CVE-2015-10127: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in PlusCaptcha Plugin up to 2.0.6 on WordPress and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.0.14 is able to address this issue. The patch is identified as 1274afc635170daafd38306487b6bb8a01f78ecd. It is recommended to upgrade the affected component. VDB-248954 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-12-26T17:15Z
Repository: https://github.com/wp-plugins/pluscaptcha
Language: PHP
Files changed: PlusCaptcha.php, external/comment-form-inline-errors.php, library/admin.php, library/public.php, library/shortcode-and-others.php, readme.txt, template/admin-options-contactform.php, template/admin-options.php, template/admin-register.php
Commit date: 2015-02-19 12:22:01 +0000
Commit message: Solver XSS

git-svn-id: https://plugins.svn.wordpress.org/pluscaptcha/trunk@1094241 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/PlusCaptcha.php b/PlusCaptcha.php
index a62698f..7cbe660 100644
--- a/PlusCaptcha.php
+++ b/PlusCaptcha.php
@@ -1,11 +1,11 @@
 <?php
 /*
 Plugin Name: PlusCaptcha
 Plugin URI: http://www.pluscaptcha.com/
 Description: The Easiest Captcha to Setup and Execute, with Auto-Setup Feature! Forget ugly and complicated captchas! Unique! <strong>TRUSTED BY +27 THOUSAND OF WEBSITES, BLOGS, E-COMMERCE AND GOVERNMENT SITES AROUND WORLD WIDE!</strong> Free Full Service with <strong>24/7 emergency support</strong> ( <a href="mailto:emergency@pluscaptcha.com">emergency@pluscaptcha.com</a> ) plus, with continuously updates and support! Questions? <a href="http://www.pluscaptcha.com/contacto">contact us!</a>
-Version: 2.0.6
+Version: 2.0.14
 Author: PlusCaptcha
 Author URI: http://www.pluscaptcha.com/
 License: GNU GPL2
 */
 /*
@@ -27,10 +27,22 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 /*
 	For Irina Luchinetz & Igor Borovskoy. I'm not sure about if I could finish this project without their support. My infinite thanks to them! Thanks for make this dream possible, I know about you couldn't help to me like you would like, but this untidy house with infinite love is all I need, all everyone needs...
 		- Denis, CEO PlusCaptcha
 */
 
+if (!function_exists('tags')) {
+	# Clean
+	# Limpiar data
+	function tags($tags){  
+		$tags = strip_tags($tags);  
+		$tags = stripslashes($tags);  
+		$tags = htmlentities($tags);
+		$tags = addslashes($tags);
+		return trim($tags);  
+	}
+}
+
 /* Ocultar errores */
 require_once(ABSPATH . 'wp-settings.php');
 error_reporting(0);
 /* *************** */
 
diff --git a/external/comment-form-inline-errors.php b/external/comment-form-inline-errors.php
index 0281798..2ac2ba6 100644
--- a/external/comment-form-inline-errors.php
+++ b/external/comment-form-inline-errors.php
@@ -45,20 +45,20 @@ if (!class_exists('wpCommentFormInlineErrors')){
          * @param array $args
          */
 
         function handleWpError($message, $title='', $args=array())
         {
-            if(!is_admin() && !empty($_POST['comment_post_ID']) && is_numeric($_POST['comment_post_ID'])){
+            if(!is_admin() && tags(!empty($_POST['comment_post_ID'])) && tags(is_numeric($_POST['comment_post_ID']))){
                 $_SESSION['formError'] = $message;
                 $denied = array('submit', 'comment_post_ID', 'comment_parent');
                 foreach($_POST as $key => $value){
                     if(!in_array($key, $denied)){
                         $_SESSION['formFields'][$key] = stripslashes($value);
                     }
                 }
                 session_write_close();
-                wp_safe_redirect(get_permalink($_POST['comment_post_ID']) . '#formError', 302);
+                wp_safe_redirect(get_permalink(tags($_POST['comment_post_ID'])) . '#formError', 302);
                 exit;
             } else {
                 _default_wp_die_handler($message, $title, $args);
             }
         }
diff --git a/library/admin.php b/library/admin.php
index 54f9b09..fdeb7cd 100644
--- a/library/admin.php
+++ b/library/admin.php
@@ -1,16 +1,18 @@
 <?php
 
-# Clean
-# Limpiar data
-function tags($tags){  
-	$tags = strip_tags($tags);  
-	$tags = stripslashes($tags);  
-	$tags = htmlentities($tags);
-	$tags = addslashes($tags);
-	return trim($tags);  
-} 
+if (!function_exists('tags')) {
+	# Clean
+	# Limpiar data
+	function tags($tags){  
+		$tags = strip_tags($tags);  
+		$tags = stripslashes($tags);  
+		$tags = htmlentities($tags);
+		$tags = addslashes($tags);
+		return trim($tags);  
+	}
+}
 
 tags($_REQUEST);
 tags($_POST);
 tags($_GET);
 
@@ -106,19 +108,19 @@ function PlusCaptcha_register_form() {
   $hidden_field_name = 'mt_submit_hidden';
   $form_html = 'Could not load registration form.';
   //var_export($_POST);
   // See if the user has posted us some information
   // If they did, this hidden field will be set to 'Y'
-  if ((isset($_POST[$hidden_field_name])) && ($_POST[$hidden_field_name] == 'Y')) {
+  if ((tags(isset($_POST[$hidden_field_name]))) && (tags($_POST[$hidden_field_name]) == 'Y')) {
     $result = json_decode(submit_register_form($_POST), true);
     if ($result['error']) {
       if (!empty($result['html'])) {
         $form_html = $result['html'];
       }
     } else {
       update_option('uuid_key_speci_to_generate_captchas', $result['app_id']);
-	  update_option('PlusCaptcha_feedback_quemejoraria', $_POST["PlusCaptcha_feedback_quemejoraria"]);
+	  update_option('PlusCaptcha_feedback_quemejoraria', tags($_POST["PlusCaptcha_feedback_quemejoraria"]));
       //update_option('PlusCaptcha_key', $result['key']);
       //update_option('PlusCaptcha_secret', $result['secret']);
 
       // Load the main options page, and ignore the post data (since it's missing all the options!).
       sweetcatpcha_main_settings(true);
@@ -134,36 +136,36 @@ function PlusCaptcha_register_form() {
   } else {
     //$form_html = $PlusCaptcha_instance->get_register_form();
 	$form_html = "NONE";
   }
   // Fill Register Form fields
-  $website = json_encode(empty($_POST['website']) ? "http://{$_SERVER['SERVER_NAME']}/" : $_POST['website']);
-  $email = json_encode($_POST['email']);
+  $website = json_encode(tags(empty($_POST['website'])) ? "http://{".tags($_SERVER['SERVER_NAME'])."}/" : tags($_POST['website']));
+  $email = json_encode(tags($_POST['email']));
   
