CVE-2022-29450: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Admin Management Xtended plugin <= 2.4.4 at WordPress.


CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2022-06-15T19:15Z
Repository: https://github.com/oliverschloebe/admin-management-xtended
Language: PHP
Files changed: admin-management-xtended.php, css/styles.css, general-functions.php, js/functions.js, link-functions.php, media-functions.php, page-functions.php, post-functions.php, readme.txt
Commit date: 2022-06-18 13:41:32 +0200
Commit message: 2.4.5 Release

* FIXED: WordPress 6.0 compatibility
* FIXED: CSRF vulnerabilities fixed (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29450)

Diff: diff --git a/admin-management-xtended.php b/admin-management-xtended.php
index 91364f9..6a7b7b1 100644
--- a/admin-management-xtended.php
+++ b/admin-management-xtended.php
@@ -1,18 +1,18 @@
 <?php
 /*
 Plugin Name: Admin Management Xtended
-Version: 2.4.4
+Version: 2.4.5
 Plugin URI: https://www.schloebe.de/wordpress/admin-management-xtended-plugin/
 Description: <strong>WordPress 4.3+ only.</strong> Extends admin functionalities by introducing: toggling post/page visibility inline, changing page order with drag'n'drop, inline category management, inline tag management, changing publication date inline, changing post slug inline, toggling comment status open/closed, hide draft posts, change media order, change media description inline, toggling link visibility, changing link categories
 Author: Oliver Schl&ouml;be
 Author URI: https://www.schloebe.de/
 Text Domain: admin-management-xtended
 Domain Path: /languages
 
 
-Copyright 2008-2021 Oliver Schlöbe (email : scripts@schloebe.de)
+Copyright 2008-2022 Oliver Schlöbe (email : scripts@schloebe.de)
 
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or
 (at your option) any later version.
@@ -51,11 +51,11 @@ function ame_is_plugin_active( $plugin_filename ) {
 }
 
 /**
  * Define the plugin version
  */
-define("AME_VERSION", "2.4.4");
+define("AME_VERSION", "2.4.5");
 
 /**
  * Define the global var AMEISWP43, returning bool if WP 4.3 or higher is running
  */
 define('AMEISWP43', version_compare($GLOBALS['wp_version'], '4.2.999', '>'));
diff --git a/css/styles.css b/css/styles.css
index 0ce383e..1789906 100644
--- a/css/styles.css
+++ b/css/styles.css
@@ -1,18 +1,23 @@
-.status-draft, .status-future, .cannotdrop {
-	-moz-opacity: 0.4;
+.cannotdrop {
+	opacity: 0.4;
 	filter:Alpha(opacity=40, finishopacity=40, style=1);
 }
+
 .ondragrow {
 	background: #328AB2;
 	color: #fff;
 }
 
 .ondragrow a {
 	color: #fff;
 }
 
+#TB_ajaxContent {
+	overflow: hidden;
+}
+
 ul#categorychecklist {
 	list-style: none;
 	padding: 0;
 	margin: 0;
 }
diff --git a/general-functions.php b/general-functions.php
index 6363bcf..3a52d42 100644
--- a/general-functions.php
+++ b/general-functions.php
@@ -6,11 +6,11 @@
  * @package WordPress_Plugins
  * @subpackage AdminManagementXtended
  */
 
 /*
- * Copyright 2008-2020 Oliver Schlöbe (email : scripts@schloebe.de)
+ * Copyright 2008-2022 Oliver Schlöbe (email : scripts@schloebe.de)
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 2 of the License, or
  * (at your option) any later version.
@@ -69,10 +69,12 @@ function return_function($output) {
  * @since 1.5.0
  * @author scripts@schloebe.de
  */
 function ame_ajax_save_mediadesc() {
 	global $wpdb;
+	check_ajax_referer( 'ame_ajax_validation', 'security' );
+
 	$postid = intval( $_POST['postid'] );
 	$new_mediadesc = $_POST['new_mediadesc'];
 	
 	if( !current_user_can( 'edit_post', $postid ) ) {
 		die();
@@ -94,10 +96,12 @@ function ame_ajax_save_mediadesc() {
  * @since 1.2.0
  * @author scripts@schloebe.de
  */
 function ame_ajax_set_commentstatus() {
 	global $wpdb;
+	check_ajax_referer( 'ame_ajax_validation', 'security' );
+
 	$postid = intval( $_POST['postid'] );
 	$q_status = intval( $_POST['comment_status'] );
 	
 	if( !current_user_can( 'edit_post', $postid ) ) {
 		die();
@@ -125,10 +129,11 @@ function ame_ajax_set_commentstatus() {
  * @since 1.1.0
  * @author scripts@schloebe.de
  */
 function ame_get_pageorder() {
 	global $wpdb;
+	check_ajax_referer( 'ame_ajax_validation', 'security' );
 	
