504c9ce6edd6692e04222af3fed6f&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version,
+				'download'		=> 'http://bestwebsoft.com/plugin/job-board/?k=b0c504c9ce6edd6692e04222af3fed6f&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version . '#download',
+				'wp_install'	=> '/wp-admin/plugin-install.php?tab=search&type=term&s=Job+board+BestWebSoft&plugin-search-input=Search+Plugins',
+				'settings'		=> 'admin.php?page=job-board.php'
 			)
 		);
 		$bws_plugins_pro	= array(
 			'gallery-plugin-pro/gallery-plugin-pro.php' => array(
 				'name'			=> 'Gallery Pro',
@@ -303,11 +328,11 @@ if ( ! function_exists( 'bws_add_menu_render' ) ) {
 				'purchase' 		=> 'http://bestwebsoft.com/plugin/twitter-pro?k=63ecbf0cc9cebf060b5a3c9362299700&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version . '#purchase',
 				'settings' 		=> 'admin.php?page=twitter-pro.php'
 			),
 			'google-one-pro/google-plus-one-pro.php' => array(
 				'name'			=> 'Google +1 Pro',
-				'description'	=> 'Allows you to celebrate liked the article.',
+				'description'	=> 'Allows you to see how many times your page has been liked on Google Search Engine as well as who has liked the article.',
 				'link'			=> 'http://bestwebsoft.com/plugin/google-plus-one-pro/?k=f4b0a62d155c9df9601a0531ad5bd832&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version,
 				'purchase' 		=> 'http://bestwebsoft.com/plugin/google-plus-one-pro?k=f4b0a62d155c9df9601a0531ad5bd832&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version . '#purchase',
 				'settings' 		=> 'admin.php?page=google-plus-one-pro.php'
 			),
 			'facebook-button-pro/facebook-button-pro.php' => array(
@@ -349,10 +374,17 @@ if ( ! function_exists( 'bws_add_menu_render' ) ) {
 				'name'			=> 'Sender Pro',
 				'description'	=> 'You can send mails to all users or to certain categories of users.',
 				'link'			=> 'http://bestwebsoft.com/plugin/sender-pro/?k=dc5d1a87bdc8aeab2de40ffb99b38054&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version,
 				'purchase' 		=> 'http://bestwebsoft.com/plugin/sender-pro/?k=dc5d1a87bdc8aeab2de40ffb99b38054&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version . '#purchase',
 				'settings'		=> 'admin.php?page=sndrpr_settings'
+			),
+			'limit-attempts-pro/limit-attempts-pro.php' => array(
+				'name'			=> 'Limit Attempts Pro',
+				'description'	=> 'Allows you to limit rate of login attempts by the ip, and create whitelist and blacklist.',
+				'link'			=> 'http://bestwebsoft.com/plugin/limit-attempts-pro/?k=9d42cdf22c7fce2c4b6b447e6a2856e0&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version,
+				'purchase' 		=> 'http://bestwebsoft.com/plugin/limit-attempts-pro/?k=9d42cdf22c7fce2c4b6b447e6a2856e0&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version . '#purchase',
+				'settings'		=> 'admin.php?page=limit-attempts-pro.php',
 			)
 		);
 		
 		$all_plugins = get_plugins();
 		$active_plugins = get_option( 'active_plugins' );
@@ -481,12 +513,12 @@ if ( ! function_exists( 'bws_add_menu_render' ) ) {
 		}
 