   //jQuery('<div><input type="text" class="field" name="dynamic[]" value="' + i + '" /></div>').fadeIn('slow').appendTo('.inputs');
   $form_html .= "<script type=\"text/javascript\" language=\"javascript\">\n";
   $form_html .= "    jQuery('input[name=website]').addClass('requiredField');\n";
   $form_html .= "    jQuery('input[name=email]').addClass('requiredField');\n";
   $form_html .= "    jQuery('select[name=site_category]').addClass('requiredField');\n";
     
   $form_html .= "    jQuery('input[name=website]').val($website);\n";
   $form_html .= "    jQuery('input[name=email]').val($email);\n";
 
-  if (isset($_POST['language'])) {
-    $language = (int) $_POST['language'];
+  if (tags(isset($_POST['language']))) {
+    $language = (int) tags($_POST['language']);
     $form_html .= "    jQuery('select[name=language]').val($language);\n";
   }
-  if (isset($_POST['category'])) {
-    $category = (int) $_POST['category'];
+  if (tags(isset($_POST['category']))) {
+    $category = (int) tags($_POST['category']);
     $form_html .= "    jQuery('select[name=category]').val($category);\n";
   }
-  if (isset($_POST['site_category'])) {
-    $site_category = (int) $_POST['site_category'];
+  if (tags(isset($_POST['site_category']))) {
+    $site_category = (int) tags($_POST['site_category']);
     $form_html .= "    jQuery('select[name=site_category]').val($site_category);\n";
   }
-  if (isset($_POST['gender'])) {
-    $gender = (int) $_POST['gender'];
+  if (tags(isset($_POST['gender']))) {
+    $gender = (int) tags($_POST['gender']);
     $form_html .= "    jQuery('select[name=gender]').val($gender);\n";
   }
   $form_html .= "</script>\n";
   
   $form_html = preg_replace('/category:/', 'PlusCaptcha design:', $form_html);
@@ -207,16 +209,16 @@ function sweetcatpcha_main_settings($ignore_post = false) {
 
   PlusCaptcha_contactform_settings();
 
   // See if the user has posted us some information
   // If they did, this hidden field will be set to 'Y'
-  if ((!$ignore_post) && (isset($_POST[$hidden_field_name])) && ($_POST[$hidden_field_name] == 'Y')) {
+  if ((!$ignore_post) && (tags(isset($_POST[$hidden_field_name]))) && (tags($_POST[$hidden_field_name]) == 'Y')) {
     $rs = TRUE;
 
     // Read their posted value
     foreach ($PlusCaptcha_options as $opt_name => $v) {
-      $opt_val = isset($_POST[$opt_name]) ? $_POST[$opt_name] : null;
+      $opt_val = tags(isset($_POST[$opt_name])) ? tags($_POST[$opt_name]) : null;
 
       // Save the posted value in the database
       update_option($opt_name, $opt_val);
     }
 
