CVE-2013-10020: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, was found in MMDeveloper A Forms Plugin up to 1.4.2 on WordPress. This affects an unknown part of the file a-forms.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.4.3 is able to address this issue. The identifier of the patch is 3e693197bd69b7173cc16d8d2e0a7d501a2a0b06. It is recommended to upgrade the affected component. The identifier VDB-222609 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-03-10T01:15Z
Repository: https://github.com/wp-plugins/a-forms
Language: Other
Files changed: a-forms.php, readme.txt
Commit date: 2013-08-20 01:07:25 +0000
Commit message: Fixed yet another issue with critical cross-site scripting. I've forced SiteLock to check and check, and I think its finally fixed.

git-svn-id: https://plugins.svn.wordpress.org/a-forms/trunk@758898 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/a-forms.php b/a-forms.php
index bf53d00..64f78d0 100644
--- a/a-forms.php
+++ b/a-forms.php
@@ -18,11 +18,11 @@ http://wordpress.org/extend/plugins/a-forms
 
 3) Login to WordPress admin, click on Plugins / Add New / Upload, then upload the zip file you just downloaded.
 
 4) Activate the plugin.
 
-Version: 1.4.2
+Version: 1.4.3
 Author: TheOnlineHero - Tom Skroza
 License: GPL2
 */
 
 require_once("a-form.php");
@@ -220,21 +220,21 @@ function register_a_forms_page() {
 }
 
 add_action('wp_ajax_aform_css_file_selector', 'aform_css_file_selector');
 function aform_css_file_selector() {
   if (are_a_forms_dependencies_installed()) {
-    update_option("aform_current_css_file", esc_html($_POST["css_file_selection"]));
-    echo(@file_get_contents(get_template_directory()."/aforms_css/".esc_html($_POST["css_file_selection"])));
+    update_option("aform_current_css_file", ($_POST["css_file_selection"]));
+    echo(@file_get_contents(get_template_directory()."/aforms_css/".($_POST["css_file_selection"])));
   }
   die();  
 }
 
 add_action('wp_ajax_add_field_to_section', 'add_field_to_section');
 function add_field_to_section() {
   global $wpdb;
-  $section = tom_get_row_by_id("a_form_sections", "*", "ID", esc_html($_POST["section_id"]));
-  tom_insert_record("a_form_fields", array("field_order" => esc_html($_POST["field_order"]), "section_id" => esc_html($_POST["section_id"]), "form_id" => $section->form_id));
+  $section = tom_get_row_by_id("a_form_sections", "*", "ID", ($_POST["section_id"]));
+  tom_insert_record("a_form_fields", array("field_order" => ($_POST["field_order"]), "section_id" => ($_POST["section_id"]), "form_id" => $section->form_id));
   echo $section->ID."::".$wpdb->insert_id;
   die();  
 }
 
 
@@ -278,23 +278,23 @@ function a_form_initial_page() {
   if (get_option("include_securimage") != "1" && !class_exists("Securimage")) {
     // Make Tom M8te use Securimage.
     update_option("include_securimage", "1");
   } 
 
-  if (esc_html(tom_get_query_string_value("a_form_page")) == "fields") {
-    if (esc_html($_GET["action"]) == "delete") {
+  if ((tom_get_query_string_value("a_form_page")) == "fields") {
+    if (($_GET["action"]) == "delete") {
       AFormFields::delete();
     }
   }
 
   if (tom_get_query_string_value("a_form_page") == "section") {
     a_form_section_page();
   } else if (tom_get_query_string_value("a_form_page") == "section_section_sort") {
-    tom_update_record_by_id("a_form_sections", array("section_order" => esc_html($_POST["section_order"])), "ID", esc_html($_POST["ID"]));
+    tom_update_record_by_id("a_form_sections", array("section_order" => ($_POST["section_order"])), "ID", ($_POST["ID"]));
     exit;
   } else if (tom_get_query_string_value("a_form_page") == "section_field_sort") {
-    tom_update_record_by_id("a_form_fields", array("field_order" => esc_html($_POST["field_order"]), "section_id" => esc_html($_POST["section_id"])), "FID", esc_html($_POST["FID"]));
+    tom_update_record_by_id("a_form_fields", array("field_order" => ($_POST["field_order"]), "section_id" => ($_POST["section_id"])), "FID", ($_POST["FID"]));
     exit;
   } else if (tom_get_query_string_value("a_form_page") == "create_field") {
 