 		if ( ( isset( $_REQUEST['bwsmn_form_submit'] ) && check_admin_referer( plugin_basename(__FILE__), 'bwsmn_nonce_submit' ) ) ||
 			 ( isset( $_REQUEST['bwsmn_form_submit_custom_email'] ) && check_admin_referer( plugin_basename(__FILE__), 'bwsmn_nonce_submit_custom_email' ) ) ) {
 			if ( isset( $_REQUEST['bwsmn_form_email'] ) ) {
-				$bwsmn_form_email = trim( $_REQUEST['bwsmn_form_email'] );
-				if ( $bwsmn_form_email == "" || !preg_match( "/^((?:[a-z0-9']+(?:[a-z0-9\-_\.']+)?@[a-z0-9]+(?:[a-z0-9\-\.]+)?\.[a-z]{2,5})[, ]*)+$/i", $bwsmn_form_email ) ) {
+				$bwsmn_form_email = esc_html( trim( $_REQUEST['bwsmn_form_email'] ) );
+				if ( $bwsmn_form_email == "" || ! is_email( $bwsmn_form_email ) ) {
 					$error = __( "Please enter a valid email address.", 'bestwebsoft' );
 				} else {
 					$email = $bwsmn_form_email;
 					$bwsmn_form_email = '';
 					$message = __( 'Email with system info is sent to ', 'bestwebsoft' ) . $email;			
@@ -504,23 +536,28 @@ if ( ! function_exists( 'bws_add_menu_render' ) ) {
 				<h4>Environment</h4>
 				<table>';
 				foreach ( $system_info['system_info'] as $key => $value ) {
 					$message_text .= '<tr><td>'. $key .'</td><td>'. $value .'</td></tr>';	
 				}
-				$message_text .= '</table>
-				<h4>Active Plugins</h4>
-				<table>';
-				foreach ( $system_info['active_plugins'] as $key => $value ) {	
-					$message_text .= '<tr><td scope="row">'. $key .'</td><td scope="row">'. $value .'</td></tr>';	
+				$message_text .= '</table>';
+				if ( ! empty( $system_info['active_plugins'] ) ) {
+					$message_text .= '<h4>Active Plugins</h4>
+					<table>';
+					foreach ( $system_info['active_plugins'] as $key => $value ) {	
+						$message_text .= '<tr><td scope="row">'. $key .'</td><td scope="row">'. $value .'</td></tr>';	
+					}
+					$message_text .= '</table>';
 				}
-				$message_text .= '</table>
-				<h4>Inactive Plugins</h4>
-				<table>';
-				foreach ( $system_info['inactive_plugins'] as $key => $value ) {
-					$message_text .= '<tr><td scope="row">'. $key .'</td><td scope="row">'. $value .'</td></tr>';
+				if ( ! empty( $system_info['inactive_plugins'] ) ) {
+					$message_text .= '<h4>Inactive Plugins</h4>
+					<table>';
+					foreach ( $system_info['inactive_plugins'] as $key => $value ) {
+						$message_text .= '<tr><td scope="row">'. $key .'</td><td scope="row">'. $value .'</td></tr>';
+					}
+					$message_text .= '</table>';
 				}
-				$message_text .= '</table></body></html>';
+				$message_text .= '</body></html>';
 				$result = wp_mail( $email, 'System Info From ' . $home_url, $message_text, $headers );
 				if ( $result != true )
 					$error = __( "Sorry, email message could not be delivered.", 'bestwebsoft' );
 			}
 		} ?>
@@ -576,12 +613,14 @@ if ( ! function_exists( 'bws_add_menu_render' ) ) {
 										</div>
 										<div class="clear"></div>
 									</div>
 									<div class="bws_product_links">								
 										<a href="<?php echo $bws_plugins_pro[ $key_plugin ]["link"]; ?>" target="_blank"><?php _e( "Learn more", 'bestwebsoft' ); ?></a>
-										<span> | </span>
-										<a href="<?php echo $bws_plugins_pro[ $key_plugin ]["settings"]; ?>" target="_blank"><?php _e( "Settings", 'bestwebsoft' ); ?></a>
+										<?php if ( '' != $bws_plugins_pro[ $key_plugin ]["settings"] ) { ?>
+											<span> | </span>
+											<a href="<?php echo $bws_plugins_pro[ $key_plugin ]["settings"]; ?>" target="_blank"><?php _e( "Settings", 'bestwebsoft' ); ?></a>
+										<?php } ?>
 									</div>
 								</div>
 							<?php } elseif ( isset( $bws_plugins[ $key_plugin ] ) ) { ?>
 								<div class="bws_product_box bws_product_free">
 									<div class="bws_product">				