 	if( !current_user_can( 'edit_pages' ) ) {
 		die();
 		return;
 	}
@@ -153,10 +158,12 @@ function ame_get_pageorder() {
  * @since 1.3.0
  * @author scripts@schloebe.de
  */
 function ame_ajax_save_tags() {
 	global $wpdb;
+	check_ajax_referer( 'ame_ajax_validation', 'security' );
+	
 	$postid = intval( $_POST['postid'] );
 	$ame_tags = $_POST['new_tags'];
 	
 	if( !current_user_can( 'edit_post', $postid ) ) {
 		die();
@@ -198,10 +205,12 @@ function ame_ajax_save_tags() {
  * @author scripts@schloebe.de
  * @uses wp_category_checklist()
  */
 function ame_ajax_get_categories() {
 	global $wpdb, $post;
+	check_ajax_referer( 'ame_ajax_validation', 'security' );
+	
 	$ame_id = intval( $_POST['postid'] );
 	
 	if( !current_user_can( 'edit_post', $ame_id ) ) {
 		die();
 		return;
@@ -230,10 +239,12 @@ function ame_ajax_get_categories() {
  * @since 1.2.0
  * @author scripts@schloebe.de
  */
 function ame_ajax_save_categories() {
 	global $wpdb, $post;
+	check_ajax_referer( 'ame_ajax_validation', 'security' );
+	
 	$postid = intval( $_POST['postid'] );
 	$ame_cats = $_POST['ame_cats'];
 	
 	if( !current_user_can( 'edit_post', $postid ) ) {
 		die();
@@ -270,10 +281,12 @@ function ame_ajax_save_categories() {
  * @since 0.9
  * @author scripts@schloebe.de
  */
 function ame_toggle_showinvisposts() {
 	global $wpdb;
+	check_ajax_referer( 'ame_ajax_validation', 'security' );
+	
 	$status = intval( $_POST['status'] );
 	
 	update_option( "ame_toggle_showinvisposts", $status );
 	die( "location.reload();" );
 }
@@ -298,10 +311,12 @@ function ame_ajax_toggle_imageset() {
  * @since 1.0
  * @author scripts@schloebe.de
  */
 function ame_toggle_orderoptions() {
 	global $wpdb;
+	check_ajax_referer( 'ame_ajax_validation', 'security' );
+	
 	$status = intval( $_POST['status'] );
 	
 	update_option( "ame_show_orderoptions", $status );
 	die( "location.reload();" );
 }
@@ -312,10 +327,12 @@ function ame_toggle_orderoptions() {
  * @since 1.0
  * @author scripts@schloebe.de
  */
 function ame_slug_edit() {
 	global $wpdb;
+	check_ajax_referer( 'ame_ajax_validation', 'security' );
+	
 	$postid = intval( $_POST['category_id'] );
 	if( is_string( $_POST['posttype'] ) ) $posttype = $_POST['posttype'];
 	
 	if( !current_user_can( 'edit_post', $postid ) ) {
 		die();
@@ -340,10 +357,12 @@ function ame_slug_edit() {
  * @since 1.7.0
  * @author scripts@schloebe.de
  */
 function ame_author_edit() {
 	global $wpdb, $current_user;
+	check_ajax_referer( 'ame_ajax_validation', 'security' );
+	
 	$postid = intval( $_POST['post_id'] );
 	
 	if( !current_user_can( 'edit_post', $postid ) ) {
 		die();
 		return;
@@ -394,10 +413,12 @@ function ame_author_edit() {
  * @since 1.0
  * @author scripts@schloebe.de
  */
 function ame_save_order() {
 	global $wpdb;
+	check_ajax_referer( 'ame_ajax_validation', 'security' );
+	
 	$postid = intval( $_POST['category_id'] );
 	$neworderid = intval( $_POST['new_orderid'] );
 	
 	if( !current_user_can( 'edit_post', $postid ) ) {
 		die();
@@ -414,10 +435,12 @@ function ame_save_order() {
  * @since 1.0
  * @author scripts@schloebe.de
  */
 function ame_save_slug() {
 	global $wpdb;
+	check_ajax_referer( 'ame_ajax_validation', 'security' );
+	
 	$postid = intval( $_POST['category_id'] );
 	
 	if( !current_user_can( 'edit_post', $postid ) ) {
 		die();
 		return;
@@ -449,10 +472,12 @@ function ame_save_slug() {
  * @since 1.7.0
  * @author scripts@schloebe.de
  */
 function ame_save_author() {
 	global $wpdb;
+	check_ajax_referer( 'ame_ajax_validation', 'security' );
+	
 	$postid = intval( $_POST['category_id'] );
 	