@@ -284,14 +286,14 @@ function PlusCaptcha_contactform_settings() {
 function plscptf_settings_save() {
   global $plscptf_options, $wpdb, $error;
   $userslogin = $wpdb->get_col("SELECT user_login FROM  $wpdb->users ", 0);
   $plscptf_options_submit = array();
   // Save data for settings page
-  $plscptf_options_submit['plscptf_user_email'] = $_REQUEST['plscptf_user_email'];
-  $plscptf_options_submit['plscptf_custom_email'] = $_REQUEST['plscptf_custom_email'];
-  $plscptf_options_submit['plscptf_select_email'] = $_REQUEST['plscptf_select_email'];
-  $plscptf_options_submit['plscptf_additions_options'] = isset($_REQUEST['plscptf_additions_options']) ? $_REQUEST['plscptf_additions_options'] : 0;
+  $plscptf_options_submit['plscptf_user_email'] = tags($_REQUEST['plscptf_user_email']);
+  $plscptf_options_submit['plscptf_custom_email'] = tags($_REQUEST['plscptf_custom_email']);
+  $plscptf_options_submit['plscptf_select_email'] = tags($_REQUEST['plscptf_select_email']);
+  $plscptf_options_submit['plscptf_additions_options'] = tags(isset($_REQUEST['plscptf_additions_options'])) ? tags($_REQUEST['plscptf_additions_options']) : 0;
   if ($plscptf_options_submit['plscptf_additions_options'] == 0) {
     $plscptf_options_submit['plscptf_send_copy'] = 0;
     $plscptf_options_submit['plscptf_from_field'] = get_bloginfo('name');
     $plscptf_options_submit['plscptf_display_add_info'] = 1;
     $plscptf_options_submit['plscptf_display_sent_from'] = 1;
@@ -306,40 +308,40 @@ function plscptf_settings_save() {
     $plscptf_options_submit['plscptf_message_label'] = __("Message:", 'PlusCaptcha');
     $plscptf_options_submit['plscptf_action_after_send'] = 1;
     $plscptf_options_submit['plscptf_thank_text'] = __("Thank you for contacting us.", 'PlusCaptcha');
     $plscptf_options_submit['plscptf_redirect_url'] = '';
   } else {
-    $plscptf_options_submit['plscptf_send_copy'] = isset($_REQUEST['plscptf_send_copy']) ? $_REQUEST['plscptf_send_copy'] : 0;
-    $plscptf_options_submit['plscptf_mail_method'] = $_REQUEST['plscptf_mail_method'];
-    $plscptf_options_submit['plscptf_from_field'] = $_REQUEST['plscptf_from_field'];
-    $plscptf_options_submit['plscptf_display_add_info'] = isset($_REQUEST['plscptf_display_add_info']) ? 1 : 0;
-    $plscptf_options_submit['plscptf_change_label'] = isset($_REQUEST['plscptf_change_label']) ? 1 : 0;
+    $plscptf_options_submit['plscptf_send_copy'] = tags(isset($_REQUEST['plscptf_send_copy'])) ? tags($_REQUEST['plscptf_send_copy']) : 0;
+    $plscptf_options_submit['plscptf_mail_method'] = tags($_REQUEST['plscptf_mail_method']);
+    $plscptf_options_submit['plscptf_from_field'] = tags($_REQUEST['plscptf_from_field']);
+    $plscptf_options_submit['plscptf_display_add_info'] = tags(isset($_REQUEST['plscptf_display_add_info'])) ? 1 : 0;
+    $plscptf_options_submit['plscptf_change_label'] = tags(isset($_REQUEST['plscptf_change_label'])) ? 1 : 0;
     if ($plscptf_options_submit['plscptf_display_add_info'] == 1) {
-      $plscptf_options_submit['plscptf_display_sent_from'] = isset($_REQUEST['plscptf_display_sent_from']) ? 1 : 0;
-      $plscptf_options_submit['plscptf_display_date_time'] = isset($_REQUEST['plscptf_display_date_time']) ? 1 : 0;
-      $plscptf_options_submit['plscptf_display_coming_from'] = isset($_REQUEST['plscptf_display_coming_from']) ? 1 : 0;
-      $plscptf_options_submit['plscptf_display_user_agent'] = isset($_REQUEST['plscptf_display_user_agent']) ? 1 : 0;
+      $plscptf_options_submit['plscptf_display_sent_from'] = tags(isset($_REQUEST['plscptf_display_sent_from'])) ? 1 : 0;
+      $plscptf_options_submit['plscptf_display_date_time'] = tags(isset($_REQUEST['plscptf_display_date_time'])) ? 1 : 0;
+      $plscptf_options_submit['plscptf_display_coming_from'] = tags(isset($_REQUEST['plscptf_display_coming_from'])) ? 1 : 0;
+      $plscptf_options_submit['plscptf_display_user_agent'] = tags(isset($_REQUEST['plscptf_display_user_agent'])) ? 1 : 0;
     } else {
       $plscptf_options_submit['plscptf_display_sent_from'] = 1;
       $plscptf_options_submit['plscptf_display_date_time'] = 1;
       $plscptf_options_submit['plscptf_display_coming_from'] = 1;
       $plscptf_options_submit['plscptf_display_user_agent'] = 1;
     }
     if ($plscptf_options_submit['plscptf_change_label'] == 1) {
-      $plscptf_options_submit['plscptf_name_label'] = isset($_REQUEST['plscptf_name_label']) ? $_REQUEST['plscptf_name_label'] : $plscptf_options_submit['plscptf_name_label'];
-      $plscptf_options_submit['plscptf_email_label'] = isset($_REQUEST['plscptf_email_label']) ? $_REQUEST['plscptf_email_label'] : $plscptf_options_submit['plscptf_email_label'];
-      $plscptf_options_submit['plscptf_subject_label'] = isset($_REQUEST['plscptf_subject_label']) ? $_REQUEST['plscptf_subject_label'] : $plscptf_options_submit['plscptf_subject_label'];
-      $plscptf_options_submit['plscptf_message_label'] = isset($_REQUEST['plscptf_message_label']) ? $_REQUEST['plscptf_message_label'] : $plscptf_options_submit['plscptf_message_label'];
+      $plscptf_options_submit['plscptf_name_label'] = tags(isset($_REQUEST['plscptf_name_label'])) ? tags($_REQUEST['plscptf_name_label']) : $plscptf_options_submit['plscptf_name_label'];
+      $plscptf_options_submit['plscptf_email_label'] = tags(isset($_REQUEST['plscptf_email_label'])) ? tags($_REQUEST['plscptf_email_label']) : $plscptf_options_submit['plscptf_email_label'];
+      $plscptf_options_submit['plscptf_subject_label'] = tags(isset($_REQUEST['plscptf_subject_label'])) ? tags($_REQUEST['plscptf_subject_label']) : $plscptf_options_submit['plscptf_subject_label'];
+      $plscptf_options_submit['plscptf_message_label'] = tags(isset($_REQUEST['plscptf_message_label'])) ? tags($_REQUEST['plscptf_message_label']) : $plscptf_options_submit['plscptf_message_label'];
     } else {
       $plscptf_options_submit['plscptf_name_label'] = __("Name:", 'PlusCaptcha');
       $plscptf_options_submit['plscptf_email_label'] = __("E-Mail Address:", 'PlusCaptcha');
       $plscptf_options_submit['plscptf_subject_label'] = __("Subject:", 'PlusCaptcha');
       $plscptf_options_submit['plscptf_message_label'] = __("Message:", 'PlusCaptcha');
     }
-    $plscptf_options_submit['plscptf_action_after_send'] = $_REQUEST['plscptf_action_after_send'];
-    $plscptf_options_submit['plscptf_thank_text'] = $_REQUEST['plscptf_thank_text'];
-    $plscptf_options_submit['plscptf_redirect_url'] = $_REQUEST['plscptf_redirect_url'];
+    $plscptf_options_submit['plscptf_action_after_send'] = tags($_REQUEST['plscptf_action_after_send']);
+    $plscptf_options_submit['plscptf_thank_text'] = tags($_REQUEST['plscptf_thank_text']);
+    $plscptf_options_submit['plscptf_redirect_url'] = tags($_REQUEST['plscptf_redirect_url']);
   }
   $plscptf_options = array_merge($plscptf_options, $plscptf_options_submit);
   if ($plscptf_options_submit['plscptf_action_after_send'] == 0
           && ( trim($plscptf_options_submit['plscptf_redirect_url']) == ""
           || !preg_match('@^(?:http://)?([^/]+)@i', trim($plscptf_options_submit['plscptf_redirect_url'])) )) {
@@ -355,11 +357,11 @@ function plscptf_settings_save() {
       $message = __("Options saved.", 'PlusCaptcha');
     } else {
       $error .=__("Such user does not exist. Settings not saved.", 'PlusCaptcha');
     }
   } else {
-    if ( isset($_REQUEST['PlusCaptcha_form_contact']) ) {
+    if ( tags(isset($_REQUEST['PlusCaptcha_form_contact'])) ) {
       if ($plscptf_options_submit['plscptf_custom_email'] != "" && preg_match("/^((?:[a-z0-9]+(?:[a-z0-9\-_\.]+)?@[a-z0-9]+(?:[a-z0-9\-\.]+)?\.[a-z]{2,5})[, ]*)+$/i", trim($plscptf_options_submit['plscptf_custom_email']))) {
         update_option('PlusCaptcha_form_contact_options', $plscptf_options, '', 'yes');
       $message = __("Options saved.", 'PlusCaptcha');
       } else {
         $error .= __("Please input correct email. Settings not saved.", 'PlusCaptcha');
diff --git a/library/public.php b/library/public.php
index 9e185e0..bb5ad14 100644
--- a/library/public.php
+++ b/library/public.php
@@ -1,15 +1,27 @@
 <?php
 