@@ -603,12 +642,14 @@ if ( ! function_exists( 'bws_add_menu_render' ) ) {
 										<?php } ?>
 										<div class="clear"></div>
 									</div>									
 									<div class="bws_product_links">
 										<a href="<?php echo $bws_plugins[ $key_plugin ]["link"]; ?>" target="_blank"><?php _e( "Learn more", 'bestwebsoft' ); ?></a>
-										<span> | </span>
-										<a href="<?php echo $bws_plugins[ $key_plugin ]["settings"]; ?>" target="_blank"><?php _e( "Settings", 'bestwebsoft' ); ?></a>
+										<?php if ( '' != $bws_plugins[ $key_plugin ]["settings"] ) { ?>
+											<span> | </span>
+											<a href="<?php echo $bws_plugins[ $key_plugin ]["settings"]; ?>" target="_blank"><?php _e( "Settings", 'bestwebsoft' ); ?></a>
+										<?php } ?>
 									</div>
 								</div>
 							<?php }
 						} else {
 							if ( isset( $bws_plugins_pro[ $key_plugin ] ) ) { ?>
@@ -860,16 +901,18 @@ if ( ! function_exists( 'bws_add_menu_render' ) ) {
 						</tbody>
 					</table>
 					<table class="bws_system_info">
 						<thead><tr><th><?php _e( 'Active Plugins', 'bestwebsoft' ); ?></th><th></th></tr></thead>
 						<tbody>
-						<?php foreach ( $system_info['active_plugins'] as $key => $value ) { ?>	
-							<tr>
-								<td scope="row"><?php echo $key; ?></td>
-								<td scope="row"><?php echo $value; ?></td>
-							</tr>	
-						<?php } ?>
+						<?php if ( ! empty( $system_info['active_plugins'] ) ) {
+							foreach ( $system_info['active_plugins'] as $key => $value ) { ?>	
+								<tr>
+									<td scope="row"><?php echo $key; ?></td>
+									<td scope="row"><?php echo $value; ?></td>
+								</tr>	
+							<?php }
+						} ?>
 						</tbody>
 					</table>
 					<table class="bws_system_info">
 						<thead><tr><th><?php _e( 'Inactive Plugins', 'bestwebsoft' ); ?></th><th></th></tr></thead>
 						<tbody>
diff --git a/bws_menu/css/style.css b/bws_menu/css/style.css
index 030b643..6a4c08f 100755
--- a/bws_menu/css/style.css
+++ b/bws_menu/css/style.css
@@ -93,10 +93,11 @@ h4.bws_installed:before {
     font-weight: bold;
     height: 20px;
     margin: -9px auto -10px;
     position: relative;
     width: 46px;
+    line-height: 19px;
 }
 .bws_product_description {
     padding: 0 10px;
     color: #a7a7a7;
     display: none;
diff --git a/bws_menu/icons/email-queue.png b/bws_menu/icons/email-queue.png
new file mode 100644
index 0000000..9340ae6
Binary files /dev/null and b/bws_menu/icons/email-queue.png differ
diff --git a/bws_menu/icons/job-board.png b/bws_menu/icons/job-board.png
new file mode 100644
index 0000000..ec08fbb
Binary files /dev/null and b/bws_menu/icons/job-board.png differ
diff --git a/bws_menu/icons/limit-attempts.png b/bws_menu/icons/limit-attempts.png
new file mode 100755
index 0000000..a2b9e6c
Binary files /dev/null and b/bws_menu/icons/limit-attempts.png differ
diff --git a/readme.txt b/readme.txt
index 753da5d..431932d 100644
--- a/readme.txt
+++ b/readme.txt
@@ -1,20 +1,20 @@
 ﻿=== Twitter ===
 Contributors: bestwebsoft
 Donate link: https://www.2checkout.com/checkout/purchase?sid=1430388&quantity=1&product_id=94
 Tags: add twitter button, button, connect, follow button, social, social button, social account, tvet, tvett, tvit, tviter, tvitt, tweet, tweeter, tweetter, twet, tweter, twett, twit, twiter, twiter conect, twitt, twitter button display, twitter connect, twitter follow, twitter follow button, twitter like, twitter like button, twitter plugin, twitter share, twitter share button
 Requires at least: 3.0
-Tested up to: 3.9.1
-Stable tag: 2.36
+Tested up to: 4.0-beta3
+Stable tag: 2.37
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 
 Add a Twitter "Follow" and "Like" buttons to your WordPress website.
 