 	if( !current_user_can( 'edit_post', $postid ) ) {
 		die();
 		return;
@@ -478,10 +503,12 @@ function ame_save_author() {
  * @since 0.7
  * @author scripts@schloebe.de
  */
 function ame_save_title() {
 	global $wpdb;
+	check_ajax_referer( 'ame_ajax_validation', 'security' );
+	
 	$postid = intval( $_POST['category_id'] );
 	$new_title = $_POST['new_title'];
 	$new_title = apply_filters( 'the_title', $new_title );
 	
 	if( !current_user_can( 'edit_post', $postid ) ) {
@@ -502,10 +529,12 @@ function ame_save_title() {
  * @since 0.7
  * @author scripts@schloebe.de
  */
 function ame_set_date() {
 	global $wpdb;
+	check_ajax_referer( 'ame_ajax_validation', 'security' );
+	
 	$postid = intval( substr( $_POST['category_id'], 10, 5 ) );
 	
 	if( !current_user_can( 'edit_post', $postid ) ) {
 		die();
 		return;
@@ -540,10 +569,12 @@ function ame_set_date() {
  * @since 0.7
  * @author scripts@schloebe.de
  */
 function ame_toggle_visibility() {
 	global $wpdb;
+	check_ajax_referer( 'ame_ajax_validation', 'security' );
+	
 	$postid = intval( $_POST['category_id'] );
 	
 	if( !current_user_can( 'edit_post', $postid ) ) {
 		die();
 		return;
@@ -582,10 +613,12 @@ function ame_toggle_visibility() {
  * @since 2.3.0
  * @author scripts@schloebe.de
  */
 function ame_toggle_sticky() {
 	global $wpdb;
+	check_ajax_referer( 'ame_ajax_validation', 'security' );
+	
 	$postid = intval( $_POST['post_id'] );
 	
 	if( !current_user_can( 'edit_post', $postid ) ) {
 		die();
 		return;
@@ -610,10 +643,12 @@ function ame_toggle_sticky() {
  * @since 2.1.0
  * @author scripts@schloebe.de
  * @link http://plugins.trac.wordpress.org/browser/exclude-pages/trunk/exclude_pages.php#L162
  */
 function ame_toggle_excludestatus() {
+	check_ajax_referer( 'ame_ajax_validation', 'security' );
+	
 	if( !current_user_can( 'edit_pages' ) ) {
 		die();
 		return;
 	}
 	
@@ -953,13 +988,24 @@ if( function_exists( 'add_action' ) ) {
 				'jquery' 
 			), AME_VERSION );
 			wp_enqueue_script( 'ame_gui-modificators', AME_PLUGINFULLURL . "js/gui-modificators.js", array(
 				'sack' 
 			), AME_VERSION );
-			wp_enqueue_script( 'ame_miscscripts', AME_PLUGINFULLURL . "js/functions.js", array(
-				'sack' 
-			), AME_VERSION );
+			wp_register_script( 
+				'ame_miscscripts',
+				AME_PLUGINFULLURL . "js/functions.js",
+				array( 'jquery', 'sack' ),
+				AME_VERSION
+			);   
+			wp_enqueue_script( 'ame_miscscripts' );    
+			wp_localize_script( 
+				'ame_miscscripts',
+				'ameAjaxSec',
+				array(
+					'ajaxnonce'	=> wp_create_nonce( 'ame_ajax_validation' )
+				) 
+			);
 		}
 		
 		add_action( 'admin_head', 'ame_css_admin_header' );
 		add_action( 'admin_print_scripts', 'ame_js_admin_header' );
 		add_action( 'admin_head', 'ame_js_jquery_datepicker_header' );
@@ -998,13 +1044,24 @@ if( function_exists( 'add_action' ) ) {
 				'thickbox' 
 			) );
 			wp_enqueue_script( 'ame_gui-modificators', AME_PLUGINFULLURL . "js/gui-modificators.js", array(
 				'sack' 
 			), AME_VERSION );
-			wp_enqueue_script( 'ame_miscscripts', AME_PLUGINFULLURL . "js/functions.js", array(
-				'sack' 
-			), AME_VERSION );
+			wp_register_script( 
+				'ame_miscscripts',
+				AME_PLUGINFULLURL . "js/functions.js",
+				array( 'jquery', 'sack' ),
+				AME_VERSION
+			);   
+			wp_enqueue_script( 'ame_miscscripts' );    
+			wp_localize_script( 
+				'ame_miscscripts',
+				'ameAjaxSec',
+				array(
+					'ajaxnonce'	=> wp_create_nonce( 'ame_ajax_validation' )
+				) 
+			);
 		}
 		
