CVE-2015-10107: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in Simplr Registration Form Plus+ Plugin up to 2.3.4 on WordPress and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.3.5 is able to address this issue. The identifier of the patch is d588446844dd49232ab400ef213ff5b92121c33e. It is recommended to upgrade the affected component. The identifier VDB-230153 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-05-31T03:15Z
Repository: https://github.com/wp-plugins/simplr-registration-form
Language: PHP
Files changed: lib/mod.php, readme.txt, simplr_reg_page.php, views/fields.php
Commit date: 2015-05-06 20:52:40 +0000
Commit message: Addresses add_query_arg vulnerability

git-svn-id: https://plugins.svn.wordpress.org/simplr-registration-form/trunk@1154851 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/lib/mod.php b/lib/mod.php
index d108044..8845bb9 100644
--- a/lib/mod.php
+++ b/lib/mod.php
@@ -5,11 +5,11 @@
 *	@params $views (string)
 */
 if(!function_exists('simplr_views_users')):
 	function simplr_views_users( $views ) {
 		$class = (@$_GET['view_inactive'] == true) ? 'current':'';
-		$views['view_inactive'] = '<a href="'.add_query_arg(array('view_inactive' => 'true')).'" class="'.$class.'" >'. __('Inactive Users','simplr-reg') . ' ('.simplr_count_inactive().')</a>';
+		$views['view_inactive'] = '<a href="'.esc_url(add_query_arg(array('view_inactive' => 'true'))).'" class="'.$class.'" >'. __('Inactive Users','simplr-reg') . ' ('.simplr_count_inactive().')</a>';
 		return $views;
 	}
 endif;
 
 if(!function_exists('simplr_count_inactive')):
diff --git a/readme.txt b/readme.txt
index 8c7515b..4a3a226 100644
--- a/readme.txt
+++ b/readme.txt
@@ -1,12 +1,12 @@
 === Simplr Registration Form Plus+ ===
 Contributors: mpvanwinkle77, mpol
 Donate link: http://www.mikevanwinkle.com/
 Tags: registration, signup, profile, cms, users, user management, user profile
 Requires at least: 3.0
-Tested up to: 4.2
-Stable tag: 2.3.4
+Tested up to: 4.2.1
+Stable tag: 2.3.5
 
 This plugin allows users to easily add a custom user registration form anywhere on their site using simple shortcode.
 
 == Description ==
 **NEW FEATURES**
@@ -51,10 +51,13 @@ For the banners we credit:
 2. The settings page with the first tab open.
 3. The modal where you can customize the shortcode that will be entered.
 
 == Changelog ==
 
+= 2.3.5 =
+* properly escape add_query_arg inputs
+
 = 2.3.4 =
 * 2015-04-18
 * Really use the Email From address for emails.
 
 = 2.3.3 =
diff --git a/simplr_reg_page.php b/simplr_reg_page.php
index 2276dd7..de817db 100644
--- a/simplr_reg_page.php
+++ b/simplr_reg_page.php
@@ -1,9 +1,9 @@
 <?php
 /*
 Plugin Name: Simplr User Registration Form Plus
-Version: 2.3.4
+Version: 2.3.5
 Description: This a simple plugin for adding a custom user registration form to any post or page using shortcode.
 Author: Mike Van Winkle
 Author URI: http://www.mikevanwinkle.com
 Plugin URI: http://www.mikevanwinkle.com/wordpress/how-to/custom-wordpress-registration-page/
 License: GPL
diff --git a/views/fields.php b/views/fields.php
index f8c28b0..56c0b7e 100644
--- a/views/fields.php
+++ b/views/fields.php
@@ -73,11 +73,11 @@ if(@$_GET['action'] == 'edit' OR @$_GET['action'] == 'add') {
 			jQuery('#choices').find('.form-comment').toggle();
 		});
 	});
 	</script>
 	<div class="inner">
-		<form action="<?php echo add_query_arg(array('action'=>'add')); ?>" method="post" id="add-field">
+		<form action="<?php echo esc_url(add_query_arg(array('action'=>'add'))); ?>" method="post" id="add-field">
 			<?php SREG_Form::text(array('name'=>'label','label'=>__('Field Label','simplr-reg'),'required'=>true,'comment'=>__('Human readable name for display to users','simplr-reg')),esc_attr(@$field->label),'wide'); ?>
 			<?php SREG_Form::text(array('name'=>'key','label'=>__('Field Key','simplr-reg'),'required'=>true,'comment'=>__('Machine readable name to represent this field in the Database','simplr-reg')),esc_attr(@$field->key),'wide'); ?>
 
 			<?php SREG_Form::radio( array('name'=>'custom_column','label'=>__('Show this field on user admin screens?','simplr-reg'), 'default'=>'no') , @esc_attr($field->custom_column), 'wide', array('yes'=>'Yes','no'=>'No') ); ?>
 

Vulnerable code: 		$views['view_inactive'] = '<a href="'.add_query_arg(array('view_inactive' => 'true')).'" class="'.$class.'" >'. __('Inactive Users','simplr-reg') . ' ('.simplr_count_inactive().')</a>';
Tested up to: 4.2
Stable tag: 2.3.4
Version: 2.3.4
		<form action="<?php echo add_query_arg(array('action'=>'add')); ?>" method="post" id="add-field">
Fixed code: 		$views['view_inactive'] = '<a href="'.esc_url(add_query_arg(array('view_inactive' => 'true'))).'" class="'.$class.'" >'. __('Inactive Users','simplr-reg') . ' ('.simplr_count_inactive().')</a>';
Tested up to: 4.2.1
Stable tag: 2.3.5
= 2.3.5 =
* properly escape add_query_arg inputs

Version: 2.3.5
		<form action="<?php echo esc_url(add_query_arg(array('action'=>'add'))); ?>" method="post" id="add-field">