     exit;
   } else {
@@ -307,11 +307,11 @@ function a_form_initial_page() {
 }
 
 function a_form_page() {
   if (tom_get_query_string_value("a_form_page") != "section") {
     if (isset($_POST["action"])) {
-      $action = esc_html($_POST["action"]);
+      $action = ($_POST["action"]);
       if ($action == "Update") {
         AForm::update();
       }
       if ($action == "Create") {
         AForm::create();
@@ -326,17 +326,17 @@ function a_form_page() {
   <div class="wrap a-form">
   <h2>A Forms <a class="add-new-h2" href="<?php echo(get_option('siteurl')); ?>/wp-admin/admin.php?page=a-forms/a-forms.php&action=new">Add New Form</a></h2>
   <?php
 
   if (isset($_GET["message"]) && $_GET["message"] != "") {
-    echo("<div class='updated below-h2'><p>".esc_html($_GET["message"])."</p></div>");
+    echo("<div class='updated below-h2'><p>".($_GET["message"])."</p></div>");
   }
 
   if (isset($_GET["action"]) && $_GET["action"] != "delete") {
     if ($_GET["action"] == "edit") {
       // Display Edit Page
-      $a_form = tom_get_row_by_id("a_form_forms", "*", "ID", esc_html($_GET["id"])); ?>
+      $a_form = tom_get_row_by_id("a_form_forms", "*", "ID", ($_GET["id"])); ?>
 
         <div class="postbox " style="display: block; ">
         <div class="inside">
           <form action="" method="post">
             <?php AForm::render_admin_a_form_forms_form($a_form, "Update"); ?>
@@ -345,11 +345,11 @@ function a_form_page() {
         </div>
 
     
     <?php }
 
-    if (esc_html($_GET["action"]) == "new") {
+    if (($_GET["action"]) == "new") {
       // Display New Page
       ?>
 
         <div class="postbox " style="display: block; ">
         <div class="inside">
@@ -415,28 +415,28 @@ function a_form_section_page() {
   <h2>A Forms <a class="add-new-h2" href="<?php echo(get_option('siteurl')); ?>/wp-admin/admin.php?page=a-forms/a-forms.php&action=new">Add New Form</a></h2>
   
   <?php
 
   if (isset($_GET["message"]) && $_GET["message"] != "") {
-    echo("<div class='updated below-h2'><p>".esc_html($_GET["message"])."</p></div>");
+    echo("<div class='updated below-h2'><p>".($_GET["message"])."</p></div>");
   }
 
   if (isset($_GET["action"]) && $_GET["action"] != "delete") {
     if ($_GET["action"] == "edit") {
       // Display Edit Page
-      $a_form = tom_get_row_by_id("a_form_sections", "*", "ID", esc_html($_GET["id"])); ?>
+      $a_form = tom_get_row_by_id("a_form_sections", "*", "ID", ($_GET["id"])); ?>
       <div class="postbox " style="display: block; ">
       <div class="inside">
         <form action="" method="post">
           <?php AFormSection::render_admin_a_form_sections_form($a_form, "Update"); ?>
         </form>
       </div>
       </div>
       </div>
     <?php }
 
-    if (esc_html($_GET["action"]) == "new") {
+    if (($_GET["action"]) == "new") {
       // Display New Page
       ?>
       <div class="postbox " style="display: block; ">
       <div class="inside">
         <form action="" method="post">
@@ -582,12 +582,12 @@ function a_form_tracking_page() {
   });
   </script>
 
   <div class="wrap">
   <h2>Tracking</h2>
-  <?php if (esc_html(tom_get_query_string_value("id")) != "") { 
-    if (esc_html(tom_get_query_string_value("action")) != "view") { ?>
+  <?php if ((tom_get_query_string_value("id")) != "") { 
+    if ((tom_get_query_string_value("action")) != "view") { ?>
       <form action="" method="post">
         <?php tom_add_form_field(null, "text", "Search Text", "search_text", "search_text", array(), "p", array()); ?>
         <?php tom_add_form_field(null, "text", "Date From", "search_date_from", "search_date_from", array("class" => "datepicker"), "p", array()); ?>
         <?php tom_add_form_field(null, "text", "Date To", "search_date_to", "search_date_to", array("class" => "datepicker"), "p", array()); ?>
         <p><input type="submit" name="action" value="Search" /></p>
@@ -600,33 +600,33 @@ function a_form_tracking_page() {
     } else if ($_GET["action"] == "show") {
       $limit_clause = "10";
       
