CVE-2022-4631: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, was found in WP-Ban. Affected is an unknown function of the file ban-options.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 22b925449c84faa9b7496abe4f8f5661cb5eb3bf. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216480.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-21T19:15Z
Repository: https://github.com/lesterchan/wp-ban
Language: PHP
Files changed: README.md, ban-options.php, wp-ban.php
Commit date: 2022-12-04 19:24:07 +0800
Commit message: Fixed XSS

Diff: diff --git a/.travis.yml b/.travis.yml
deleted file mode 100644
index 11d4f52..0000000
--- a/.travis.yml
+++ /dev/null
@@ -1,13 +0,0 @@
-language: php
-php:
-  - "7.3"
-  - "7.2"
-  - "7.1"
-  - "7.0"
-  - "5.6"
-
-script:
-  - find . \( -name '*.php' \) -exec php -lf {} \;
-
-notifications:
-  email: false
diff --git a/README.md b/README.md
index 4cf7d4e..0c7ae1b 100644
--- a/README.md
+++ b/README.md
@@ -1,21 +1,18 @@
 # WP-Ban
 Contributors: GamerZ  
 Donate link: https://lesterchan.net/site/donation/  
 Tags: banned, ban, deny, denied, permission, ip, hostname, host, spam, bots, bot, exclude, referrer, url, referral, range  
 Requires at least: 4.3   
-Tested up to: 5.9  
-Stable tag: 1.69  
+Tested up to: 6.1  
+Stable tag: 1.69.1  
 
 Ban users by IP, IP Range, host name, user agent and referrer url from visiting your WordPress's blog.
 
 ## Description
 It will display a custom ban message when the banned IP, IP range, host name or referrer url that tries to visit you blog. You can also exclude certain IPs from being banned. There will be statistics recorded on how many times they attempt to visit your blog. It allows wildcard matching too.
 
-### Build Status
-[![Build Status](https://travis-ci.org/lesterchan/wp-ban.svg?branch=master)](https://travis-ci.org/lesterchan/wp-ban)
-
 ### Development
 * [https://github.com/lesterchan/wp-ban](https://github.com/lesterchan/wp-ban "https://github.com/lesterchan/wp-ban")
 
 ### Translations
 * [http://dev.wp-plugins.org/browser/wp-ban/i18n/](http://dev.wp-plugins.org/browser/wp-ban/i18n/ "http://dev.wp-plugins.org/browser/wp-ban/i18n/")
@@ -25,10 +22,13 @@ It will display a custom ban message when the banned IP, IP range, host name or
 
 ### Donations
 * I spent most of my free time creating, updating, maintaining and supporting these plugins, if you really love my plugins and could spare me a couple of bucks, I will really appreciate it. If not feel free to use it without any obligations.
 
 ## Changelog
+### Version 1.69.1
+* NEW: Fixed XSS
+
 ### Version 1.69
 * NEW: Bump WordPress 4.7
 * FIXED: Notices
 
 ### Version 1.68
diff --git a/ban-options.php b/ban-options.php
index 4e19eb9..4a967fc 100644
--- a/ban-options.php
+++ b/ban-options.php
@@ -7,10 +7,19 @@ if(!current_user_can('manage_options')) {
 ### Variables
 $base_name = plugin_basename('wp-ban/ban-options.php');
 $base_page = 'admin.php?page='.$base_name;
 $admin_login = trim($current_user->user_login);
 
+# Allow HTML
+$allowed_tags = wp_kses_allowed_html( 'post' );
+$allowed_tags['html'] = true;
+$allowed_tags['head'] = true;
+$allowed_tags['meta'] = array(
+    'charset' => true,
+);
+$allowed_tags['body'] = true;
+
 ### Form Processing
 // Update Options
 if( ! empty( $_POST['Submit'] ) ) {
     check_admin_referer('wp-ban_templates');
     $text = '';
@@ -22,105 +31,105 @@ if( ! empty( $_POST['Submit'] ) ) {
     $banned_ips_range_post      = ! empty( $_POST['banned_ips_range'] )         ? explode( "\n", trim( $_POST['banned_ips_range'] ) ) : array();
     $banned_hosts_post          = ! empty( $_POST['banned_hosts'] )             ? explode( "\n", trim($_POST['banned_hosts'] ) ) : array();
     $banned_referers_post       = ! empty( $_POST['banned_referers'] )          ? explode( "\n", trim($_POST['banned_referers'] ) ) : array();
     $banned_user_agents_post    = ! empty( $_POST['banned_user_agents'] )       ? explode( "\n", trim($_POST['banned_user_agents'] ) ) : array();
     $banned_exclude_ips_post    = ! empty( $_POST['banned_exclude_ips'] )       ? explode( "\n", trim( $_POST['banned_exclude_ips'] ) ) : array();
-    $banned_message             = ! empty( $_POST['banned_template_message'] )  ? trim( $_POST['banned_template_message'] ) : '';
+    $banned_message             = ! empty( $_POST['banned_template_message'] )  ? wp_kses( trim( $_POST['banned_template_message'] ), $allowed_tags ) : '';
 