 		add_action( 'admin_print_scripts', 'ame_js_admin_header' );
 		add_action( 'admin_head', 'ame_css_admin_header' );
 		add_action( 'admin_enqueue_scripts', 'ame_enqueue_stuff_linkmanager' );
@@ -1013,13 +1070,24 @@ if( function_exists( 'add_action' ) ) {
 
 		function ame_enqueue_stuff_upload() {
 			wp_enqueue_script( 'ame_gui-modificators', AME_PLUGINFULLURL . "js/gui-modificators.js", array(
 				'sack' 
 			), AME_VERSION );
-			wp_enqueue_script( 'ame_miscscripts', AME_PLUGINFULLURL . "js/functions.js", array(
-				'sack' 
-			), AME_VERSION );
+			wp_register_script( 
+				'ame_miscscripts',
+				AME_PLUGINFULLURL . "js/functions.js",
+				array( 'jquery', 'sack' ),
+				AME_VERSION
+			);   
+			wp_enqueue_script( 'ame_miscscripts' );    
+			wp_localize_script( 
+				'ame_miscscripts',
+				'ameAjaxSec',
+				array(
+					'ajaxnonce'	=> wp_create_nonce( 'ame_ajax_validation' )
+				) 
+			);
 		}
 		
 		add_action( 'admin_print_scripts', 'ame_js_admin_header' );
 		add_action( 'admin_enqueue_scripts', 'ame_enqueue_stuff_upload' );
 	}
diff --git a/js/functions.js b/js/functions.js
index eaf6577..0c86f81 100644
--- a/js/functions.js
+++ b/js/functions.js
@@ -23,10 +23,11 @@ function mediadescSpanFadeOut( postid, ame_mediadesc ) {
 		jQuery("span#ame_mediadesc" + postid).fadeIn('fast', function() {
 			var ame_sack = new sack( ajaxurl );
 			ame_sack.execute = 1;
 			ame_sack.method = 'POST';
 			ame_sack.setVar( "action", "ame_ajax_save_mediadesc" );
+			ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
 			ame_sack.setVar( "postid", postid );
 			ame_sack.setVar( "new_mediadesc", ame_mediadesc );
 			ame_sack.onError = function() { alert('Ajax error on saving media description'); };
 			ame_sack.runAJAX();
 		});
@@ -43,21 +44,21 @@ function ame_ajax_form_tags( postid, posttags ) {
 	});
 	jQuery('#ame_tags' + postid + ' #ame_tag_save' + postid).click(function() {
 		var new_tags = jQuery('input#ame-new-tags' + postid).val();
 		tagSpanFadeOut( postid, new_tags );
 	});
-	ame_setupSuggest( postid );
 }
 
 function tagSpanFadeOut( postid, ame_tags ) {
 	jQuery("span#ame_tags" + postid).fadeOut('fast', function() {
 		var loading = '<img border="0" alt="" src="' + ameAjaxL10n.imgUrl + 'loader.gif" align="absbottom" /> ' + ameAjaxL10n.pleaseWait;
 		jQuery("span#ame_tags" + postid).fadeIn('fast', function() {
 			var ame_sack = new sack( ajaxurl );
 			ame_sack.execute = 1;
 			ame_sack.method = 'POST';
 			ame_sack.setVar( "action", "ame_ajax_save_tags" );
+			ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
 			ame_sack.setVar( "postid", postid );
 			ame_sack.setVar( "new_tags", ame_tags );
 			ame_sack.onError = function() { alert('Ajax error on saving tags'); };
 			ame_sack.runAJAX();
 		});
@@ -71,10 +72,11 @@ function catSpanFadeOut( postid, ame_cats ) {
 		jQuery("span#ame_category" + postid).fadeIn('fast', function() {
 			var ame_sack = new sack( ajaxurl );
 			ame_sack.execute = 1;
 			ame_sack.method = 'POST';
 			ame_sack.setVar( "action", "ame_ajax_save_categories" );
+			ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
 			ame_sack.setVar( "postid", postid );
 			ame_sack.setVar( "ame_cats", ame_cats );
 			ame_sack.onError = function() { alert('Ajax error on saving categories'); };
 			ame_sack.onSuccess = function() { re_init(); };
 			ame_sack.runAJAX();
@@ -87,10 +89,11 @@ function catSpanFadeOut( postid, ame_cats ) {
 function ame_ajax_get_categories( postid ) {
 	var ame_sack = new sack( ajaxurl );
 	ame_sack.execute = 0;
 	ame_sack.method = 'POST';
 	ame_sack.setVar( "action", "ame_ajax_get_categories" );
+	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
 	ame_sack.setVar( "postid", postid );
 	ame_sack.onError = function() { alert('Ajax error on getting categories') };
 	ame_sack.onCompletion = function() {
 		jQuery('#categorychoosewrap' + postid).html( ame_sack.response );
 		jQuery('#thickboxlink' + postid).delay(500).click();
@@ -116,10 +119,11 @@ function linkcatSpanFadeOut( linkid, ame_linkcats ) {
 		jQuery("span#ame_linkcategory" + linkid).fadeIn('fast', function() {
 			var ame_sack = new sack( ajaxurl );
 			ame_sack.execute = 1;
 			ame_sack.method = 'POST';
 			ame_sack.setVar( "action", "ame_ajax_save_linkcategories" );
+			ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
 			ame_sack.setVar( "linkid", linkid );
 			ame_sack.setVar( "ame_linkcats", ame_linkcats );
 			ame_sack.onError = function() { alert('Ajax error on saving link categories'); };
 			ame_sack.onSuccess = function() { re_init(); };
 			ame_sack.runAJAX();
@@ -141,10 +145,11 @@ function ame_ajax_save_linkcategories( linkid ) {
 function ame_ajax_set_commentstatus( postid, status, posttype ) {
 	var ame_sack = new sack( ajaxurl );
 	ame_sack.execute = 1;
 	ame_sack.method = 'POST';
 	ame_sack.setVar( "action", "ame_ajax_set_commentstatus" );
+	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
 	ame_sack.setVar( "postid", postid );
 	ame_sack.setVar( "comment_status", status );
 	ame_sack.setVar( "posttype", posttype );
 	ame_sack.onError = function() { alert('Ajax error on toggling comment status') };
 	ame_sack.runAJAX();
@@ -153,20 +158,22 @@ function ame_ajax_set_commentstatus( postid, status, posttype ) {
 function ame_ajax_get_pageorder( pageordertable ) {
 	var ame_sack = new sack( ajaxurl );
 	ame_sack.execute = 1;
 	ame_sack.method = 'POST';
 	ame_sack.setVar( "action", "ame_get_pageorder" );
+	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
 	ame_sack.setVar( "pageordertable2", pageordertable );
 	ame_sack.onError = function() { alert('Ajax error on getting page order') };
 	ame_sack.runAJAX();
 }
 