+if (!function_exists('tags')) {
+	# Clean
+	# Limpiar data
+	function tags($tags){  
+		$tags = strip_tags($tags);  
+		$tags = stripslashes($tags);  
+		$tags = htmlentities($tags);
+		$tags = addslashes($tags);
+		return trim($tags);  
+	}
+}
+
 /**
  * Get PlusCaptcha values from POST data
  * @return array
  */
 function PlusCaptcha_get_values() {
 	return array(
-		'sckey'		=> ( isset( $_POST[ 'sckey' ] ) ? $_POST[ 'sckey' ] : '' ),
-		'scvalue'	=> ( isset( $_POST[ 'scvalue' ] ) ? $_POST[ 'scvalue' ] : '' )
+		'sckey'		=> ( tags( isset( $_POST[ 'sckey' ]) ) ? tags($_POST[ 'sckey' ]) : '' ),
+		'scvalue'	=> ( tags( isset( $_POST[ 'scvalue' ]) ) ? tags($_POST[ 'scvalue' ]) : '' )
 	);
 }
 
 function get_result($entrada,$shortcode=false) {
 
@@ -258,11 +270,11 @@ function PlusCaptcha_registration_form() {
  * @return WP_Error
  */
 function PlusCaptcha_authenticate($user) {
 	global $PlusCaptcha_instance;
 	//$scValues = PlusCaptcha_get_values();
-	if ( !empty( $_POST ) && get_result(simpleSessionGet("contacto", "")) == false ) {
+	if (  tags( !empty( $_POST ) ) && get_result(simpleSessionGet("contacto", "")) == false ) {
 		$user = new WP_Error( 'captcha_wrong', '<strong>' . __( 'ERROR', 'PlusCaptcha' ) . '</strong>: ' . __( PlusCaptcha_ERROR_MESSAGE, 'PlusCaptcha' ) );
 	}else{
 		//$_SESSION["passport"] = false;
 	}
 	return $user;
@@ -351,11 +363,11 @@ function PlusCaptcha_signup_extra_fields($errors) {
  * @param $errors
  * @return mixed
  */
 function PlusCaptcha_wpmu_validate_user_signup($errors) {
 	global $PlusCaptcha_instance;
-	if ( $_POST['stage'] == 'validate-user-signup' ) {
+	if ( tags($_POST['stage']) == 'validate-user-signup' ) {
 		//$scValues = PlusCaptcha_get_values();
 		if ( get_result(simpleSessionGet("contacto", "")) == false ) {
 			$errors['errors']->add( 'captcha_wrong', '<strong>' . __( 'ERROR', 'PlusCaptcha' ) . '</strong>: ' . __(PlusCaptcha_ERROR_MESSAGE, 'PlusCaptcha' ) );
 		}else{
 			//$_SESSION["passport"] = false;
diff --git a/library/shortcode-and-others.php b/library/shortcode-and-others.php
index 793bb02..43f8482 100644
--- a/library/shortcode-and-others.php
+++ b/library/shortcode-and-others.php
@@ -1,16 +1,18 @@
 <?php
 
-# Clean
-# Limpiar data
-function tags($tags){  
-	$tags = strip_tags($tags);  
-	$tags = stripslashes($tags);  
-	$tags = htmlentities($tags);
-	$tags = addslashes($tags);
-	return trim($tags);  
-} 
+if (!function_exists('tags')) {
+	# Clean
+	# Limpiar data
+	function tags($tags){  
+		$tags = strip_tags($tags);  
+		$tags = stripslashes($tags);  
+		$tags = htmlentities($tags);
+		$tags = addslashes($tags);
+		return trim($tags);  
+	}
+}
 
 tags($_REQUEST);
 tags($_POST);
 tags($_GET);
 
@@ -20,17 +22,17 @@ if (!function_exists('plscptf_display_form')) {
   function plscptf_display_form() {
     global $error_message, $plscptf_options, $result;
     $plscptf_options = get_option('PlusCaptcha_form_contact_options');
     $content = "";
 
-    $page_url = ( isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] == "on" ? "https://" : "http://" ) . $_SERVER["SERVER_NAME"] . $_SERVER["REQUEST_URI"];
+    $page_url = ( tags(isset($_SERVER["HTTPS"])) && tags($_SERVER["HTTPS"]) == "on" ? "https://" : "http://" ) . tags($_SERVER["SERVER_NAME"]) . tags($_SERVER["REQUEST_URI"]);
     // If contact form submited
-    $name = isset($_REQUEST['plscptf_contact_name']) ? $_REQUEST['plscptf_contact_name'] : "";
-    $email = isset($_REQUEST['plscptf_contact_email']) ? $_REQUEST['plscptf_contact_email'] : "";
-    $subject = isset($_REQUEST['plscptf_contact_subject']) ? $_REQUEST['plscptf_contact_subject'] : "";
-    $message = isset($_REQUEST['plscptf_contact_message']) ? $_REQUEST['plscptf_contact_message'] : "";
-    $send_copy = isset($_REQUEST['plscptf_contact_send_copy']) ? $_REQUEST['plscptf_contact_send_copy'] : "";
+    $name = tags(isset($_REQUEST['plscptf_contact_name'])) ? tags($_REQUEST['plscptf_contact_name']) : "";
+    $email = tags(isset($_REQUEST['plscptf_contact_email'])) ? tags($_REQUEST['plscptf_contact_email']) : "";
+    $subject = tags(isset($_REQUEST['plscptf_contact_subject'])) ? tags($_REQUEST['plscptf_contact_subject']) : "";
+    $message = tags(isset($_REQUEST['plscptf_contact_message'])) ? tags($_REQUEST['plscptf_contact_message']) : "";
+    $send_copy = tags(isset($_REQUEST['plscptf_contact_send_copy'])) ? tags($_REQUEST['plscptf_contact_send_copy']) : "";
     // If it is good
     if (true === $result) {
       $_SESSION['plscptf_send_mail'] = true;
       if ($plscptf_options['plscptf_action_after_send'] == 1)
         $content .= $plscptf_options['plscptf_thank_text'];
@@ -114,11 +116,11 @@ if (!function_exists('plscptf_check_and_send')) {
 
