CVE-2015-10120: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, was found in WDS Multisite Aggregate Plugin up to 1.0.0 on WordPress. Affected is the function update_options of the file includes/WDS_Multisite_Aggregate_Options.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is 49e0bbcb6ff70e561365d9e0d26426598f63ca12. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-233364.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-07-10T16:15Z
Repository: https://github.com/wp-plugins/wds-multisite-aggregate
Language: PHP
Files changed: includes/WDS_Multisite_Aggregate_Options.php, readme.md, readme.txt, wds-multisite-aggregate.php
Commit date: 2015-04-20 18:07:04 +0000
Commit message: Update for xss vulnerability, https://make.wordpress.org/plugins/2015/04/20/fixing-add_query_arg-and-remove_query_arg-usage

git-svn-id: https://plugins.svn.wordpress.org/wds-multisite-aggregate/trunk@1139353 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/includes/WDS_Multisite_Aggregate_Options.php b/includes/WDS_Multisite_Aggregate_Options.php
index 187b628..29dfa4c 100644
--- a/includes/WDS_Multisite_Aggregate_Options.php
+++ b/includes/WDS_Multisite_Aggregate_Options.php
@@ -58,11 +58,11 @@ class WDS_Multisite_Aggregate_Options {
 		global $wpdb, $current_site, $wp_version;
 
 		if ( ! isset( $_POST['tags_blog_enabled'] ) || !$_POST['tags_blog_enabled'] ) {
 			if ( isset( $_POST['tags_blog_enabled'] ) && $this->get( 'tags_blog_enabled' ) != $_POST['tags_blog_enabled'] )
 				$this->update( 'tags_blog_enabled', 0, true );
-			wp_redirect( add_query_arg( array( 'updated' => '1' ) ) );
+			wp_redirect( esc_url_raw( add_query_arg( array( 'updated' => '1' ) ) ) );
 			exit;
 		}
 		$this->update( 'tags_blog_enabled', 1 );
 
 		if ( ( isset( $_POST['tags_blog'] ) || isset( $_POST['tags_blog_main_blog'] ) ) && isset( $_POST['tags_blog_public'] ) ) {
@@ -141,11 +141,11 @@ class WDS_Multisite_Aggregate_Options {
 		$blogs_to_import = $this->comma_delimited_to_array_from_request( 'blogs_to_import' );
 		$this->update( 'blogs_to_import', $blogs_to_import );
 
 		// force write if changes saved
 		$this->update( true );
-		wp_redirect( add_query_arg( array( 'updated' => '1' ) ) );
+		wp_redirect( esc_url_raw( add_query_arg( array( 'updated' => '1' ) ) ) );
 		exit;
 	}
 
 	function make_integer_from_request( $key ) {
 		return isset( $_REQUEST[ $key ] ) ? (int) $_REQUEST[ $key ] : 0;
diff --git a/readme.md b/readme.md
index 76eea89..f8a3216 100644
--- a/readme.md
+++ b/readme.md
@@ -1,10 +1,10 @@
 # WDS Multisite Aggregate #
 **Contributors:** donncha, imwebgefunden, wpmuguru, WebDevStudios, jtsternberg, Mamaduka  
 **Tags:** wordpressmu  
-**Tested up to:** 3.8.1  
-**Stable tag:** 1.0.0  
+**Tested up to:** 4.2  
+**Stable tag:** 1.0.1  
 **Requires at least:** 3.0  
 
 A central area where all the posts on a WordPress multisite network can be collected.
 
 ## Description ##
@@ -29,10 +29,13 @@ WPCLI is supported:
 	7. Add "Post Meta" custom fields to be copied with posts/pages.
 	8. "Populate Posts" allows you to fill in posts from an existing blog.
 
 ## Changelog ##
 
+### 1.0.1 ###
+* Update for xss vulnerability, https://make.wordpress.org/plugins/2015/04/20/fixing-add_query_arg-and-remove_query_arg-usage
+
 ### 1.0.0 ###
 * Forked from 'MU Sitewide Tags' and rewritten with OOP principles, WordPress coding standards, and extensibility in mind.
 
 ### 0.4.2 ###
 * duplicate category fix
diff --git a/readme.txt b/readme.txt
index 398693c..2e51b12 100644
--- a/readme.txt
+++ b/readme.txt
@@ -1,10 +1,10 @@
 === WDS Multisite Aggregate ===
 Contributors: donncha, imwebgefunden, wpmuguru, WebDevStudios, jtsternberg, Mamaduka
 Tags: wordpressmu
-Tested up to: 3.8.1
-Stable tag: 1.0.0
+Tested up to: 4.2
+Stable tag: 1.0.1
 Requires at least: 3.0
 
 A central area where all the posts on a WordPress MS network can be collected.
 
 == Description ==
@@ -29,10 +29,46 @@ WPCLI is supported:
 	7. Add "Post Meta" custom fields to be copied with posts/pages.
 	8. "Populate Posts" allows you to fill in posts from an existing blog.
 