       $page_no = 0;
       if (isset($_GET["a_form_tracks_page"])) {
-        $page_no = esc_html($_GET["a_form_tracks_page"]);
+        $page_no = ($_GET["a_form_tracks_page"]);
       }
       $offset = $page_no * $limit_clause;
-      $where_sql = "form_id=".esc_html($_GET["id"]);
-      if (esc_html(tom_get_query_string_value("search_text")) != "") {
-        $where_sql .= " AND content LIKE '%".esc_html($_POST["search_text"])."%'";
+      $where_sql = "form_id=".($_GET["id"]);
+      if ((tom_get_query_string_value("search_text")) != "") {
+        $where_sql .= " AND content LIKE '%".($_POST["search_text"])."%'";
       }
 
-      if ((esc_html(tom_get_query_string_value("search_date_from")) != null) && (esc_html(tom_get_query_string_value("search_date_to")) != null)) {
-        $where_sql .= " AND (created_at BETWEEN '".esc_html(tom_get_query_string_value("search_date_from"))." 00:00:00' AND '".esc_html(tom_get_query_string_value("search_date_to"))." 23:59:59')";
-      } else if (esc_html(tom_get_query_string_value("search_date_from")) != null) {
-        $where_sql .= " AND created_at > '".esc_html(tom_get_query_string_value("search_date_from"))." 00:00:00'";
-      } else if (esc_html(tom_get_query_string_value("search_date_to")) != null) {
-        $where_sql .= " AND created_at < '".esc_html(tom_get_query_string_value("search_date_to"))." 23:59:59'";
+      if (((tom_get_query_string_value("search_date_from")) != null) && ((tom_get_query_string_value("search_date_to")) != null)) {
+        $where_sql .= " AND (created_at BETWEEN '".(tom_get_query_string_value("search_date_from"))." 00:00:00' AND '".(tom_get_query_string_value("search_date_to"))." 23:59:59')";
+      } else if ((tom_get_query_string_value("search_date_from")) != null) {
+        $where_sql .= " AND created_at > '".(tom_get_query_string_value("search_date_from"))." 00:00:00'";
+      } else if ((tom_get_query_string_value("search_date_to")) != null) {
+        $where_sql .= " AND created_at < '".(tom_get_query_string_value("search_date_to"))." 23:59:59'";
       }
 
       $tracks = tom_get_results("a_form_tracks", "*", $where_sql, array("created_at DESC"), "$limit_clause OFFSET $offset");
-      $fields = tom_get_results("a_form_fields", "*", "form_id=".esc_html($_GET["id"]), array());
+      $fields = tom_get_results("a_form_fields", "*", "form_id=".($_GET["id"]), array());
       
       $total_tracks = count(tom_get_results("a_form_tracks", "*", $where_sql, array("created_at DESC")));
 
       if ($total_tracks > 0) {
-        tom_generate_datatable_pagination("a_form_tracks", $total_tracks, $limit_clause, esc_html($_GET["a_form_tracks_page"]), "?page=a-forms/a-forms-tracking.php&action=show&id=".esc_html($_GET["id"])."&search_text=".esc_html(tom_get_query_string_value("search_text"))."&search_date_from=".esc_html(tom_get_query_string_value("search_date_from"))."&search_date_to=".esc_html(tom_get_query_string_value("search_date_to")), "ASC", "top");
+        tom_generate_datatable_pagination("a_form_tracks", $total_tracks, $limit_clause, ($_GET["a_form_tracks_page"]), "?page=a-forms/a-forms-tracking.php&action=show&id=".($_GET["id"])."&search_text=".(tom_get_query_string_value("search_text"))."&search_date_from=".(tom_get_query_string_value("search_date_from"))."&search_date_to=".(tom_get_query_string_value("search_date_to")), "ASC", "top");
       ?>
         <table id="tracking">
           <thead>
             <tr>
               <td>ID</td>
@@ -648,11 +648,11 @@ function a_form_tracking_page() {
                 $content = $fields_array[str_replace(" ", "_", strtolower($field->field_label))];
                 echo("<td>");
                 if ($content != "" && $field->field_type == "file") {
                   echo("<a href='".get_option("siteurl")."/wp-content/plugins/tom-m8te/tom-download-file.php?file=".$content."'>download</a>");
                 } else {
-                  echo(preg_replace("/, $/", "", $content));
+                  echo(preg_replace("/, $/", "", esc_html($content)));
                 }
                 echo("</td>");
               }
 