     $banned_ips = array();
-    if(!empty($banned_ips_post)) {
-        foreach($banned_ips_post as $banned_ip) {
-            if($admin_login == 'admin' && ($banned_ip == ban_get_ip() || is_admin_ip($banned_ip))) {
-                $text .= '<p style="color: blue;">'.sprintf(__('This IP \'%s\' Belongs To The Admin And Will Not Be Added To Ban List', 'wp-ban'),$banned_ip).'</p>';
+    if ( ! empty( $banned_ips_post ) ) {
+        foreach ( $banned_ips_post as $banned_ip ) {
+            if( $admin_login === 'admin' && ( $banned_ip === ban_get_ip() || is_admin_ip( $banned_ip ) ) ) {
+                $text .= '<p style="color: blue;">' . sprintf( __( 'This IP \'%s\' Belongs To The Admin And Will Not Be Added To Ban List', 'wp-ban' ), $banned_ip ) . '</p>';
             } else {
-                $banned_ips[] = trim($banned_ip);
+                $banned_ips[] = esc_html( trim( $banned_ip ) );
             }
         }
     }
 
     $banned_ips_range = array();
-    if( ! empty( $banned_ips_range_post ) ) {
+    if ( ! empty( $banned_ips_range_post ) ) {
         foreach( $banned_ips_range_post as $banned_ip_range ) {
             $range = explode( '-', $banned_ip_range );
-            if( sizeof( $range ) === 2 ) {
+            if ( sizeof( $range ) === 2 ) {
                 $range_start = trim( $range[0] );
                 $range_end = trim( $range[1] );
-                if( $admin_login === 'admin' && ( check_ip_within_range( ban_get_ip(), $range_start, $range_end ) ) ) {
-                    $text .= '<p style="color: blue;">'.sprintf( __( 'The Admin\'s IP \'%s\' Fall Within This Range (%s - %s) And Will Not Be Added To Ban List', 'wp-ban' ), ban_get_ip(), $range_start, $range_end ).'</p>';
+                if ( $admin_login === 'admin' && ( check_ip_within_range( ban_get_ip(), $range_start, $range_end ) ) ) {
+                    $text .= '<p style="color: blue;">' . sprintf( __( 'The Admin\'s IP \'%s\' Fall Within This Range (%s - %s) And Will Not Be Added To Ban List', 'wp-ban' ), ban_get_ip(), $range_start, $range_end ) . '</p>';
                 } else {
-                    $banned_ips_range[] = trim( $banned_ip_range );
+                    $banned_ips_range[] = esc_html( trim( $banned_ip_range ) );
                 }
             }
         }
     }
 
     $banned_hosts = array();
-    if(!empty($banned_hosts_post)) {
-        foreach($banned_hosts_post as $banned_host) {
-            if($admin_login == 'admin' && ($banned_host == @gethostbyaddr(ban_get_ip()) || is_admin_hostname($banned_host))) {
-                $text .= '<p style="color: blue;">'.sprintf(__('This Hostname \'%s\' Belongs To The Admin And Will Not Be Added To Ban List', 'wp-ban'), $banned_host).'</p>';
+    if ( ! empty( $banned_hosts_post ) ) {
+        foreach ( $banned_hosts_post as $banned_host ) {
+            if ( $admin_login === 'admin' && ( $banned_host === @gethostbyaddr( ban_get_ip() ) || is_admin_hostname( $banned_host ) ) ) {
+                $text .= '<p style="color: blue;">' . sprintf( __( 'This Hostname \'%s\' Belongs To The Admin And Will Not Be Added To Ban List', 'wp-ban' ), $banned_host ) . '</p>';
             } else {
-                $banned_hosts[] = trim($banned_host);
+                $banned_hosts[] = esc_html( trim( $banned_host ) );
             }
         }
     }
 
     $banned_referers = array();
-    if(!empty($banned_referers_post)) {
-        foreach($banned_referers_post as $banned_referer) {
-            if(is_admin_referer($banned_referer)) {
-                $text .= '<p style="color: blue;">'.sprintf(__('This Referer \'%s\' Belongs To This Site And Will Not Be Added To Ban List', 'wp-ban'), $banned_referer).'</p>';
+    if ( ! empty( $banned_referers_post ) ) {
+        foreach ( $banned_referers_post as $banned_referer ) {
+            if ( is_admin_referer( $banned_referer ) ) {
+                $text .= '<p style="color: blue;">' . sprintf( __( 'This Referer \'%s\' Belongs To This Site And Will Not Be Added To Ban List', 'wp-ban' ), $banned_referer ) . '</p>';
             } else {
-                $banned_referers[] = trim($banned_referer);
+                $banned_referers[] = esc_html( trim( $banned_referer ) );
             }
         }
     }
 