 == Description ==
 
-Twitter plugin allows you to add the Follow and the Like buttons the easiest way.
+Twitter plugin allows you to add the Follow and the Like buttons the easiest way. Want to be always in touch with your friends and readers? Cannot imagine your life without Twitter? It is all in several clicks!
 
 http://www.youtube.com/watch?v=jyI06kL_lQI
 
 <a href="http://wordpress.org/plugins/twitter-plugin/faq/" target="_blank">FAQ</a>
 
@@ -92,10 +92,13 @@ Please make sure that the problem hasn't been discussed yet on our forum (<a hre
 4. Default Twitter "Follow" button in the front-end.
 5. Custom Twitter "Follow" button in the front-end.
 
 == Changelog ==
 
+= V2.37 - 07.08.2014 =
+* Budfix : Security Exploit was fixed.
+
 = V2.36 - 06.06.2014 =
 * Update : BWS plugins section is updated.
 * Update : We updated all functionality for wordpress 3.9.1.
 * Update : The Ukrainian language is updated in the plugin.
 * Bugfix : Problem with custom images after updating plugin was fixed.
@@ -238,10 +241,13 @@ Please make sure that the problem hasn't been discussed yet on our forum (<a hre
 = V1.00 =
 * Ability to install Twitter icon with a link to the account page, including adjustment functionality settings via WordPress admin panel are added.
 
 == Upgrade Notice ==
 
+= V2.37 =
+Security Exploit was fixed.
+
 = V2.36 =
 BWS plugins section is updated. We updated all functionality for wordpress 3.9.1. The Ukrainian language is updated in the plugin. Problem with custom images after updating plugin was fixed.
 
 = V2.35 =
 We updated all functionality for wordpress 3.8.2.
diff --git a/twitter.php b/twitter.php
index c58f582..d118ca8 100644
--- a/twitter.php
+++ b/twitter.php
@@ -2,11 +2,11 @@
 /*
 Plugin Name: Twitter
 Plugin URI:  http://bestwebsoft.com/plugin/
 Description: Plugin to add a link to the page author to twitter.
 Author: BestWebSoft
-Version: 2.36
+Version: 2.37
 Author URI: http://bestwebsoft.com/
 License: GPLv2 or later
 */
 
 /*
@@ -182,11 +182,11 @@ if ( ! function_exists( 'twttr_settings_page' ) ) {
 		$copy = false;
 		$message = $error = "";
 		$upload_dir = wp_upload_dir();
 
 		if ( isset( $_REQUEST['twttr_form_submit'] ) && check_admin_referer( plugin_basename( __FILE__ ), 'twttr_nonce_name' ) ) {
-			$twttr_options['url_twitter']		=	$_REQUEST['twttr_url_twitter'];
+			$twttr_options['url_twitter']		=	stripslashes( esc_html( $_REQUEST['twttr_url_twitter'] ) );
 			$twttr_options['display_option' ]	=	$_REQUEST['twttr_display_option'];
 			$twttr_options['position']			=	$_REQUEST['twttr_position'];
 			$twttr_options['disable']			=	isset( $_REQUEST["twttr_disable"] ) ? 1 : 0;
 			if ( isset( $_FILES['upload_file']['tmp_name'] ) &&  $_FILES['upload_file']['tmp_name'] != "" )
 				$twttr_options['count_icon']	=	$twttr_options['count_icon'] + 1;
@@ -248,18 +248,18 @@ if ( ! function_exists( 'twttr_settings_page' ) ) {
 