               echo("<td>".$track->referrer_url."</td>");
@@ -668,11 +668,11 @@ get_option("siteurl")."/wp-admin/admin.php?page=a-forms/a-forms-tracking.php&act
       } else {
         echo("<p>No records found!</p>");
       }
     } else if ($_GET["action"] == "view") {
       $view = tom_get_row_by_id("a_form_tracks", "*", "ID", $_GET["id"]);
-      echo "<p><textarea rows='40' cols='160'>".$view->content."</textarea></p>";
+      echo "<p><textarea rows='40' cols='160'>".esc_html(stripcslashes($view->content))."</textarea></p>";
       echo("<p><a href='".get_option("siteurl")."/wp-admin/admin.php?page=a-forms/a-forms-tracking.php&action=show&id=".$view->form_id."'>Back</a></p>");
     }
     
   ?>
   </div>
@@ -699,11 +699,11 @@ function a_form_shortcode($atts) {
 
     $form_valid = true;
     $section_index = 0;
 
     if (isset($_POST["send_a_form_section"])) {
-      $section_index = esc_html($_POST["send_a_form_section"]);
+      $section_index = ($_POST["send_a_form_section"]);
     } else {
       $section_index = 0;
     }
 
     // Get this section.
@@ -717,23 +717,19 @@ function a_form_shortcode($atts) {
     }
 
     // Check to see if User submits a form action.
     if (isset($_POST["send_a_form"]) && ($atts["id"] == $_POST["send_a_form"])) {
 
-      foreach ($_POST as $key => $value) {
-        $_POST[$key] = esc_attr(esc_html($value));
-      }
-
       // User has submitted an aform.
       $captcha_valid = true;
       $form_valid = tom_validate_form($validation_array);
 
       $field_values = array();
       $attachment_urls = array();
 
       if (isset($_POST["a_form_attachment_urls"]) && $_POST["a_form_attachment_urls"] != "") {
-        $attachment_urls = explode("::", esc_html($_POST["a_form_attachment_urls"]));
+        $attachment_urls = explode("::", ($_POST["a_form_attachment_urls"]));
       }
 
       // Construct email content.
       $all_fields = tom_get_results("a_form_fields", "*", "form_id='".$atts["id"]."'");
       foreach ($all_fields as $field) {
@@ -742,12 +738,12 @@ function a_form_shortcode($atts) {
         if ($field->field_type == "checkbox") {
           $i = 0;
           $email_content .= $field->field_label.": ";
           $answers = "";
           foreach (explode(",", $field->value_options) as $key) {
-            if (esc_html($_POST[$form_name.$field_name."_".$i]) != "") {
-              $content = str_replace('\"', "\"", esc_html($_POST[$form_name.$field_name."_".$i]));
+            if (($_POST[$form_name.$field_name."_".$i]) != "") {
+              $content = str_replace('\"', "\"", ($_POST[$form_name.$field_name."_".$i]));
               $content = str_replace("\'", '\'', $content);
               $answers .= $content.", ";
             }
             $i++;
           }
@@ -766,23 +762,23 @@ function a_form_shortcode($atts) {
           }
           
           if ($filedst != "") {
             $field_values[$field_name] = $filedst;
           } else {
-            if (esc_html($_POST["a_form_attachment_urls"]) != "") {
-              $records = explode("::", esc_html($_POST["a_form_attachment_urls"]));
+            if (($_POST["a_form_attachment_urls"]) != "") {
+              $records = explode("::", ($_POST["a_form_attachment_urls"]));
               foreach ($records as $record) {
                 $key_value = explode("=>", $record);
                 if ($key_value[0] == $form_name.$field_name && $key_value[1] != "") {
                   $field_values[$field_name] = $key_value[1];
                 }
               }
             }
           }
           
         } else {
-          $content = str_replace('\"', "\"", esc_html($_POST[$form_name.$field_name]));
+          $content = str_replace('\"', "\"", ($_POST[$form_name.$field_name]));
           $content = str_replace("\'", '\'', $content);
           $email_content .= $field->field_label.": ".$content."\n\n";
           $field_values[$field_name] = $content;
         }
         