 function ame_ajax_toggle_imageset( setid ) {
 	var ame_sack = new sack( ajaxurl );
 	ame_sack.execute = 1;
 	ame_sack.method = 'POST';
 	ame_sack.setVar( "action", "ame_ajax_toggle_imageset" );
+	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
 	ame_sack.setVar( "setid", setid );
 	ame_sack.onError = function() { alert('Ajax error on toggling image set') };
 	ame_sack.runAJAX();
 }
 
@@ -174,10 +181,11 @@ function ame_ajax_toggle_showinvisposts( status ) {
 	jQuery("#ame_toggle_showinvisposts").prop("value", ameAjaxL10n.pleaseWait);
 	var ame_sack = new sack( ajaxurl );
 	ame_sack.execute = 1;
 	ame_sack.method = 'POST';
 	ame_sack.setVar( "action", "ame_toggle_showinvisposts" );
+	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
 	ame_sack.setVar( "status", status );
 	ame_sack.onError = function() { alert('Ajax error on toggling post visibility') };
 	ame_sack.runAJAX();
 }
 
@@ -185,10 +193,11 @@ function ame_ajax_toggle_orderoptions( status ) {
 	jQuery("#ame_order2_loader").html(ameAjaxL10n.pleaseWait);
 	var ame_sack = new sack( ajaxurl );
 	ame_sack.execute = 1;
 	ame_sack.method = 'POST';
 	ame_sack.setVar( "action", "ame_toggle_orderoptions" );
+	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
 	ame_sack.setVar( "status", status );
 	ame_sack.onError = function() { alert('Ajax error on toggling page order column') };
 	ame_sack.runAJAX();
 }
 