     $banned_user_agents = array();
-    if(!empty($banned_user_agents_post)) {
-        foreach($banned_user_agents_post as $banned_user_agent) {
-            if(is_admin_user_agent($banned_user_agent)) {
-                $text .= '<p style="color: blue;">'.sprintf(__('This User Agent \'%s\' Is Used By The Current Admin And Will Not Be Added To Ban List', 'wp-ban'), $banned_user_agent).'</p>';
+    if ( ! empty( $banned_user_agents_post ) ) {
+        foreach ( $banned_user_agents_post as $banned_user_agent ) {
+            if ( is_admin_user_agent( $banned_user_agent ) ) {
+                $text .= '<p style="color: blue;">' . sprintf( __( 'This User Agent \'%s\' Is Used By The Current Admin And Will Not Be Added To Ban List', 'wp-ban' ), $banned_user_agent ) . '</p>';
             } else {
-                $banned_user_agents[] = trim($banned_user_agent);
+                $banned_user_agents[] = esc_html( trim( $banned_user_agent ) );
             }
         }
     }
 
     $banned_exclude_ips = array();
-    if(!empty($banned_exclude_ips_post)) {
-        foreach($banned_exclude_ips_post as $banned_exclude_ip) {
-            $banned_exclude_ips[] = trim($banned_exclude_ip);
+    if ( ! empty( $banned_exclude_ips_post ) ) {
+        foreach ( $banned_exclude_ips_post as $banned_exclude_ip ) {
+            $banned_exclude_ips[] = esc_html( trim( $banned_exclude_ip ) );
         }
     }
     $update_ban_queries = array();
     $update_ban_queries[] = update_option( 'banned_options', $banned_options );
-    $update_ban_queries[] = update_option('banned_ips', $banned_ips);
-    $update_ban_queries[] = update_option('banned_ips_range', $banned_ips_range);
-    $update_ban_queries[] = update_option('banned_hosts', $banned_hosts);
-    $update_ban_queries[] = update_option('banned_referers', $banned_referers);
-    $update_ban_queries[] = update_option('banned_user_agents', $banned_user_agents);
-    $update_ban_queries[] = update_option('banned_exclude_ips', $banned_exclude_ips);
-    $update_ban_queries[] = update_option('banned_message', $banned_message);
+    $update_ban_queries[] = update_option( 'banned_ips', $banned_ips );
+    $update_ban_queries[] = update_option( 'banned_ips_range', $banned_ips_range );
+    $update_ban_queries[] = update_option( 'banned_hosts', $banned_hosts );
+    $update_ban_queries[] = update_option( 'banned_referers', $banned_referers );
+    $update_ban_queries[] = update_option( 'banned_user_agents', $banned_user_agents );
+    $update_ban_queries[] = update_option( 'banned_exclude_ips', $banned_exclude_ips );
+    $update_ban_queries[] = update_option( 'banned_message', $banned_message );
     $update_ban_text = array();
     $update_ban_text[] = __( 'Banned Options', 'wp-ban' );
-    $update_ban_text[] = __('Banned IPs', 'wp-ban');
-    $update_ban_text[] = __('Banned IP Range', 'wp-ban');
-    $update_ban_text[] = __('Banned Host Names', 'wp-ban');
-    $update_ban_text[] = __('Banned Referers', 'wp-ban');
-    $update_ban_text[] = __('Banned User Agents', 'wp-ban');
-    $update_ban_text[] = __('Banned Excluded IPs', 'wp-ban');
-    $update_ban_text[] = __('Banned Message', 'wp-ban');
-    $i=0;
-    foreach($update_ban_queries as $update_ban_query) {
-        if($update_ban_query) {
-            $text .= '<p style="color: green;">'.$update_ban_text[$i].' '.__('Updated', 'wp-ban').'</p>';