   function plscptf_check_and_send() {
     //die ('plscptf_check_and_send'); 
     global $result;
     $plscptf_options = get_option('PlusCaptcha_form_contact_options');
-    if (isset($_REQUEST['plscptf_contact_action'])) {
+    if (tags(isset($_REQUEST['plscptf_contact_action']))) {
       // Check all input data
       $result = plscptf_check_form();
     }
     if (true === $result) { // OK
       $_SESSION['plscptf_send_mail'] = true;
@@ -145,17 +147,17 @@ if (!function_exists('plscptf_check_form')) {
     $error_message['error_email'] = __("Please input your e-mail address.", 'PlusCaptcha');
     $error_message['error_subject'] = __("Subject required.", 'PlusCaptcha');
     $error_message['error_message'] = __("Message text required.", 'PlusCaptcha');
     $error_message['error_form'] = __("Please correct your input data below and try again.", 'PlusCaptcha');
     // Check information
-    if ("" != $_REQUEST['plscptf_contact_name'])
+    if ("" != tags($_REQUEST['plscptf_contact_name']))
       unset($error_message['error_name']);
-    if ("" != $_REQUEST['plscptf_contact_email'] && preg_match("/^(?:[a-z0-9]+(?:[a-z0-9\-_\.]+)?@[a-z0-9]+(?:[a-z0-9\-\.]+)?\.[a-z]{2,5})$/i", trim($_REQUEST['plscptf_contact_email'])))
+    if ("" != tags($_REQUEST['plscptf_contact_email']) && preg_match("/^(?:[a-z0-9]+(?:[a-z0-9\-_\.]+)?@[a-z0-9]+(?:[a-z0-9\-\.]+)?\.[a-z]{2,5})$/i", tags(trim($_REQUEST['plscptf_contact_email']))))
       unset($error_message['error_email']);
-    if ("" != $_REQUEST['plscptf_contact_subject'])
+    if ("" != tags($_REQUEST['plscptf_contact_subject']))
       unset($error_message['error_subject']);
-    if ("" != $_REQUEST['plscptf_contact_message'])
+    if ("" != tags($_REQUEST['plscptf_contact_message']))
       unset($error_message['error_message']);
     
     PlusCaptcha_validate_contact_form($error_message);
 
     if (1 == count($error_message)) { // OK
@@ -189,36 +191,36 @@ if (!function_exists('plscptf_send_mail')) {
       // If email options are not certain choose admin email
       $to = get_option("admin_email");
     }
     if ("" != $to) {
       // subject
-      $subject = $_REQUEST['plscptf_contact_subject'];
+      $subject = tags($_REQUEST['plscptf_contact_subject']);
       $user_info_string = '';
       $userdomain = '';
       $form_action_url = '';
       $attachments = array();
       $headers = "";
 
       if (getenv('HTTPS') == 'on') {
-        $form_action_url = 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
+        $form_action_url = 'https://' . tags($_SERVER['HTTP_HOST']) . tags($_SERVER['REQUEST_URI']);
       } else {
-        $form_action_url = 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
+        $form_action_url = 'http://' . tags($_SERVER['HTTP_HOST']) . tags($_SERVER['REQUEST_URI']);
       }
 
       if ($plscptf_options['plscptf_display_add_info'] == 1) {
-        $userdomain = gethostbyaddr($_SERVER['REMOTE_ADDR']);
+        $userdomain = gethostbyaddr(tags($_SERVER['REMOTE_ADDR']));
         if ($plscptf_options['plscptf_display_add_info'] == 1 ||
                 $plscptf_options['plscptf_display_sent_from'] == 1 ||
                 $plscptf_options['plscptf_display_coming_from'] == 1 ||
                 $plscptf_options['plscptf_display_user_agent'] == 1) {
           $user_info_string .= '<tr>
 							<td><br /></td><td><br /></td>
 						</tr>';
         }
         if ($plscptf_options['plscptf_display_sent_from'] == 1) {
           $user_info_string .= '<tr>
-							<td>' . __('Sent from (ip address)', 'PlusCaptcha') . ':</td><td>' . $_SERVER['REMOTE_ADDR'] . " ( " . $userdomain . " )" . '</td>
+							<td>' . __('Sent from (ip address)', 'PlusCaptcha') . ':</td><td>' . tags($_SERVER['REMOTE_ADDR']) . " ( " . $userdomain . " )" . '</td>
 						</tr>';
         }
         if ($plscptf_options['plscptf_display_date_time'] == 1) {
           $user_info_string .= '<tr>
 							<td>' . __('Date/Time', 'PlusCaptcha') . ':</td><td>' . date_i18n(get_option('date_format') . ' ' . get_option('time_format'), strtotime(current_time('mysql'))) . '</td>
@@ -229,11 +231,11 @@ if (!function_exists('plscptf_send_mail')) {
 							<td>' . __('Coming from (referer)', 'PlusCaptcha') . ':</td><td>' . $form_action_url . '</td>
 						</tr>';
         }
         if ($plscptf_options['plscptf_display_user_agent'] == 1) {
           $user_info_string .= '<tr>
-							<td>' . __('Using (user agent)', 'PlusCaptcha') . ':</td><td>' . plscptf_clean_input($_SERVER['HTTP_USER_AGENT']) . '</td>
+							<td>' . __('Using (user agent)', 'PlusCaptcha') . ':</td><td>' . plscptf_clean_input(tags($_SERVER['HTTP_USER_AGENT'])) . '</td>
 						</tr>';
         }
       }
       // message
       $message = '
@@ -242,20 +244,20 @@ if (!function_exists('plscptf_send_mail')) {
 				<title>' . __("Contact from", 'PlusCaptcha') . get_bloginfo('name') . '</title>
 			</head>
 			<body>
 				<table>
 					<tr>
-						<td width="160">' . __("Name", 'PlusCaptcha') . '</td><td>' . $_REQUEST['plscptf_contact_name'] . '</td>
+						<td width="160">' . __("Name", 'PlusCaptcha') . '</td><td>' . tags($_REQUEST['plscptf_contact_name']) . '</td>
 					</tr>
 					<tr>
-						<td>' . __("Email", 'PlusCaptcha') . '</td><td>' . $_REQUEST['plscptf_contact_email'] . '</td>
+						<td>' . __("Email", 'PlusCaptcha') . '</td><td>' . tags($_REQUEST['plscptf_contact_email']) . '</td>
 					</tr>
 					<tr>
-						<td>' . __("Subject", 'PlusCaptcha') . '</td><td>' . $_REQUEST['plscptf_contact_subject'] . '</td>
+						<td>' . __("Subject", 'PlusCaptcha') . '</td><td>' . tags($_REQUEST['plscptf_contact_subject']) . '</td>
 					</tr>
 					<tr>
-						<td>' . __("Message", 'PlusCaptcha') . '</td><td>' . $_REQUEST['plscptf_contact_message'] . '</td>
+						<td>' . __("Message", 'PlusCaptcha') . '</td><td>' . tags($_REQUEST['plscptf_contact_message']) . '</td>
 					</tr>
 					<tr>
 						<td>' . __("Site", 'PlusCaptcha') . '</td><td>' . get_bloginfo("url") . '</td>
 					</tr>
 					<tr>
@@ -270,26 +272,26 @@ if (!function_exists('plscptf_send_mail')) {
         // To send HTML mail, the Content-type header must be set
         $headers = 'MIME-Version: 1.0' . "\r\n";
         $headers .= 'Content-type: text/html; charset=utf-8' . "\r\n";
 