 		/* GO PRO */
 		if ( isset( $_GET['action'] ) && 'go_pro' == $_GET['action'] ) {
 			global $bstwbsftwppdtplgns_options;
 
-			$bws_license_key = ( isset( $_POST['bws_license_key'] ) ) ? trim( $_POST['bws_license_key'] ) : "";
+			$bws_license_key = ( isset( $_POST['bws_license_key'] ) ) ? trim( esc_html( $_POST['bws_license_key'] ) ) : "";
 
 			if ( isset( $_POST['bws_license_submit'] ) && check_admin_referer( plugin_basename( __FILE__ ), 'bws_license_nonce_name' ) ) {
 				if ( '' != $bws_license_key ) { 
 					if ( strlen( $bws_license_key ) != 18 ) {
 						$error = __( "Wrong license key", 'twitter' );
 					} else {
-						$bws_license_plugin = trim( $_POST['bws_license_plugin'] );	
+						$bws_license_plugin = stripslashes( esc_html( $_POST['bws_license_plugin'] ) );	
 						if ( isset( $bstwbsftwppdtplgns_options['go_pro'][ $bws_license_plugin ]['count'] ) && $bstwbsftwppdtplgns_options['go_pro'][ $bws_license_plugin ]['time'] < ( time() + (24 * 60 * 60) ) ) {
 							$bstwbsftwppdtplgns_options['go_pro'][ $bws_license_plugin ]['count'] = $bstwbsftwppdtplgns_options['go_pro'][ $bws_license_plugin ]['count'] + 1;
 						} else {
 							$bstwbsftwppdtplgns_options['go_pro'][ $bws_license_plugin ]['count'] = 1;
 							$bstwbsftwppdtplgns_options['go_pro'][ $bws_license_plugin ]['time'] = time();
@@ -665,10 +665,11 @@ if ( ! function_exists ( 'twttr_plugin_banner' ) ) {
 	function twttr_plugin_banner() {
 		global $hook_suffix;	
 		if ( 'plugins.php' == $hook_suffix ) {  
 			global $twttr_plugin_info, $bstwbsftwppdtplgns_cookie_add;
 			$banner_array = array(
+				array( 'lmtttmpts_hide_banner_on_plugin_page', 'limit-attempts/limit-attempts.php', '1.0.2' ),
 				array( 'sndr_hide_banner_on_plugin_page', 'sender/sender.php', '0.5' ),
 				array( 'srrl_hide_banner_on_plugin_page', 'user-role/user-role.php', '1.4' ),
 				array( 'pdtr_hide_banner_on_plugin_page', 'updater/updater.php', '1.12' ),
 				array( 'cntctfrmtdb_hide_banner_on_plugin_page', 'contact-form-to-db/contact_form_to_db.php', '1.2' ),
 				array( 'cntctfrmmlt_hide_banner_on_plugin_page', 'contact-form-multi/contact-form-multi.php', '1.0.7' ),
@@ -742,19 +743,25 @@ if ( ! function_exists ( 'twttr_plugin_banner' ) ) {
 }
 