@@ -801,15 +797,15 @@ function a_form_shortcode($atts) {
 
           // Check that the answer is first number plus second number.
           $captcha_valid = 
           (
             (
-              esc_html($_POST[aform_field_name($form, "captcha_first_number")]) 
+              ($_POST[aform_field_name($form, "captcha_first_number")]) 
               + 
-              esc_html($_POST[aform_field_name($form, "captcha_second_number")])
+              ($_POST[aform_field_name($form, "captcha_second_number")])
             ) 
-            == esc_html($_POST[aform_field_name($form, "captcha")])
+            == ($_POST[aform_field_name($form, "captcha")])
           );
 
           // Check to see if captcha is valid.
           if ($captcha_valid == false) {
             // Captcha is invalid, so display error message.
@@ -820,28 +816,28 @@ function a_form_shortcode($atts) {
       
       // Check to see if form is valid.
       $nonce_passed = wp_verify_nonce($_REQUEST["_wpnonce"], "a-forms-contact-a-form");
       if ($nonce_passed && $form_valid && $captcha_valid) {
         // Form is valid.
-        if (esc_html($_POST["action"]) == "Send") {
+        if (($_POST["action"]) == "Send") {
           // User clicked Send, so since form is valid and they click Send, send the email.
 
           $subject = $form->subject;
           $from_name = "";
           $user_email = "";
           if ($form->field_name_id != "") {
             $row = tom_get_row_by_id("a_form_fields", "*", "FID", $form->field_name_id);
-            $from_name = esc_html($_POST[$form_name.str_replace(" ", "_", strtolower($row->field_label))]);
+            $from_name = ($_POST[$form_name.str_replace(" ", "_", strtolower($row->field_label))]);
           }
           if ($form->field_email_id != "") {
             $row = tom_get_row_by_id("a_form_fields", "*", "FID", $form->field_email_id);
-            $user_email = esc_html($_POST[$form_name.str_replace(" ", "_", strtolower($row->field_label))]);
+            $user_email = ($_POST[$form_name.str_replace(" ", "_", strtolower($row->field_label))]);
           }
           if ($form->field_subject_id != "") {
             $row = tom_get_row_by_id("a_form_fields", "*", "FID", $form->field_subject_id);
             if (isset($_POST[$form_name.str_replace(" ", "_", strtolower($row->field_label))])) {
-              $subject .= " - ".esc_html($_POST[$form_name.str_replace(" ", "_", strtolower($row->field_label))]);
+              $subject .= " - ".($_POST[$form_name.str_replace(" ", "_", strtolower($row->field_label))]);
             }
           }
 
           if ($form->confirmation_from_email != "") {
             $from_email = $form->confirmation_from_email;
@@ -884,20 +880,20 @@ function a_form_shortcode($atts) {
             if ($form->success_message != "") {
               $mail_message = "<div class='success'>".$form->success_message."</div>";
             }
 
             if ($form->tracking_enabled) {
-              tom_insert_record("a_form_tracks", array("created_at" => $current_datetime, "form_id" => esc_html($_POST["send_a_form"]), "content" => $email_content, "track_type" => "Successful Email", "referrer_url" => $_SERVER["HTTP_REFERER"], "fields_array" => serialize($field_values)));  
+              tom_insert_record("a_form_tracks", array("created_at" => $current_datetime, "form_id" => ($_POST["send_a_form"]), "content" => $email_content, "track_type" => "Successful Email", "referrer_url" => $_SERVER["HTTP_REFERER"], "fields_array" => serialize($field_values)));  
             }        
 
             if ($form->success_redirect_url != "") {
               tom_javascript_redirect_to($form->success_redirect_url, "<p>Please <a href='$url'>Click Next</a> to continue.</p>");
             }
 
           } else {
             if ($form->tracking_enabled) {
-              tom_insert_record("a_form_tracks", array("created_at" => $current_datetime, "form_id" => esc_html($_POST["send_a_form"]), "content" => "Error Message: ".$mail_message.".\n\nContent: ".$email_content, "track_type" => "Failed Email", "referrer_url" => $_SERVER["HTTP_REFERER"], "fields_array" => serialize($field_values)));
+              tom_insert_record("a_form_tracks", array("created_at" => $current_datetime, "form_id" => ($_POST["send_a_form"]), "content" => "Error Message: ".$mail_message.".\n\nContent: ".$email_content, "track_type" => "Failed Email", "referrer_url" => $_SERVER["HTTP_REFERER"], "fields_array" => serialize($field_values)));
             }
           }          
 
           $return_content .= $mail_message;
         }
@@ -918,18 +914,18 @@ function a_form_shortcode($atts) {
     $return_content .= "<form action='' id='".str_replace(" ", "_", strtolower($form->form_name))."' method='post' class='a-form' enctype='multipart/form-data'>";
 