         // Additional headers
-        $headers .= 'From: ' . $_REQUEST['plscptf_contact_email'] . "\r\n";
-        if (isset($_REQUEST['plscptf_contact_send_copy']) && $_REQUEST['plscptf_contact_send_copy'] == 1)
-          wp_mail($_REQUEST['plscptf_contact_email'], stripslashes($subject), stripslashes($message), $headers, $attachments);
+        $headers .= 'From: ' . tags($_REQUEST['plscptf_contact_email']) . "\r\n";
+        if (tags(isset($_REQUEST['plscptf_contact_send_copy'])) && tags($_REQUEST['plscptf_contact_send_copy']) == 1)
+          wp_mail(tags($_REQUEST['plscptf_contact_email']), stripslashes($subject), stripslashes($message), $headers, $attachments);
 
         // Mail it
         return wp_mail($to, stripslashes($subject), stripslashes($message), $headers, $attachments);
       }
       else {
         // HTML e-mail, we should set Content-type header
         $headers = 'MIME-Version: 1.0' . "\r\n";
         $headers .= 'Content-type: text/html; charset=utf-8' . "\r\n";
 
         // Additional headers
-        $headers .= 'From: ' . $_REQUEST['plscptf_contact_email'] . "\r\n";
-        if (isset($_REQUEST['plscptf_contact_send_copy']) && $_REQUEST['plscptf_contact_send_copy'] == 1)
-          @mail($_REQUEST['plscptf_contact_email'], stripslashes($subject), stripslashes($message), $headers);
+        $headers .= 'From: ' . tags($_REQUEST['plscptf_contact_email']) . "\r\n";
+        if (tags(isset($_REQUEST['plscptf_contact_send_copy'])) && tags($_REQUEST['plscptf_contact_send_copy']) == 1)
+          @mail(tags($_REQUEST['plscptf_contact_email']), stripslashes($subject), stripslashes($message), $headers);
 
         return @mail($to, stripslashes($subject), stripslashes($message), $headers);
       }
     }
     return false;
diff --git a/readme.txt b/readme.txt
index 9133e61..fbcfa63 100644
--- a/readme.txt
+++ b/readme.txt
@@ -1,8 +1,8 @@
 === PlusCaptcha ===
 Contributors: PlusCaptcha
-Version: 2.0.6
+Version: 2.0.14
 Tags: pluscaptcha, captcha, antispam, comment, catcha, registration, match captcha, lost password, login, spam, images captcha, capcha, captha, ecology, ecoplus, plus, buddypress, contact form 7, sweetcaptcha, text captcha, multilingual, register, admin, ajax, image, images, keycaptcha, plugin, post, akismet, wpmu, re captcha, recaptcha, wordpress captcha, picture captcha
 Requires at least: 3.0.0
 Tested up to: 4.0.0
 Stable tag: trunk
 
@@ -131,10 +131,13 @@ At this point, **your account was created automatically (NEW FEATURE!) and you d
 * Wordpress more than 2.8
 * Outside connection hosting by fopen().
 
 == Changelog ==
 
+= 2.0.10 =
+* Cross-site scripting (XSS) loged user side fixed. Thanks to Carlo Pelliccioni @ Hacktive Security
+
 = 2.0.6 =
 * Fixed security things reported by security.szurek.pl, Thanks!
 
 = 2.0.5 =
 * Padding footer fixed.
@@ -182,10 +185,13 @@ Credits: Mistakes reported to emergency@pluscaptcha.com (Thank to Claude @ Norwo
 * Release version.
 * Do not forget feedback to support[at]pluscaptcha.com.
 
 == Upgrade Notice ==
 
+= 2.0.10 =
+* Cross-site scripting (XSS) loged user side fixed. Thanks to Carlo Pelliccioni @ Hacktive Security
+
 = 2.0.6 =
 * Fixed security things reported by security.szurek.pl, Thanks!
 
 = 1.2.1 =
 Default Hide Backlin to Maintaining Good Aesthetics
diff --git a/template/admin-options-contactform.php b/template/admin-options-contactform.php
index db70ebe..0556c58 100644
--- a/template/admin-options-contactform.php
+++ b/template/admin-options-contactform.php
@@ -1,7 +1,7 @@
 <!-- Additional options in admin PlusCaptcha Settings -->
-<?php 
+<?php
 global $error, $wpdb; 
 $userslogin = $wpdb->get_col("SELECT user_login FROM  $wpdb->users ", 0);
 ?>
 <script type="text/javascript">
 	jQuery(document).ready(function(){
diff --git a/template/admin-options.php b/template/admin-options.php
index 5f68a9b..744e78b 100644
--- a/template/admin-options.php
+++ b/template/admin-options.php
@@ -1,18 +1,30 @@
 <?php
 
+if (!function_exists('tags')) {
+	# Clean
+	# Limpiar data
+	function tags($tags){  
+		$tags = strip_tags($tags);  
+		$tags = stripslashes($tags);  
+		$tags = htmlentities($tags);
+		$tags = addslashes($tags);
+		return trim($tags);  
+	}
+}
+
 $status = @fgets(@fopen("http://www.pluscaptcha.com/status/", 'r'), 4096);
 