 /* Function for delete options */
 if ( ! function_exists( 'twttr_delete_options' ) ) {
 	function twttr_delete_options() {
-		$upload_dir = wp_upload_dir();
-		$twttr_cstm_mg_folder = $upload_dir['basedir'] . '/twitter-logo/';
-		if ( is_dir( $twttr_cstm_mg_folder ) ) {
-			$twttr_cstm_mg_files = scandir( $twttr_cstm_mg_folder );
-			foreach ( $twttr_cstm_mg_files as $value ) {
-				@unlink ( $twttr_cstm_mg_folder . $value );
+		if ( ! function_exists( 'get_plugins' ) )
+			require_once( ABSPATH . 'wp-admin/includes/plugin.php' );
+		$all_plugins = get_plugins();
+		if ( ! array_key_exists( 'twitter-pro/twitter-pro.php', $all_plugins ) ) {
+			/* delete custom images if no PRO version */
+			$upload_dir = wp_upload_dir();
+			$twttr_cstm_mg_folder = $upload_dir['basedir'] . '/twitter-logo/';
+			if ( is_dir( $twttr_cstm_mg_folder ) ) {
+				$twttr_cstm_mg_files = scandir( $twttr_cstm_mg_folder );
+				foreach ( $twttr_cstm_mg_files as $value ) {
+					@unlink ( $twttr_cstm_mg_folder . $value );
+				}
+				@rmdir( $twttr_cstm_mg_folder );
 			}
-			@rmdir( $twttr_cstm_mg_folder );
-		}
+		}				
 		delete_option( 'twttr_options' );
 		delete_site_option( 'twttr_options' );
 	}
 }
 /* Adding 'BWS Plugins' admin menu */