+    $update_ban_text[] = __( 'Banned IPs', 'wp-ban');
+    $update_ban_text[] = __( 'Banned IP Range', 'wp-ban');
+    $update_ban_text[] = __( 'Banned Host Names', 'wp-ban');
+    $update_ban_text[] = __( 'Banned Referers', 'wp-ban');
+    $update_ban_text[] = __( 'Banned User Agents', 'wp-ban');
+    $update_ban_text[] = __( 'Banned Excluded IPs', 'wp-ban');
+    $update_ban_text[] = __( 'Banned Message', 'wp-ban');
+    $i = 0;
+    foreach ( $update_ban_queries as $update_ban_query ) {
+        if ( $update_ban_query ) {
+            $text .= '<p style="color: green;">' . $update_ban_text[$i] . ' ' . __( 'Updated', 'wp-ban' ) . '</p>';
         }
         $i++;
     }
-    if(empty($text)) {
-        $text = '<p style="color: red;">'.__('No Ban Option Updated', 'wp-ban').'</p>';
+    if ( empty( $text ) ) {
+        $text = '<p style="color: red;">' . __( 'No Ban Option Updated', 'wp-ban' ) . '</p>';
     }
 }
 if( ! empty( $_POST['do'] ) ) {
     // Decide What To Do
     switch( $_POST['do'] ) {
@@ -200,11 +209,11 @@ $banned_options = get_option( 'banned_options' );
     var checked = 0;
     function banned_default_templates(template) {
         var default_template;
         switch(template) {
             case "message":
-                default_template = "<!DOCTYPE html>\n<html>\n<head>\n<meta charset=\"utf-8\">\n<title>%SITE_NAME% - %SITE_URL%</title>\n</head>\n<body>\n<div id=\"wp-ban-container\">\n<p style=\"text-align: center; font-weight: bold;\"><?php _e('You Are Banned.', 'wp-ban'); ?></p>\n</div>\n</body>\n</html>";
+                default_template = "<html>\n<head>\n<meta charset=\"utf-8\">\n<title>%SITE_NAME% - %SITE_URL%</title>\n</head>\n<body>\n<div id=\"wp-ban-container\">\n<p style=\"text-align: center; font-weight: bold;\"><?php _e('You Are Banned.', 'wp-ban'); ?></p>\n</div>\n</body>\n</html>";
                 break;
         }
         jQuery("#banned_template_" + template).val(default_template);
     }
     function toggle_checkbox() {
@@ -274,11 +283,11 @@ $banned_options = get_option( 'banned_options' );
         <tr class="alternate">
             <td><?php _e('Site URL', 'wp-ban'); ?>:</td>
             <td><strong><?php echo get_option('home'); ?></strong></td>
         </tr>
         <tr>
-            <td valign="top" colspan="2" align="center">
+            <td valign="top" colspan="2" style="text-align: center;">
                 <?php _e('Please <strong>DO NOT</strong> ban yourself.', 'wp-ban'); ?>
             </td>
         </tr>
     </table>
     <p>&nbsp;</p>
diff --git a/wp-ban.php b/wp-ban.php
index ded43e6..703031f 100644
--- a/wp-ban.php
+++ b/wp-ban.php
@@ -1,19 +1,19 @@
 <?php
 /*
 Plugin Name: WP-Ban
 Plugin URI: https://lesterchan.net/portfolio/programming/php/
 Description: Ban users by IP, IP Range, host name, user agent and referer url from visiting your WordPress's blog. It will display a custom ban message when the banned IP, IP range, host name, user agent or referer url tries to visit you blog. You can also exclude certain IPs from being banned. There will be statistics recordered on how many times they attemp to visit your blog. It allows wildcard matching too.
-Version: 1.69
+Version: 1.69.1
 Author: Lester 'GaMerZ' Chan
 Author URI: https://lesterchan.net
 Text Domain: wp-ban
 */
 