@@ -197,10 +206,11 @@ function ame_ajax_order_save( cat_id, posttype ) {
 	jQuery("span#ame_order_loader" + cat_id).show();
 	var ame_sack = new sack( ajaxurl );
 	ame_sack.execute = 1;
 	ame_sack.method = 'POST';
 	ame_sack.setVar( "action", "ame_save_order" );
+	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
 	ame_sack.setVar( "category_id", cat_id );
 	ame_sack.setVar( "new_orderid", neworderid );
 	ame_sack.setVar( "posttype", posttype );
 	ame_sack.onError = function() { alert('Ajax error on saving page order') };
 	ame_sack.runAJAX();
@@ -210,10 +220,11 @@ function ame_slug_edit( cat_id, posttype ) {
 	var newslug = jQuery("input#ame_slug" + cat_id).prop('value');
 	var ame_sack = new sack( ajaxurl );
 	ame_sack.execute = 1;
 	ame_sack.method = 'POST';
 	ame_sack.setVar( "action", "ame_slug_edit" );
+	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
 	ame_sack.setVar( "col_no", jQuery('.widefat thead tr th').length );
 	ame_sack.setVar( "category_id", cat_id );
 	ame_sack.setVar( "posttype", posttype );
 	ame_sack.onError = function() { alert('Ajax error on editing post slug') };
 	ame_sack.runAJAX();
@@ -222,10 +233,11 @@ function ame_slug_edit( cat_id, posttype ) {
 function ame_ajax_set_visibility( post_id, status, posttype ) {
 	var ame_sack = new sack( ajaxurl );
 	ame_sack.execute = 1;
 	ame_sack.method = 'POST';
 	ame_sack.setVar( "action", "ame_toggle_visibility" );
+	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
 	ame_sack.setVar( "category_id", post_id );
 	ame_sack.setVar( "vis_status", status );
 	ame_sack.setVar( "posttype", posttype );
 	ame_sack.onError = function() { alert('Ajax error on toggling visibility') };
 	ame_sack.runAJAX();
@@ -234,20 +246,22 @@ function ame_ajax_set_visibility( post_id, status, posttype ) {
 function ame_ajax_set_sticky( post_id, posttype ) {
 	var ame_sack = new sack( ajaxurl );
 	ame_sack.execute = 1;
 	ame_sack.method = 'POST';
 	ame_sack.setVar( "action", "ame_toggle_sticky" );
+	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
 	ame_sack.setVar( "post_id", post_id );
 	ame_sack.onError = function() { alert('Ajax error on toggling sticky') };
 	ame_sack.runAJAX();
 }
 
 function ame_ajax_set_postdate( post_id, pickedDate, posttype ) {
 	var ame_sack = new sack( ajaxurl );
 	ame_sack.execute = 1;
 	ame_sack.method = 'POST';
 	ame_sack.setVar( "action", "ame_set_date" );
+	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
 	ame_sack.setVar( "category_id", post_id );
 	ame_sack.setVar( "pickedDate", pickedDate );
 	ame_sack.setVar( "posttype", posttype );
 	ame_sack.onError = function() { alert('Ajax error on chosing new date') };
 	ame_sack.runAJAX();
@@ -268,10 +282,11 @@ function ame_ajax_title_save( cat_id, posttype ) {
 	var newtitle = jQuery("input#ame_title" + cat_id).prop('value');
 	var ame_sack = new sack( ajaxurl );
 	ame_sack.execute = 1;
 	ame_sack.method = 'POST';
 	ame_sack.setVar( "action", "ame_save_title" );
+	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
 	ame_sack.setVar( "category_id", cat_id );
 	ame_sack.setVar( "new_title", newtitle );
 	ame_sack.setVar( "posttype", posttype );
 	ame_sack.onError = function() { alert('Ajax error on saving post title') };
 	ame_sack.runAJAX();
@@ -285,10 +300,11 @@ function ame_ajax_slug_save( cat_id, typenumber ) {
 	}
 	var ame_sack = new sack( ajaxurl );
 	ame_sack.execute = 1;
 	ame_sack.method = 'POST';
 	ame_sack.setVar( "action", "ame_save_slug" );
+	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
 	ame_sack.setVar( "category_id", cat_id );
 	ame_sack.setVar( "new_slug", newslug );
 	ame_sack.setVar( "typenumber", typenumber );
 	ame_sack.onError = function() { alert('Ajax error on saving post slug') };
 	ame_sack.runAJAX();
@@ -298,10 +314,11 @@ function ame_ajax_author_save( cat_id, typenumber ) {
 	var newauthor = jQuery("select#author-" + cat_id).prop('value');
 	var ame_sack = new sack( ajaxurl );
 	ame_sack.execute = 1;
 	ame_sack.method = 'POST';
 	ame_sack.setVar( "action", "ame_save_author" );
+	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
 	ame_sack.setVar( "category_id", cat_id );
 	ame_sack.setVar( "newauthor", newauthor );
 	ame_sack.setVar( "typenumber", typenumber );
 	ame_sack.onError = function() { alert('Ajax error on saving post authot') };
 	ame_sack.runAJAX();
@@ -310,10 +327,11 @@ function ame_ajax_author_save( cat_id, typenumber ) {
 function ame_author_edit( post_id, posttype ) {
 	var ame_sack = new sack( ajaxurl );
 	ame_sack.execute = 1;
 	ame_sack.method = 'POST';
 	ame_sack.setVar( "action", "ame_author_edit" );
+	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
 	ame_sack.setVar( "post_id", post_id );
 	ame_sack.setVar( "col_no", jQuery('.widefat thead tr th').length );
 	ame_sack.setVar( "posttype", posttype );
 	ame_sack.onError = function() { alert('Ajax error on editing author') };
 	ame_sack.runAJAX();
@@ -322,10 +340,11 @@ function ame_author_edit( post_id, posttype ) {
 function ame_ajax_set_linkvisibility( link_id ) {
 	var ame_sack = new sack( ajaxurl );
 	ame_sack.execute = 1;
 	ame_sack.method = 'POST';
 	ame_sack.setVar( "action", "ame_toggle_linkvisibility" );
+	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
 	ame_sack.setVar( "link_id", link_id );
 	ame_sack.onError = function() { alert('Ajax error on toggling link visibility') };
 	ame_sack.runAJAX();
 }
 