     $return_content .= "<input type='hidden' name='_wpnonce' value='".$aform_form_nonce."'/>";
     $return_content .= "<fieldset>";
     // Get next section
-    if (esc_html($_POST["action"]) == "Next") {
+    if (($_POST["action"]) == "Next") {
       if ($form_valid) {
         $section_index++;
       } 
     }
 
     // Get previous section.
-    if (esc_html($_POST["action"]) == "Back") {
+    if (($_POST["action"]) == "Back") {
       $section_index--;
     }
 
     $section = $sections[$section_index];
 
diff --git a/readme.txt b/readme.txt
index 1f52790..5dc7545 100644
--- a/readme.txt
+++ b/readme.txt
@@ -2,11 +2,11 @@
 Contributors: MMDeveloper
 Donate link: 
 Tags: form, contact, plugin
 Requires at least: 3.3
 Tested up to: 3.6
-Stable tag: 1.4.2
+Stable tag: 1.4.3
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 
 Create easy contact forms.
 
@@ -31,10 +31,14 @@ http://wordpress.org/extend/plugins/a-forms
 4) Activate the plugin.
 
 
 == Changelog ==
 
+= 1.4.3 =
+
+* Fixed yet another issue with critical cross-site scripting. I've forced SiteLock to check and check, and I think its finally fixed.
+
 = 1.4.2 =
 
 * Fixed another issue with critical cross-site scripting.
 
 = 1.4.1 =
@@ -89,10 +93,14 @@ http://wordpress.org/extend/plugins/a-forms
 
 * Initial Commit
 
 == Upgrade notice ==
 
+= 1.4.3 =
+
+* Fixed yet another issue with critical cross-site scripting. I've forced SiteLock to check and check, and I think its finally fixed.
+
 = 1.4.2 =
 
 * Fixed another issue with critical cross-site scripting.
 
 = 1.4.1 =

Vulnerable code: Version: 1.4.2
    update_option("aform_current_css_file", esc_html($_POST["css_file_selection"]));
    echo(@file_get_contents(get_template_directory()."/aforms_css/".esc_html($_POST["css_file_selection"])));
  $section = tom_get_row_by_id("a_form_sections", "*", "ID", esc_html($_POST["section_id"]));
  tom_insert_record("a_form_fields", array("field_order" => esc_html($_POST["field_order"]), "section_id" => esc_html($_POST["section_id"]), "form_id" => $section->form_id));
  if (esc_html(tom_get_query_string_value("a_form_page")) == "fields") {
    if (esc_html($_GET["action"]) == "delete") {
    tom_update_record_by_id("a_form_sections", array("section_order" => esc_html($_POST["section_order"])), "ID", esc_html($_POST["ID"]));
    tom_update_record_by_id("a_form_fields", array("field_order" => esc_html($_POST["field_order"]), "section_id" => esc_html($_POST["section_id"])), "FID", esc_html($_POST["FID"]));
      $action = esc_html($_POST["action"]);
    echo("<div class='updated below-h2'><p>".esc_html($_GET["message"])."</p></div>");
      $a_form = tom_get_row_by_id("a_form_forms", "*", "ID", esc_html($_GET["id"])); ?>
    if (esc_html($_GET["action"]) == "new") {
    echo("<div class='updated below-h2'><p>".esc_html($_GET["message"])."</p></div>");
      $a_form = tom_get_row_by_id("a_form_sections", "*", "ID", esc_html($_GET["id"])); ?>
    if (esc_html($_GET["action"]) == "new") {
  <?php if (esc_html(tom_get_query_string_value("id")) != "") { 
    if (esc_html(tom_get_query_string_value("action")) != "view") { ?>
        $page_no = esc_html($_GET["a_form_tracks_page"]);
      $where_sql = "form_id=".esc_html($_GET["id"]);
      if (esc_html(tom_get_query_string_value("search_text")) != "") {
        $where_sql .= " AND content LIKE '%".esc_html($_POST["search_text"])."%'";
      if ((esc_html(tom_get_query_string_value("search_date_from")) != null) && (esc_html(tom_get_query_string_value("search_date_to")) != null)) {
        $where_sql .= " AND (created_at BETWEEN '".esc_html(tom_get_query_string_value("search_date_from"))." 00:00:00' AND '".esc_html(tom_get_query_string_value("search_date_to"))." 23:59:59')";
      } else if (esc_html(tom_get_query_string_value("search_date_from")) != null) {
        $where_sql .= " AND created_at > '".esc_html(tom_get_query_string_value("search_date_from"))." 00:00:00'";
      } else if (esc_html(tom_get_query_string_value("search_date_to")) != null) {
        $where_sql .= " AND created_at < '".esc_html(tom_get_query_string_value("search_date_to"))." 23:59:59'";
      $fields = tom_get_results("a_form_fields", "*", "form_id=".esc_html($_GET["id"]), array());
        tom_generate_datatable_pagination("a_form_tracks", $total_tracks, $limit_clause, esc_html($_GET["a_form_tracks_page"]), "?page=a-forms/a-forms-tracking.php&action=show&id=".esc_html($_GET["id"])."&search_text=".esc_html(tom_get_query_string_value("search_text"))."&search_date_from=".esc_html(tom_get_query_string_value("search_date_from"))."&search_date_to=".esc_html(tom_get_query_string_value("search_date_to")), "ASC", "top");
                  echo(preg_replace("/, $/", "", $content));
      echo "<p><textarea rows='40' cols='160'>".$view->content."</textarea></p>";
      $section_index = esc_html($_POST["send_a_form_section"]);
      foreach ($_POST as $key => $value) {
        $_POST[$key] = esc_attr(esc_html($value));
      }