 
 /*
-	Copyright 2016  Lester Chan  (email : lesterchan@gmail.com)
+	Copyright 2022  Lester Chan  (email : lesterchan@gmail.com)
 
 	This program is free software; you can redistribute it and/or modify
 	it under the terms of the GNU General Public License as published by
 	the Free Software Foundation; either version 2 of the License, or
 	(at your option) any later version.
@@ -89,16 +89,16 @@ function preview_banned_message() {
 
 ### Function: Print Out Banned Message
 function print_banned_message() {
 	$banned_ip = ban_get_ip();
 	$banned_stats = get_option( 'banned_stats' );
-	if( isset( $banned_stats['count'] ) ) {
+	if ( isset( $banned_stats['count'] ) ) {
 		$banned_stats['count'] += 1;
 	} else {
 		$banned_stats['count'] = 1;
 	}
-	if( isset( $banned_stats['users'][$banned_ip] ) ) {
+	if ( isset( $banned_stats['users'][$banned_ip] ) ) {
 		$banned_stats['users'][$banned_ip] += 1;
 	} else {
 		$banned_stats['users'][$banned_ip] = 1;
 	}
 	update_option( 'banned_stats', $banned_stats );
@@ -119,10 +119,11 @@ function print_banned_message() {
 			@gethostbyaddr( $banned_ip ),
 			number_format_i18n( $banned_stats['count'] )
 		),
 		stripslashes( get_option( 'banned_message' ) )
 	);
+	echo '<!DOCTYPE html>' . "\n";
 	echo $banned_message;
 	exit();
 }
 