 /**
 * Guardar data del blog para mejorar la experiencia
 **/
 
 if( get_option('PlusCaptcha_feedback_quemejoraria', '') != get_option('actual_PlusCaptcha_feedback_quemejoraria', '') )
 {
 	// Enviar feedback
 	$url = 'http://www.pluscaptcha.com/api/wp_log/feedback?'
-		.'quemejorar='.substr(str_replace(".","[dot]",urlencode($_POST["PlusCaptcha_feedback_quemejoraria"])),0,299).
+		.'quemejorar='.substr(str_replace(".","[dot]",urlencode(tags($_POST["PlusCaptcha_feedback_quemejoraria"]))),0,299).
 		'&uuid='.get_option( 'uuid_api_wp_feedback' ).'';
 		@fgets(@fopen($url, 'r'), 4096);
 	// Guardar Feedback en forma local
 	update_option('actual_PlusCaptcha_feedback_quemejoraria', get_option('PlusCaptcha_feedback_quemejoraria', ''));
 }
diff --git a/template/admin-register.php b/template/admin-register.php
index 7e3f74f..195bc1c 100644
--- a/template/admin-register.php
+++ b/template/admin-register.php
@@ -1,5 +1,20 @@
+<?php
+
+if (!function_exists('tags')) {
+	# Clean
+	# Limpiar data
+	function tags($tags){  
+		$tags = strip_tags($tags);  
+		$tags = stripslashes($tags);  
+		$tags = htmlentities($tags);
+		$tags = addslashes($tags);
+		return trim($tags);  
+	}
+}
+
+?>
 <style type="text/css">
 #register_message {
 	margin-bottom: 10px;
 }
 

Vulnerable code: Version: 2.0.6
            if(!is_admin() && !empty($_POST['comment_post_ID']) && is_numeric($_POST['comment_post_ID'])){
                wp_safe_redirect(get_permalink($_POST['comment_post_ID']) . '#formError', 302);
# Clean
# Limpiar data
function tags($tags){  
	$tags = strip_tags($tags);  
	$tags = stripslashes($tags);  
	$tags = htmlentities($tags);
	$tags = addslashes($tags);
	return trim($tags);  
} 
  if ((isset($_POST[$hidden_field_name])) && ($_POST[$hidden_field_name] == 'Y')) {
	  update_option('PlusCaptcha_feedback_quemejoraria', $_POST["PlusCaptcha_feedback_quemejoraria"]);
  $website = json_encode(empty($_POST['website']) ? "http://{$_SERVER['SERVER_NAME']}/" : $_POST['website']);
  $email = json_encode($_POST['email']);
  if (isset($_POST['language'])) {
    $language = (int) $_POST['language'];
  if (isset($_POST['category'])) {
    $category = (int) $_POST['category'];
  if (isset($_POST['site_category'])) {
    $site_category = (int) $_POST['site_category'];
  if (isset($_POST['gender'])) {
    $gender = (int) $_POST['gender'];
  if ((!$ignore_post) && (isset($_POST[$hidden_field_name])) && ($_POST[$hidden_field_name] == 'Y')) {
      $opt_val = isset($_POST[$opt_name]) ? $_POST[$opt_name] : null;
  $plscptf_options_submit['plscptf_user_email'] = $_REQUEST['plscptf_user_email'];
  $plscptf_options_submit['plscptf_custom_email'] = $_REQUEST['plscptf_custom_email'];
  $plscptf_options_submit['plscptf_select_email'] = $_REQUEST['plscptf_select_email'];
  $plscptf_options_submit['plscptf_additions_options'] = isset($_REQUEST['plscptf_additions_options']) ? $_REQUEST['plscptf_additions_options'] : 0;
    $plscptf_options_submit['plscptf_send_copy'] = isset($_REQUEST['plscptf_send_copy']) ? $_REQUEST['plscptf_send_copy'] : 0;
    $plscptf_options_submit['plscptf_mail_method'] = $_REQUEST['plscptf_mail_method'];
    $plscptf_options_submit['plscptf_from_field'] = $_REQUEST['plscptf_from_field'];
    $plscptf_options_submit['plscptf_display_add_info'] = isset($_REQUEST['plscptf_display_add_info']) ? 1 : 0;
    $plscptf_options_submit['plscptf_change_label'] = isset($_REQUEST['plscptf_change_label']) ? 1 : 0;
      $plscptf_options_submit['plscptf_display_sent_from'] = isset($_REQUEST['plscptf_display_sent_from']) ? 1 : 0;
      $plscptf_options_submit['plscptf_display_date_time'] = isset($_REQUEST['plscptf_display_date_time']) ? 1 : 0;
      $plscptf_options_submit['plscptf_display_coming_from'] = isset($_REQUEST['plscptf_display_coming_from']) ? 1 : 0;
      $plscptf_options_submit['plscptf_display_user_agent'] = isset($_REQUEST['plscptf_display_user_agent']) ? 1 : 0;
      $plscptf_options_submit['plscptf_name_label'] = isset($_REQUEST['plscptf_name_label']) ? $_REQUEST['plscptf_name_label'] : $plscptf_options_submit['plscptf_name_label'];
      $plscptf_options_submit['plscptf_email_label'] = isset($_REQUEST['plscptf_email_label']) ? $_REQUEST['plscptf_email_label'] : $plscptf_options_submit['plscptf_email_label'];
      $plscptf_options_submit['plscptf_subject_label'] = isset($_REQUEST['plscptf_subject_label']) ? $_REQUEST['plscptf_subject_label'] : $plscptf_options_submit['plscptf_subject_label'];
      $plscptf_options_submit['plscptf_message_label'] = isset($_REQUEST['plscptf_message_label']) ? $_REQUEST['plscptf_message_label'] : $plscptf_options_submit['plscptf_message_label'];
    $plscptf_options_submit['plscptf_action_after_send'] = $_REQUEST['plscptf_action_after_send'];
    $plscptf_options_submit['plscptf_thank_text'] = $_REQUEST['plscptf_thank_text'];
    $plscptf_options_submit['plscptf_redirect_url'] = $_REQUEST['plscptf_redirect_url'];
    if ( isset($_REQUEST['PlusCaptcha_form_contact']) ) {
		'sckey'		=> ( isset( $_POST[ 'sckey' ] ) ? $_POST[ 'sckey' ] : '' ),
		'scvalue'	=> ( isset( $_POST[ 'scvalue' ] ) ? $_POST[ 'scvalue' ] : '' )
	if ( !empty( $_POST ) && get_result(simpleSessionGet("contacto", "")) == false ) {
	if ( $_POST['stage'] == 'validate-user-signup' ) {
# Clean
# Limpiar data
function tags($tags){  
	$tags = strip_tags($tags);  
	$tags = stripslashes($tags);  
	$tags = htmlentities($tags);
	$tags = addslashes($tags);
	return trim($tags);  
} 
    $page_url = ( isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] == "on" ? "https://" : "http://" ) . $_SERVER["SERVER_NAME"] . $_SERVER["REQUEST_URI"];
    $name = isset($_REQUEST['plscptf_contact_name']) ? $_REQUEST['plscptf_contact_name'] : "";
    $email = isset($_REQUEST['plscptf_contact_email']) ? $_REQUEST['plscptf_contact_email'] : "";
    $subject = isset($_REQUEST['plscptf_contact_subject']) ? $_REQUEST['plscptf_contact_subject'] : "";
    $message = isset($_REQUEST['plscptf_contact_message']) ? $_REQUEST['plscptf_contact_message'] : "";
    $send_copy = isset($_REQUEST['plscptf_contact_send_copy']) ? $_REQUEST['plscptf_contact_send_copy'] : "";
    if (isset($_REQUEST['plscptf_contact_action'])) {
    if ("" != $_REQUEST['plscptf_contact_name'])
    if ("" != $_REQUEST['plscptf_contact_email'] && preg_match("/^(?:[a-z0-9]+(?:[a-z0-9\-_\.]+)?@[a-z0-9]+(?:[a-z0-9\-\.]+)?\.[a-z]{2,5})$/i", trim($_REQUEST['plscptf_contact_email'])))
    if ("" != $_REQUEST['plscptf_contact_subject'])
    if ("" != $_REQUEST['plscptf_contact_message'])
      $subject = $_REQUEST['plscptf_contact_subject'];
        $form_action_url = 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
        $form_action_url = 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
        $userdomain = gethostbyaddr($_SERVER['REMOTE_ADDR']);
							<td>' . __('Sent from (ip address)', 'PlusCaptcha') . ':</td><td>' . $_SERVER['REMOTE_ADDR'] . " ( " . $userdomain . " )" . '</td>
							<td>' . __('Using (user agent)', 'PlusCaptcha') . ':</td><td>' . plscptf_clean_input($_SERVER['HTTP_USER_AGENT']) . '</td>
						<td width="160">' . __("Name", 'PlusCaptcha') . '</td><td>' . $_REQUEST['plscptf_contact_name'] . '</td>
						<td>' . __("Email", 'PlusCaptcha') . '</td><td>' . $_REQUEST['plscptf_contact_email'] . '</td>
						<td>' . __("Subject", 'PlusCaptcha') . '</td><td>' . $_REQUEST['plscptf_contact_subject'] . '</td>
						<td>' . __("Message", 'PlusCaptcha') . '</td><td>' . $_REQUEST['plscptf_contact_message'] . '</td>
        $headers .= 'From: ' . $_REQUEST['plscptf_contact_email'] . "\r\n";
        if (isset($_REQUEST['plscptf_contact_send_copy']) && $_REQUEST['plscptf_contact_send_copy'] == 1)
          wp_mail($_REQUEST['plscptf_contact_email'], stripslashes($subject), stripslashes($message), $headers, $attachments);
        $headers .= 'From: ' . $_REQUEST['plscptf_contact_email'] . "\r\n";
        if (isset($_REQUEST['plscptf_contact_send_copy']) && $_REQUEST['plscptf_contact_send_copy'] == 1)
          @mail($_REQUEST['plscptf_contact_email'], stripslashes($subject), stripslashes($message), $headers);
Version: 2.0.6
<?php 
		.'quemejorar='.substr(str_replace(".","[dot]",urlencode($_POST["PlusCaptcha_feedback_quemejoraria"])),0,299).
Fixed code: Version: 2.0.14
if (!function_exists('tags')) {
	# Clean
	# Limpiar data
	function tags($tags){  
		$tags = strip_tags($tags);  
		$tags = stripslashes($tags);  
		$tags = htmlentities($tags);
		$tags = addslashes($tags);
		return trim($tags);  
	}
}