        $attachment_urls = explode("::", esc_html($_POST["a_form_attachment_urls"]));
            if (esc_html($_POST[$form_name.$field_name."_".$i]) != "") {
              $content = str_replace('\"', "\"", esc_html($_POST[$form_name.$field_name."_".$i]));
            if (esc_html($_POST["a_form_attachment_urls"]) != "") {
              $records = explode("::", esc_html($_POST["a_form_attachment_urls"]));
          $content = str_replace('\"', "\"", esc_html($_POST[$form_name.$field_name]));
              esc_html($_POST[aform_field_name($form, "captcha_first_number")]) 
              esc_html($_POST[aform_field_name($form, "captcha_second_number")])
            == esc_html($_POST[aform_field_name($form, "captcha")])
        if (esc_html($_POST["action"]) == "Send") {
            $from_name = esc_html($_POST[$form_name.str_replace(" ", "_", strtolower($row->field_label))]);
            $user_email = esc_html($_POST[$form_name.str_replace(" ", "_", strtolower($row->field_label))]);
              $subject .= " - ".esc_html($_POST[$form_name.str_replace(" ", "_", strtolower($row->field_label))]);
              tom_insert_record("a_form_tracks", array("created_at" => $current_datetime, "form_id" => esc_html($_POST["send_a_form"]), "content" => $email_content, "track_type" => "Successful Email", "referrer_url" => $_SERVER["HTTP_REFERER"], "fields_array" => serialize($field_values)));  
              tom_insert_record("a_form_tracks", array("created_at" => $current_datetime, "form_id" => esc_html($_POST["send_a_form"]), "content" => "Error Message: ".$mail_message.".\n\nContent: ".$email_content, "track_type" => "Failed Email", "referrer_url" => $_SERVER["HTTP_REFERER"], "fields_array" => serialize($field_values)));
    if (esc_html($_POST["action"]) == "Next") {
    if (esc_html($_POST["action"]) == "Back") {
Stable tag: 1.4.2
Fixed code: Version: 1.4.3
    update_option("aform_current_css_file", ($_POST["css_file_selection"]));
    echo(@file_get_contents(get_template_directory()."/aforms_css/".($_POST["css_file_selection"])));
  $section = tom_get_row_by_id("a_form_sections", "*", "ID", ($_POST["section_id"]));
  tom_insert_record("a_form_fields", array("field_order" => ($_POST["field_order"]), "section_id" => ($_POST["section_id"]), "form_id" => $section->form_id));
  if ((tom_get_query_string_value("a_form_page")) == "fields") {
    if (($_GET["action"]) == "delete") {
    tom_update_record_by_id("a_form_sections", array("section_order" => ($_POST["section_order"])), "ID", ($_POST["ID"]));
    tom_update_record_by_id("a_form_fields", array("field_order" => ($_POST["field_order"]), "section_id" => ($_POST["section_id"])), "FID", ($_POST["FID"]));
      $action = ($_POST["action"]);
    echo("<div class='updated below-h2'><p>".($_GET["message"])."</p></div>");
      $a_form = tom_get_row_by_id("a_form_forms", "*", "ID", ($_GET["id"])); ?>
    if (($_GET["action"]) == "new") {
    echo("<div class='updated below-h2'><p>".($_GET["message"])."</p></div>");
      $a_form = tom_get_row_by_id("a_form_sections", "*", "ID", ($_GET["id"])); ?>
    if (($_GET["action"]) == "new") {
  <?php if ((tom_get_query_string_value("id")) != "") { 
    if ((tom_get_query_string_value("action")) != "view") { ?>
        $page_no = ($_GET["a_form_tracks_page"]);
      $where_sql = "form_id=".($_GET["id"]);
      if ((tom_get_query_string_value("search_text")) != "") {
        $where_sql .= " AND content LIKE '%".($_POST["search_text"])."%'";