 
@@ -154,64 +155,64 @@ function process_ban_ip_range($banned_ips_range) {
 	}
 }
 
 
 ### Function: Banned
-add_action('init', 'banned');
+add_action( 'init', 'banned' );
 function banned() {
 	$ip = ban_get_ip();
-	if($ip == 'unknown') {
+	if ( $ip === 'unknown' ) {
 		return;
 	}
-	$banned_ips = get_option('banned_ips');
-	if(is_array($banned_ips))
-		$banned_ips = array_filter($banned_ips);
+	$banned_ips = get_option( 'banned_ips' );
+	if ( is_array( $banned_ips ) )
+		$banned_ips = array_filter( $banned_ips );
 
-	$banned_ips_range = get_option('banned_ips_range');
-	if(is_array($banned_ips_range))
-		$banned_ips_range = array_filter($banned_ips_range);
+	$banned_ips_range = get_option( 'banned_ips_range' );
+	if ( is_array( $banned_ips_range ) )
+		$banned_ips_range = array_filter( $banned_ips_range );
 
-	$banned_hosts = get_option('banned_hosts');
-	if(is_array($banned_hosts))
-		$banned_hosts = array_filter($banned_hosts);
+	$banned_hosts = get_option( 'banned_hosts' );
+	if ( is_array( $banned_hosts ) )
+		$banned_hosts = array_filter( $banned_hosts );
 
-	$banned_referers = get_option('banned_referers');
-	if(is_array($banned_referers))
-		$banned_referers = array_filter($banned_referers);
+	$banned_referers = get_option( 'banned_referers' );
+	if ( is_array( $banned_referers ) )
+		$banned_referers = array_filter( $banned_referers );
 
-	$banned_user_agents = get_option('banned_user_agents');
-	if(is_array($banned_user_agents))
-		$banned_user_agents = array_filter($banned_user_agents);
+	$banned_user_agents = get_option( 'banned_user_agents' );
+	if ( is_array( $banned_user_agents ) )
+		$banned_user_agents = array_filter( $banned_user_agents );
 
 	$banned_exclude_ips = get_option('banned_exclude_ips');
-	if(is_array($banned_exclude_ips))
-		$banned_exclude_ips = array_filter($banned_exclude_ips);
+	if ( is_array( $banned_exclude_ips ) )
+		$banned_exclude_ips = array_filter( $banned_exclude_ips );
 
 	$is_excluded = false;
-	if(!empty($banned_exclude_ips)) {
-		foreach($banned_exclude_ips as $banned_exclude_ip) {
-			if($ip == $banned_exclude_ip) {
+	if ( ! empty( $banned_exclude_ips ) ) {
+		foreach( $banned_exclude_ips as $banned_exclude_ip ) {
+			if ( $ip === $banned_exclude_ip ) {
 				$is_excluded = true;
 				break;
 			}
 		}
 	}
 
-	if( ! $is_excluded ) {
+	if ( ! $is_excluded ) {
 		if( ! empty( $banned_ips ) ) {
 			process_ban( $banned_ips, $ip );
 		}
-		if( ! empty( $banned_ips_range ) ) {
+		if ( ! empty( $banned_ips_range ) ) {
 			process_ban_ip_range( $banned_ips_range );
 		}
-		if( ! empty( $banned_hosts ) ) {
+		if ( ! empty( $banned_hosts ) ) {
 			process_ban( $banned_hosts, @gethostbyaddr( $ip ) );
 		}
-		if( ! empty( $banned_referers ) && ! empty( $_SERVER['HTTP_REFERER'] ) ) {
+		if ( ! empty( $banned_referers ) && ! empty( $_SERVER['HTTP_REFERER'] ) ) {
 			process_ban( $banned_referers, $_SERVER['HTTP_REFERER'] );
 		}
-		if( ! empty( $banned_user_agents ) && ! empty( $_SERVER['HTTP_USER_AGENT'] ) ) {
+		if ( ! empty( $banned_user_agents ) && ! empty( $_SERVER['HTTP_USER_AGENT'] ) ) {
 			process_ban( $banned_user_agents, $_SERVER['HTTP_USER_AGENT'] );
 		}
 	}
 }
 
@@ -297,12 +298,11 @@ function ban_activation( $network_wide )
 
 function ban_activate() {
 	add_option('banned_ips', array());
 	add_option('banned_hosts',array());
 	add_option('banned_stats', array('users' => array(), 'count' => 0));
-	add_option('banned_message', '<!DOCTYPE html>'."\n".
-	'<html>'."\n".
+	add_option('banned_message', '<html>'."\n".
 	'<head>'."\n".
 	'<meta charset="utf-8">'."\n".
 	'<title>%SITE_NAME% - %SITE_URL%</title>'."\n".
 	'</head>'."\n".
 	'<body>'."\n".