@@ -337,10 +356,11 @@ function ame_edit_cancel( cat_id ) {
 function ame_ajax_set_excludestatus( page_id, status_id ) {
 	var ame_sack = new sack( ajaxurl );
 	ame_sack.execute = 1;
 	ame_sack.method = 'POST';
 	ame_sack.setVar( "action", "ame_toggle_excludestatus" );
+	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
 	ame_sack.setVar( "pageid", page_id );
 	ame_sack.setVar( "statusid", status_id );
 	ame_sack.onError = function() { alert('Ajax error on toggling image set') };
 	ame_sack.runAJAX();
 }
diff --git a/link-functions.php b/link-functions.php
index 37b4272..dd804e4 100644
--- a/link-functions.php
+++ b/link-functions.php
@@ -5,11 +5,11 @@
  * @package WordPress_Plugins
  * @subpackage AdminManagementXtended
  */
  
 /*
-Copyright 2008-2015 Oliver Schlöbe (email : scripts@schloebe.de)
+Copyright 2008-2022 Oliver Schlöbe (email : scripts@schloebe.de)
 
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or
 (at your option) any later version.
@@ -127,10 +127,12 @@ add_filter('manage_link-manager_columns', 'ame_column_link_categories', 2, 2);
  * @since 1.8.0
  * @author scripts@schloebe.de
  */
 function ame_toggle_linkvisibility() {
 	global $wpdb;
+	check_ajax_referer( 'ame_ajax_validation', 'security' );
+	
 	$posttype = 'link';
 	$linkid = intval( $_POST['link_id'] );
 	
 	if( !current_user_can( 'manage_links' ) ) {
 		die();
@@ -151,10 +153,12 @@ function ame_toggle_linkvisibility() {
  * @since 1.8.0
  * @author scripts@schloebe.de
  */
 function ame_ajax_save_linkcategories() {
 	global $wpdb;
+	check_ajax_referer( 'ame_ajax_save_linkcategories' );
+	
 	$linkid = (int) $_POST['linkid'];
 	$ame_linkcats = $_POST['ame_linkcats'];
 	
 	if( !current_user_can( 'manage_links' ) ) {
 		die();
diff --git a/media-functions.php b/media-functions.php
index 2a5af9e..6626d41 100644
--- a/media-functions.php
+++ b/media-functions.php
@@ -5,11 +5,11 @@
  * @package WordPress_Plugins
  * @subpackage AdminManagementXtended
  */
  
 /*
-Copyright 2008-2015 Oliver Schlöbe (email : webmaster@schloebe.de)
+Copyright 2008-2022 Oliver Schlöbe (email : webmaster@schloebe.de)
 
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or
 (at your option) any later version.
diff --git a/page-functions.php b/page-functions.php
index 7d61a8a..31caa8e 100644
--- a/page-functions.php
+++ b/page-functions.php
@@ -5,11 +5,11 @@
  * @package WordPress_Plugins
  * @subpackage AdminManagementXtended
  */
  
 /*
-Copyright 2008-2020 Oliver Schlöbe (email : scripts@schloebe.de)
+Copyright 2008-2022 Oliver Schlöbe (email : scripts@schloebe.de)
 
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or
 (at your option) any later version.
diff --git a/post-functions.php b/post-functions.php
index ada10b6..c0f3263 100644
--- a/post-functions.php
+++ b/post-functions.php
@@ -5,11 +5,11 @@
  * @package WordPress_Plugins
  * @subpackage AdminManagementXtended
  */
  
 /*
-Copyright 2008-2020 Oliver Schlöbe (email : scripts@schloebe.de)
+Copyright 2008-2022 Oliver Schlöbe (email : scripts@schloebe.de)
 
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or
 (at your option) any later version.
diff --git a/readme.txt b/readme.txt
index 56829c7..490dbb1 100644
--- a/readme.txt
+++ b/readme.txt
@@ -1,11 +1,11 @@
 === Admin Management Xtended ===
 Contributors: Alphawolf
 Donate link: https://www.schloebe.de/donate/
 Tags: admin, ajax, management, cms, post, pages, category, inline, media, revision, link, bookmark, drag-and-drop, drag drop, 
 Requires at least: 4.3
-Tested up to: 6.9.9999
+Tested up to: 6.1
 Stable tag: trunk
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 
 Adds AJAX-driven options to some admin management pages with CMS-known functions without having to open the edit screens.
@@ -102,10 +102,14 @@ Please visit [the official website](https://www.schloebe.de/wordpress/admin-mana
 3. Activate the plugin from your WordPress admin panel.
 4. Installation finished.
 