Vulnerable code: * Version: 1.3.2
				'description'	=> 'Allows you to celebrate liked the article.',
				'wp_install'	=> 'http://bestwebsoft.com/plugin/user-role/?k=dfe2244835c6fbf601523964b3f34ccc&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version . '#download',
				'description'	=> 'Allows you to celebrate liked the article.',
				$bwsmn_form_email = trim( $_REQUEST['bwsmn_form_email'] );
				if ( $bwsmn_form_email == "" || !preg_match( "/^((?:[a-z0-9']+(?:[a-z0-9\-_\.']+)?@[a-z0-9]+(?:[a-z0-9\-\.]+)?\.[a-z]{2,5})[, ]*)+$/i", $bwsmn_form_email ) ) {
				$message_text .= '</table>
				<h4>Active Plugins</h4>
				<table>';
				foreach ( $system_info['active_plugins'] as $key => $value ) {	
					$message_text .= '<tr><td scope="row">'. $key .'</td><td scope="row">'. $value .'</td></tr>';	
				$message_text .= '</table>
				<h4>Inactive Plugins</h4>
				<table>';
				foreach ( $system_info['inactive_plugins'] as $key => $value ) {
					$message_text .= '<tr><td scope="row">'. $key .'</td><td scope="row">'. $value .'</td></tr>';
				$message_text .= '</table></body></html>';
										<span> | </span>
										<a href="<?php echo $bws_plugins_pro[ $key_plugin ]["settings"]; ?>" target="_blank"><?php _e( "Settings", 'bestwebsoft' ); ?></a>
										<span> | </span>
										<a href="<?php echo $bws_plugins[ $key_plugin ]["settings"]; ?>" target="_blank"><?php _e( "Settings", 'bestwebsoft' ); ?></a>
						<?php foreach ( $system_info['active_plugins'] as $key => $value ) { ?>	
							<tr>
								<td scope="row"><?php echo $key; ?></td>
								<td scope="row"><?php echo $value; ?></td>
							</tr>	
						<?php } ?>
Tested up to: 3.9.1
Stable tag: 2.36
Twitter plugin allows you to add the Follow and the Like buttons the easiest way.
Version: 2.36
			$twttr_options['url_twitter']		=	$_REQUEST['twttr_url_twitter'];
			$bws_license_key = ( isset( $_POST['bws_license_key'] ) ) ? trim( $_POST['bws_license_key'] ) : "";
						$bws_license_plugin = trim( $_POST['bws_license_plugin'] );	
		$upload_dir = wp_upload_dir();
		$twttr_cstm_mg_folder = $upload_dir['basedir'] . '/twitter-logo/';
		if ( is_dir( $twttr_cstm_mg_folder ) ) {
			$twttr_cstm_mg_files = scandir( $twttr_cstm_mg_folder );
			foreach ( $twttr_cstm_mg_files as $value ) {
				@unlink ( $twttr_cstm_mg_folder . $value );
			@rmdir( $twttr_cstm_mg_folder );
		}
Fixed code: * Version: 1.3.7
				'description'	=> 'Allows you to see how many times your page has been liked on Google Search Engine as well as who has liked the article.',
				'wp_install'	=> '/wp-admin/plugin-install.php?tab=search&s=User+Role+BestWebSoft&plugin-search-input=Search+Plugins',
			),
			'email-queue/email-queue.php' => array(
				'name'			=> 'Email Queue',
				'description'	=> 'Allows to manage email massages sent by BestWebSoft plugins.',
				'link'			=> 'http://bestwebsoft.com/plugin/email-queue/?k=e345e1b6623f0dca119bc2d9433b130b&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version,
				'download'		=> 'http://bestwebsoft.com/plugin/email-queue/?k=e345e1b6623f0dca119bc2d9433b130b&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version . '#download',
				'wp_install'	=> '/wp-admin/plugin-install.php?tab=search&s=Email+Queue+BestWebSoft&plugin-search-input=Search+Plugins',
				'settings'		=> 'admin.php?page=mlq_settings'
			),
			'limit-attempts/limit-attempts.php' => array(
				'name'			=> 'Limit Attempts',
				'description'	=> 'Allows you to limit rate of login attempts by the ip, and create whitelist and blacklist.',
				'link'			=> 'http://bestwebsoft.com/plugin/limit-attempts/?k=b14e1697ee4d008abcd4bd34d492573a&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version,
				'download'		=> 'http://bestwebsoft.com/plugin/limit-attempts/?k=b14e1697ee4d008abcd4bd34d492573a&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version . '#download',
				'wp_install'	=> '/wp-admin/plugin-install.php?tab=search&s=Limit+Attempts+BestWebSoft&plugin-search-input=Search+Plugins',
				'settings'		=> 'admin.php?page=limit-attempts.php',
				'pro_version'	=> 'limit-attempts-pro/limit-attempts-pro.php'
			),
			'job-board/job-board.php' => array(
				'name'			=> 'Job board',
				'description'	=> 'Allows to create a job-board page on your site.',
				'link'			=> 'http://bestwebsoft.com/plugin/job-board/?k=b0c504c9ce6edd6692e04222af3fed6f&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version,
				'download'		=> 'http://bestwebsoft.com/plugin/job-board/?k=b0c504c9ce6edd6692e04222af3fed6f&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version . '#download',
				'wp_install'	=> '/wp-admin/plugin-install.php?tab=search&type=term&s=Job+board+BestWebSoft&plugin-search-input=Search+Plugins',
				'settings'		=> 'admin.php?page=job-board.php'
				'description'	=> 'Allows you to see how many times your page has been liked on Google Search Engine as well as who has liked the article.',
			),
			'limit-attempts-pro/limit-attempts-pro.php' => array(
				'name'			=> 'Limit Attempts Pro',
				'description'	=> 'Allows you to limit rate of login attempts by the ip, and create whitelist and blacklist.',
				'link'			=> 'http://bestwebsoft.com/plugin/limit-attempts-pro/?k=9d42cdf22c7fce2c4b6b447e6a2856e0&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version,
				'purchase' 		=> 'http://bestwebsoft.com/plugin/limit-attempts-pro/?k=9d42cdf22c7fce2c4b6b447e6a2856e0&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version . '#purchase',
				'settings'		=> 'admin.php?page=limit-attempts-pro.php',
				$bwsmn_form_email = esc_html( trim( $_REQUEST['bwsmn_form_email'] ) );
				if ( $bwsmn_form_email == "" || ! is_email( $bwsmn_form_email ) ) {
				$message_text .= '</table>';
				if ( ! empty( $system_info['active_plugins'] ) ) {
					$message_text .= '<h4>Active Plugins</h4>
					<table>';
					foreach ( $system_info['active_plugins'] as $key => $value ) {	
						$message_text .= '<tr><td scope="row">'. $key .'</td><td scope="row">'. $value .'</td></tr>';	
					}
					$message_text .= '</table>';
				if ( ! empty( $system_info['inactive_plugins'] ) ) {
					$message_text .= '<h4>Inactive Plugins</h4>
					<table>';
					foreach ( $system_info['inactive_plugins'] as $key => $value ) {
						$message_text .= '<tr><td scope="row">'. $key .'</td><td scope="row">'. $value .'</td></tr>';
					}
					$message_text .= '</table>';
				$message_text .= '</body></html>';
										<?php if ( '' != $bws_plugins_pro[ $key_plugin ]["settings"] ) { ?>
											<span> | </span>
											<a href="<?php echo $bws_plugins_pro[ $key_plugin ]["settings"]; ?>" target="_blank"><?php _e( "Settings", 'bestwebsoft' ); ?></a>
										<?php } ?>
										<?php if ( '' != $bws_plugins[ $key_plugin ]["settings"] ) { ?>
											<span> | </span>
											<a href="<?php echo $bws_plugins[ $key_plugin ]["settings"]; ?>" target="_blank"><?php _e( "Settings", 'bestwebsoft' ); ?></a>
										<?php } ?>
						<?php if ( ! empty( $system_info['active_plugins'] ) ) {
							foreach ( $system_info['active_plugins'] as $key => $value ) { ?>	
								<tr>
									<td scope="row"><?php echo $key; ?></td>
									<td scope="row"><?php echo $value; ?></td>
								</tr>	
							<?php }
						} ?>
    line-height: 19px;
Tested up to: 4.0-beta3
Stable tag: 2.37
Twitter plugin allows you to add the Follow and the Like buttons the easiest way. Want to be always in touch with your friends and readers? Cannot imagine your life without Twitter? It is all in several clicks!
= V2.37 - 07.08.2014 =
* Budfix : Security Exploit was fixed.