 == Changelog ==
 
+= 1.0.1 =
+* Update for xss vulnerability, https://make.wordpress.org/plugins/2015/04/20/fixing-add_query_arg-and-remove_query_arg-usage
+
+= 1.0.0 =
+* Forked from 'MU Sitewide Tags' and rewritten with OOP principles, WordPress coding standards, and extensibility in mind.
+
+= 0.4.2 =
+* duplicate category fix
+* page permalink fix
+* thumbnail size filter
+
+= 0.4.1.1 =
+* Run populate feature in source blog context.
+* Added resource warning for populate feature.
+* Fixed PHP warnings.
+* Only insert categories for published posts.
+
+= 0.4.1 =
+* Move SWT admin to its own screen.
+* Added thumbnail support.
+* Added custom taxonomy (including post formats) support.
+* Update admin screens for WordPress 3.1.
+
+= 0.4.0.1 =
+* Bug fix - only push published content to the tags blog
+
+= 0.4 =
+* Added option to include pages in tags blog.
+* Added option to include non search engine indexed blogs if tags blog not indexed.
+* Added option for post meta to be copied with post.
+
+== Upgrade Notice ==
+
+= 1.0.1 =
+* Update for xss vulnerability, https://make.wordpress.org/plugins/2015/04/20/fixing-add_query_arg-and-remove_query_arg-usage
+
 = 1.0.0 =
 * Forked from 'MU Sitewide Tags' and rewritten with OOP principles, WordPress coding standards, and extensibility in mind.
 
 = 0.4.2 =
 * duplicate category fix
@@ -56,5 +92,6 @@ WPCLI is supported:
 
 = 0.4 =
 * Added option to include pages in tags blog.
 * Added option to include non search engine indexed blogs if tags blog not indexed.
 * Added option for post meta to be copied with post.
+
diff --git a/wds-multisite-aggregate.php b/wds-multisite-aggregate.php
index c522519..58c8d38 100644
--- a/wds-multisite-aggregate.php
+++ b/wds-multisite-aggregate.php
@@ -1,11 +1,11 @@
 <?php
 /*
 Plugin Name: WDS Multisite Aggregate
 Plugin URI: https://github.com/WebDevStudios/WDS-Multisite-Aggregate
 Description: Creates a blog where all the most recent posts on a WordPress network may be found. Based on WordPress MU Sitewide Tags Pages plugin by Donncha O Caoimh. WP-CLI: `wp multisite_aggregate --help`.
-Version: 1.0.0
+Version: 1.0.1
 Author: WebDevStudios
 Author URI: http://webdevstudios.com
 */
 /*  Copyright 2008 Donncha O Caoimh (http://ocaoimh.ie/)
     With contributions by Ron Rennick(http://wpmututorials.com/), Thomas Schneider(http://www.im-web-gefunden.de/) and others.

Vulnerable code: 			wp_redirect( add_query_arg( array( 'updated' => '1' ) ) );
		wp_redirect( add_query_arg( array( 'updated' => '1' ) ) );
**Tested up to:** 3.8.1  
**Stable tag:** 1.0.0  
Tested up to: 3.8.1
Stable tag: 1.0.0
Version: 1.0.0
Fixed code: 			wp_redirect( esc_url_raw( add_query_arg( array( 'updated' => '1' ) ) ) );
		wp_redirect( esc_url_raw( add_query_arg( array( 'updated' => '1' ) ) ) );
**Tested up to:** 4.2  
**Stable tag:** 1.0.1  
### 1.0.1 ###
* Update for xss vulnerability, https://make.wordpress.org/plugins/2015/04/20/fixing-add_query_arg-and-remove_query_arg-usage

Tested up to: 4.2
Stable tag: 1.0.1
= 1.0.1 =
* Update for xss vulnerability, https://make.wordpress.org/plugins/2015/04/20/fixing-add_query_arg-and-remove_query_arg-usage

= 1.0.0 =
* Forked from 'MU Sitewide Tags' and rewritten with OOP principles, WordPress coding standards, and extensibility in mind.

= 0.4.2 =
* duplicate category fix
* page permalink fix
* thumbnail size filter

= 0.4.1.1 =
* Run populate feature in source blog context.
* Added resource warning for populate feature.
* Fixed PHP warnings.
* Only insert categories for published posts.

= 0.4.1 =
* Move SWT admin to its own screen.
* Added thumbnail support.
* Added custom taxonomy (including post formats) support.
* Update admin screens for WordPress 3.1.

= 0.4.0.1 =
* Bug fix - only push published content to the tags blog

= 0.4 =
* Added option to include pages in tags blog.
* Added option to include non search engine indexed blogs if tags blog not indexed.
* Added option for post meta to be copied with post.

== Upgrade Notice ==

= 1.0.1 =
* Update for xss vulnerability, https://make.wordpress.org/plugins/2015/04/20/fixing-add_query_arg-and-remove_query_arg-usage


Version: 1.0.1