 == Changelog ==
 
+= 2.4.5 =
+* FIXED: WordPress 6.0 compatibility
+* FIXED: CSRF vulnerabilities fixed (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29450)
+
 = 2.4.4 =
 * FIXED: WordPress 5.5 compatibility
 
 = 2.4.3 =
 * FIXED: WordPress 5.3 compatibility

Vulnerable code: Version: 2.4.4
Copyright 2008-2021 Oliver Schlöbe (email : scripts@schloebe.de)
define("AME_VERSION", "2.4.4");
.status-draft, .status-future, .cannotdrop {
	-moz-opacity: 0.4;
 * Copyright 2008-2020 Oliver Schlöbe (email : scripts@schloebe.de)
			wp_enqueue_script( 'ame_miscscripts', AME_PLUGINFULLURL . "js/functions.js", array(
				'sack' 
			), AME_VERSION );
			wp_enqueue_script( 'ame_miscscripts', AME_PLUGINFULLURL . "js/functions.js", array(
				'sack' 
			), AME_VERSION );
			wp_enqueue_script( 'ame_miscscripts', AME_PLUGINFULLURL . "js/functions.js", array(
				'sack' 
			), AME_VERSION );
	ame_setupSuggest( postid );
Copyright 2008-2015 Oliver Schlöbe (email : scripts@schloebe.de)
Copyright 2008-2015 Oliver Schlöbe (email : webmaster@schloebe.de)
Copyright 2008-2020 Oliver Schlöbe (email : scripts@schloebe.de)
Copyright 2008-2020 Oliver Schlöbe (email : scripts@schloebe.de)
Tested up to: 6.9.9999
Fixed code: Version: 2.4.5
Copyright 2008-2022 Oliver Schlöbe (email : scripts@schloebe.de)
define("AME_VERSION", "2.4.5");
.cannotdrop {
	opacity: 0.4;

#TB_ajaxContent {
	overflow: hidden;
}

 * Copyright 2008-2022 Oliver Schlöbe (email : scripts@schloebe.de)
	check_ajax_referer( 'ame_ajax_validation', 'security' );

	check_ajax_referer( 'ame_ajax_validation', 'security' );

	check_ajax_referer( 'ame_ajax_validation', 'security' );
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
			wp_register_script( 
				'ame_miscscripts',
				AME_PLUGINFULLURL . "js/functions.js",
				array( 'jquery', 'sack' ),
				AME_VERSION
			);   
			wp_enqueue_script( 'ame_miscscripts' );    
			wp_localize_script( 
				'ame_miscscripts',
				'ameAjaxSec',
				array(
					'ajaxnonce'	=> wp_create_nonce( 'ame_ajax_validation' )
				) 
			);
			wp_register_script( 
				'ame_miscscripts',
				AME_PLUGINFULLURL . "js/functions.js",
				array( 'jquery', 'sack' ),
				AME_VERSION
			);   
			wp_enqueue_script( 'ame_miscscripts' );    
			wp_localize_script( 
				'ame_miscscripts',
				'ameAjaxSec',
				array(
					'ajaxnonce'	=> wp_create_nonce( 'ame_ajax_validation' )
				) 
			);
			wp_register_script( 
				'ame_miscscripts',
				AME_PLUGINFULLURL . "js/functions.js",
				array( 'jquery', 'sack' ),
				AME_VERSION
			);   
			wp_enqueue_script( 'ame_miscscripts' );    
			wp_localize_script( 
				'ame_miscscripts',
				'ameAjaxSec',
				array(
					'ajaxnonce'	=> wp_create_nonce( 'ame_ajax_validation' )
				) 
			);
			ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
			ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
			ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
			ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
Copyright 2008-2022 Oliver Schlöbe (email : scripts@schloebe.de)
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_save_linkcategories' );
	
Copyright 2008-2022 Oliver Schlöbe (email : webmaster@schloebe.de)
Copyright 2008-2022 Oliver Schlöbe (email : scripts@schloebe.de)
Copyright 2008-2022 Oliver Schlöbe (email : scripts@schloebe.de)
Tested up to: 6.1
= 2.4.5 =
* FIXED: WordPress 6.0 compatibility
* FIXED: CSRF vulnerabilities fixed (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29450)