      if (((tom_get_query_string_value("search_date_from")) != null) && ((tom_get_query_string_value("search_date_to")) != null)) {
        $where_sql .= " AND (created_at BETWEEN '".(tom_get_query_string_value("search_date_from"))." 00:00:00' AND '".(tom_get_query_string_value("search_date_to"))." 23:59:59')";
      } else if ((tom_get_query_string_value("search_date_from")) != null) {
        $where_sql .= " AND created_at > '".(tom_get_query_string_value("search_date_from"))." 00:00:00'";
      } else if ((tom_get_query_string_value("search_date_to")) != null) {
        $where_sql .= " AND created_at < '".(tom_get_query_string_value("search_date_to"))." 23:59:59'";
      $fields = tom_get_results("a_form_fields", "*", "form_id=".($_GET["id"]), array());
        tom_generate_datatable_pagination("a_form_tracks", $total_tracks, $limit_clause, ($_GET["a_form_tracks_page"]), "?page=a-forms/a-forms-tracking.php&action=show&id=".($_GET["id"])."&search_text=".(tom_get_query_string_value("search_text"))."&search_date_from=".(tom_get_query_string_value("search_date_from"))."&search_date_to=".(tom_get_query_string_value("search_date_to")), "ASC", "top");
                  echo(preg_replace("/, $/", "", esc_html($content)));
      echo "<p><textarea rows='40' cols='160'>".esc_html(stripcslashes($view->content))."</textarea></p>";
      $section_index = ($_POST["send_a_form_section"]);
        $attachment_urls = explode("::", ($_POST["a_form_attachment_urls"]));
            if (($_POST[$form_name.$field_name."_".$i]) != "") {
              $content = str_replace('\"', "\"", ($_POST[$form_name.$field_name."_".$i]));
            if (($_POST["a_form_attachment_urls"]) != "") {
              $records = explode("::", ($_POST["a_form_attachment_urls"]));
          $content = str_replace('\"', "\"", ($_POST[$form_name.$field_name]));
              ($_POST[aform_field_name($form, "captcha_first_number")]) 
              ($_POST[aform_field_name($form, "captcha_second_number")])
            == ($_POST[aform_field_name($form, "captcha")])
        if (($_POST["action"]) == "Send") {
            $from_name = ($_POST[$form_name.str_replace(" ", "_", strtolower($row->field_label))]);
            $user_email = ($_POST[$form_name.str_replace(" ", "_", strtolower($row->field_label))]);
              $subject .= " - ".($_POST[$form_name.str_replace(" ", "_", strtolower($row->field_label))]);
              tom_insert_record("a_form_tracks", array("created_at" => $current_datetime, "form_id" => ($_POST["send_a_form"]), "content" => $email_content, "track_type" => "Successful Email", "referrer_url" => $_SERVER["HTTP_REFERER"], "fields_array" => serialize($field_values)));  
              tom_insert_record("a_form_tracks", array("created_at" => $current_datetime, "form_id" => ($_POST["send_a_form"]), "content" => "Error Message: ".$mail_message.".\n\nContent: ".$email_content, "track_type" => "Failed Email", "referrer_url" => $_SERVER["HTTP_REFERER"], "fields_array" => serialize($field_values)));
    if (($_POST["action"]) == "Next") {
    if (($_POST["action"]) == "Back") {
Stable tag: 1.4.3
= 1.4.3 =

* Fixed yet another issue with critical cross-site scripting. I've forced SiteLock to check and check, and I think its finally fixed.

= 1.4.3 =

* Fixed yet another issue with critical cross-site scripting. I've forced SiteLock to check and check, and I think its finally fixed.