Vulnerable code: language: php
php:
  - "7.3"
  - "7.2"
  - "7.1"
  - "7.0"
  - "5.6"

script:
  - find . \( -name '*.php' \) -exec php -lf {} \;

notifications:
  email: false
Tested up to: 5.9  
Stable tag: 1.69  
### Build Status
[![Build Status](https://travis-ci.org/lesterchan/wp-ban.svg?branch=master)](https://travis-ci.org/lesterchan/wp-ban)

    $banned_message             = ! empty( $_POST['banned_template_message'] )  ? trim( $_POST['banned_template_message'] ) : '';
    if(!empty($banned_ips_post)) {
        foreach($banned_ips_post as $banned_ip) {
            if($admin_login == 'admin' && ($banned_ip == ban_get_ip() || is_admin_ip($banned_ip))) {
                $text .= '<p style="color: blue;">'.sprintf(__('This IP \'%s\' Belongs To The Admin And Will Not Be Added To Ban List', 'wp-ban'),$banned_ip).'</p>';
                $banned_ips[] = trim($banned_ip);
    if( ! empty( $banned_ips_range_post ) ) {
            if( sizeof( $range ) === 2 ) {
                if( $admin_login === 'admin' && ( check_ip_within_range( ban_get_ip(), $range_start, $range_end ) ) ) {
                    $text .= '<p style="color: blue;">'.sprintf( __( 'The Admin\'s IP \'%s\' Fall Within This Range (%s - %s) And Will Not Be Added To Ban List', 'wp-ban' ), ban_get_ip(), $range_start, $range_end ).'</p>';
                    $banned_ips_range[] = trim( $banned_ip_range );
    if(!empty($banned_hosts_post)) {
        foreach($banned_hosts_post as $banned_host) {
            if($admin_login == 'admin' && ($banned_host == @gethostbyaddr(ban_get_ip()) || is_admin_hostname($banned_host))) {
                $text .= '<p style="color: blue;">'.sprintf(__('This Hostname \'%s\' Belongs To The Admin And Will Not Be Added To Ban List', 'wp-ban'), $banned_host).'</p>';
                $banned_hosts[] = trim($banned_host);
    if(!empty($banned_referers_post)) {
        foreach($banned_referers_post as $banned_referer) {
            if(is_admin_referer($banned_referer)) {
                $text .= '<p style="color: blue;">'.sprintf(__('This Referer \'%s\' Belongs To This Site And Will Not Be Added To Ban List', 'wp-ban'), $banned_referer).'</p>';
                $banned_referers[] = trim($banned_referer);
    if(!empty($banned_user_agents_post)) {
        foreach($banned_user_agents_post as $banned_user_agent) {
            if(is_admin_user_agent($banned_user_agent)) {
                $text .= '<p style="color: blue;">'.sprintf(__('This User Agent \'%s\' Is Used By The Current Admin And Will Not Be Added To Ban List', 'wp-ban'), $banned_user_agent).'</p>';
                $banned_user_agents[] = trim($banned_user_agent);
    if(!empty($banned_exclude_ips_post)) {
        foreach($banned_exclude_ips_post as $banned_exclude_ip) {
            $banned_exclude_ips[] = trim($banned_exclude_ip);
    $update_ban_queries[] = update_option('banned_ips', $banned_ips);
    $update_ban_queries[] = update_option('banned_ips_range', $banned_ips_range);
    $update_ban_queries[] = update_option('banned_hosts', $banned_hosts);
    $update_ban_queries[] = update_option('banned_referers', $banned_referers);
    $update_ban_queries[] = update_option('banned_user_agents', $banned_user_agents);
    $update_ban_queries[] = update_option('banned_exclude_ips', $banned_exclude_ips);
    $update_ban_queries[] = update_option('banned_message', $banned_message);
    $update_ban_text[] = __('Banned IPs', 'wp-ban');
    $update_ban_text[] = __('Banned IP Range', 'wp-ban');
    $update_ban_text[] = __('Banned Host Names', 'wp-ban');
    $update_ban_text[] = __('Banned Referers', 'wp-ban');
    $update_ban_text[] = __('Banned User Agents', 'wp-ban');
    $update_ban_text[] = __('Banned Excluded IPs', 'wp-ban');
    $update_ban_text[] = __('Banned Message', 'wp-ban');
    $i=0;
    foreach($update_ban_queries as $update_ban_query) {
        if($update_ban_query) {
            $text .= '<p style="color: green;">'.$update_ban_text[$i].' '.__('Updated', 'wp-ban').'</p>';
    if(empty($text)) {
        $text = '<p style="color: red;">'.__('No Ban Option Updated', 'wp-ban').'</p>';
                default_template = "<!DOCTYPE html>\n<html>\n<head>\n<meta charset=\"utf-8\">\n<title>%SITE_NAME% - %SITE_URL%</title>\n</head>\n<body>\n<div id=\"wp-ban-container\">\n<p style=\"text-align: center; font-weight: bold;\"><?php _e('You Are Banned.', 'wp-ban'); ?></p>\n</div>\n</body>\n</html>";
            <td valign="top" colspan="2" align="center">
Version: 1.69
	Copyright 2016  Lester Chan  (email : lesterchan@gmail.com)
	if( isset( $banned_stats['count'] ) ) {
	if( isset( $banned_stats['users'][$banned_ip] ) ) {
add_action('init', 'banned');
	if($ip == 'unknown') {
	$banned_ips = get_option('banned_ips');
	if(is_array($banned_ips))
		$banned_ips = array_filter($banned_ips);
	$banned_ips_range = get_option('banned_ips_range');
	if(is_array($banned_ips_range))
		$banned_ips_range = array_filter($banned_ips_range);
	$banned_hosts = get_option('banned_hosts');
	if(is_array($banned_hosts))
		$banned_hosts = array_filter($banned_hosts);
	$banned_referers = get_option('banned_referers');
	if(is_array($banned_referers))
		$banned_referers = array_filter($banned_referers);
	$banned_user_agents = get_option('banned_user_agents');
	if(is_array($banned_user_agents))
		$banned_user_agents = array_filter($banned_user_agents);
	if(is_array($banned_exclude_ips))
		$banned_exclude_ips = array_filter($banned_exclude_ips);
	if(!empty($banned_exclude_ips)) {
		foreach($banned_exclude_ips as $banned_exclude_ip) {
			if($ip == $banned_exclude_ip) {
	if( ! $is_excluded ) {
		if( ! empty( $banned_ips_range ) ) {
		if( ! empty( $banned_hosts ) ) {
		if( ! empty( $banned_referers ) && ! empty( $_SERVER['HTTP_REFERER'] ) ) {
		if( ! empty( $banned_user_agents ) && ! empty( $_SERVER['HTTP_USER_AGENT'] ) ) {
	add_option('banned_message', '<!DOCTYPE html>'."\n".
	'<html>'."\n".
Fixed code: Tested up to: 6.1  
Stable tag: 1.69.1  
### Version 1.69.1
* NEW: Fixed XSS