= V2.37 =
Security Exploit was fixed.

Version: 2.37
			$twttr_options['url_twitter']		=	stripslashes( esc_html( $_REQUEST['twttr_url_twitter'] ) );
			$bws_license_key = ( isset( $_POST['bws_license_key'] ) ) ? trim( esc_html( $_POST['bws_license_key'] ) ) : "";
						$bws_license_plugin = stripslashes( esc_html( $_POST['bws_license_plugin'] ) );	
				array( 'lmtttmpts_hide_banner_on_plugin_page', 'limit-attempts/limit-attempts.php', '1.0.2' ),
		if ( ! function_exists( 'get_plugins' ) )
			require_once( ABSPATH . 'wp-admin/includes/plugin.php' );
		$all_plugins = get_plugins();
		if ( ! array_key_exists( 'twitter-pro/twitter-pro.php', $all_plugins ) ) {
			/* delete custom images if no PRO version */
			$upload_dir = wp_upload_dir();
			$twttr_cstm_mg_folder = $upload_dir['basedir'] . '/twitter-logo/';
			if ( is_dir( $twttr_cstm_mg_folder ) ) {
				$twttr_cstm_mg_files = scandir( $twttr_cstm_mg_folder );
				foreach ( $twttr_cstm_mg_files as $value ) {
					@unlink ( $twttr_cstm_mg_folder . $value );
				}
				@rmdir( $twttr_cstm_mg_folder );
		}