# Allow HTML
$allowed_tags = wp_kses_allowed_html( 'post' );
$allowed_tags['html'] = true;
$allowed_tags['head'] = true;
$allowed_tags['meta'] = array(
    'charset' => true,
);
$allowed_tags['body'] = true;

    $banned_message             = ! empty( $_POST['banned_template_message'] )  ? wp_kses( trim( $_POST['banned_template_message'] ), $allowed_tags ) : '';
    if ( ! empty( $banned_ips_post ) ) {
        foreach ( $banned_ips_post as $banned_ip ) {
            if( $admin_login === 'admin' && ( $banned_ip === ban_get_ip() || is_admin_ip( $banned_ip ) ) ) {
                $text .= '<p style="color: blue;">' . sprintf( __( 'This IP \'%s\' Belongs To The Admin And Will Not Be Added To Ban List', 'wp-ban' ), $banned_ip ) . '</p>';
                $banned_ips[] = esc_html( trim( $banned_ip ) );
    if ( ! empty( $banned_ips_range_post ) ) {
            if ( sizeof( $range ) === 2 ) {
                if ( $admin_login === 'admin' && ( check_ip_within_range( ban_get_ip(), $range_start, $range_end ) ) ) {
                    $text .= '<p style="color: blue;">' . sprintf( __( 'The Admin\'s IP \'%s\' Fall Within This Range (%s - %s) And Will Not Be Added To Ban List', 'wp-ban' ), ban_get_ip(), $range_start, $range_end ) . '</p>';
                    $banned_ips_range[] = esc_html( trim( $banned_ip_range ) );
    if ( ! empty( $banned_hosts_post ) ) {
        foreach ( $banned_hosts_post as $banned_host ) {
            if ( $admin_login === 'admin' && ( $banned_host === @gethostbyaddr( ban_get_ip() ) || is_admin_hostname( $banned_host ) ) ) {
                $text .= '<p style="color: blue;">' . sprintf( __( 'This Hostname \'%s\' Belongs To The Admin And Will Not Be Added To Ban List', 'wp-ban' ), $banned_host ) . '</p>';
                $banned_hosts[] = esc_html( trim( $banned_host ) );
    if ( ! empty( $banned_referers_post ) ) {
        foreach ( $banned_referers_post as $banned_referer ) {
            if ( is_admin_referer( $banned_referer ) ) {
                $text .= '<p style="color: blue;">' . sprintf( __( 'This Referer \'%s\' Belongs To This Site And Will Not Be Added To Ban List', 'wp-ban' ), $banned_referer ) . '</p>';
                $banned_referers[] = esc_html( trim( $banned_referer ) );
    if ( ! empty( $banned_user_agents_post ) ) {
        foreach ( $banned_user_agents_post as $banned_user_agent ) {
            if ( is_admin_user_agent( $banned_user_agent ) ) {
                $text .= '<p style="color: blue;">' . sprintf( __( 'This User Agent \'%s\' Is Used By The Current Admin And Will Not Be Added To Ban List', 'wp-ban' ), $banned_user_agent ) . '</p>';
                $banned_user_agents[] = esc_html( trim( $banned_user_agent ) );
    if ( ! empty( $banned_exclude_ips_post ) ) {
        foreach ( $banned_exclude_ips_post as $banned_exclude_ip ) {
            $banned_exclude_ips[] = esc_html( trim( $banned_exclude_ip ) );
    $update_ban_queries[] = update_option( 'banned_ips', $banned_ips );
    $update_ban_queries[] = update_option( 'banned_ips_range', $banned_ips_range );
    $update_ban_queries[] = update_option( 'banned_hosts', $banned_hosts );
    $update_ban_queries[] = update_option( 'banned_referers', $banned_referers );
    $update_ban_queries[] = update_option( 'banned_user_agents', $banned_user_agents );
    $update_ban_queries[] = update_option( 'banned_exclude_ips', $banned_exclude_ips );
    $update_ban_queries[] = update_option( 'banned_message', $banned_message );
    $update_ban_text[] = __( 'Banned IPs', 'wp-ban');
    $update_ban_text[] = __( 'Banned IP Range', 'wp-ban');
    $update_ban_text[] = __( 'Banned Host Names', 'wp-ban');
    $update_ban_text[] = __( 'Banned Referers', 'wp-ban');
    $update_ban_text[] = __( 'Banned User Agents', 'wp-ban');
    $update_ban_text[] = __( 'Banned Excluded IPs', 'wp-ban');
    $update_ban_text[] = __( 'Banned Message', 'wp-ban');
    $i = 0;
    foreach ( $update_ban_queries as $update_ban_query ) {
        if ( $update_ban_query ) {
            $text .= '<p style="color: green;">' . $update_ban_text[$i] . ' ' . __( 'Updated', 'wp-ban' ) . '</p>';
    if ( empty( $text ) ) {
        $text = '<p style="color: red;">' . __( 'No Ban Option Updated', 'wp-ban' ) . '</p>';
                default_template = "<html>\n<head>\n<meta charset=\"utf-8\">\n<title>%SITE_NAME% - %SITE_URL%</title>\n</head>\n<body>\n<div id=\"wp-ban-container\">\n<p style=\"text-align: center; font-weight: bold;\"><?php _e('You Are Banned.', 'wp-ban'); ?></p>\n</div>\n</body>\n</html>";
            <td valign="top" colspan="2" style="text-align: center;">
Version: 1.69.1
	Copyright 2022  Lester Chan  (email : lesterchan@gmail.com)
	if ( isset( $banned_stats['count'] ) ) {
	if ( isset( $banned_stats['users'][$banned_ip] ) ) {
	echo '<!DOCTYPE html>' . "\n";
add_action( 'init', 'banned' );
	if ( $ip === 'unknown' ) {
	$banned_ips = get_option( 'banned_ips' );
	if ( is_array( $banned_ips ) )
		$banned_ips = array_filter( $banned_ips );
	$banned_ips_range = get_option( 'banned_ips_range' );
	if ( is_array( $banned_ips_range ) )
		$banned_ips_range = array_filter( $banned_ips_range );
	$banned_hosts = get_option( 'banned_hosts' );
	if ( is_array( $banned_hosts ) )
		$banned_hosts = array_filter( $banned_hosts );
	$banned_referers = get_option( 'banned_referers' );
	if ( is_array( $banned_referers ) )
		$banned_referers = array_filter( $banned_referers );
	$banned_user_agents = get_option( 'banned_user_agents' );
	if ( is_array( $banned_user_agents ) )
		$banned_user_agents = array_filter( $banned_user_agents );
	if ( is_array( $banned_exclude_ips ) )
		$banned_exclude_ips = array_filter( $banned_exclude_ips );
	if ( ! empty( $banned_exclude_ips ) ) {
		foreach( $banned_exclude_ips as $banned_exclude_ip ) {
			if ( $ip === $banned_exclude_ip ) {
	if ( ! $is_excluded ) {
		if ( ! empty( $banned_ips_range ) ) {
		if ( ! empty( $banned_hosts ) ) {
		if ( ! empty( $banned_referers ) && ! empty( $_SERVER['HTTP_REFERER'] ) ) {
		if ( ! empty( $banned_user_agents ) && ! empty( $_SERVER['HTTP_USER_AGENT'] ) ) {
	add_option('banned_message', '<html>'."\n".