            if(!is_admin() && tags(!empty($_POST['comment_post_ID'])) && tags(is_numeric($_POST['comment_post_ID']))){
                wp_safe_redirect(get_permalink(tags($_POST['comment_post_ID'])) . '#formError', 302);
if (!function_exists('tags')) {
	# Clean
	# Limpiar data
	function tags($tags){  
		$tags = strip_tags($tags);  
		$tags = stripslashes($tags);  
		$tags = htmlentities($tags);
		$tags = addslashes($tags);
		return trim($tags);  
	}
}
  if ((tags(isset($_POST[$hidden_field_name]))) && (tags($_POST[$hidden_field_name]) == 'Y')) {
	  update_option('PlusCaptcha_feedback_quemejoraria', tags($_POST["PlusCaptcha_feedback_quemejoraria"]));
  $website = json_encode(tags(empty($_POST['website'])) ? "http://{".tags($_SERVER['SERVER_NAME'])."}/" : tags($_POST['website']));
  $email = json_encode(tags($_POST['email']));
  if (tags(isset($_POST['language']))) {
    $language = (int) tags($_POST['language']);
  if (tags(isset($_POST['category']))) {
    $category = (int) tags($_POST['category']);
  if (tags(isset($_POST['site_category']))) {
    $site_category = (int) tags($_POST['site_category']);
  if (tags(isset($_POST['gender']))) {
    $gender = (int) tags($_POST['gender']);
  if ((!$ignore_post) && (tags(isset($_POST[$hidden_field_name]))) && (tags($_POST[$hidden_field_name]) == 'Y')) {
      $opt_val = tags(isset($_POST[$opt_name])) ? tags($_POST[$opt_name]) : null;
  $plscptf_options_submit['plscptf_user_email'] = tags($_REQUEST['plscptf_user_email']);
  $plscptf_options_submit['plscptf_custom_email'] = tags($_REQUEST['plscptf_custom_email']);
  $plscptf_options_submit['plscptf_select_email'] = tags($_REQUEST['plscptf_select_email']);
  $plscptf_options_submit['plscptf_additions_options'] = tags(isset($_REQUEST['plscptf_additions_options'])) ? tags($_REQUEST['plscptf_additions_options']) : 0;
    $plscptf_options_submit['plscptf_send_copy'] = tags(isset($_REQUEST['plscptf_send_copy'])) ? tags($_REQUEST['plscptf_send_copy']) : 0;
    $plscptf_options_submit['plscptf_mail_method'] = tags($_REQUEST['plscptf_mail_method']);
    $plscptf_options_submit['plscptf_from_field'] = tags($_REQUEST['plscptf_from_field']);
    $plscptf_options_submit['plscptf_display_add_info'] = tags(isset($_REQUEST['plscptf_display_add_info'])) ? 1 : 0;
    $plscptf_options_submit['plscptf_change_label'] = tags(isset($_REQUEST['plscptf_change_label'])) ? 1 : 0;
      $plscptf_options_submit['plscptf_display_sent_from'] = tags(isset($_REQUEST['plscptf_display_sent_from'])) ? 1 : 0;
      $plscptf_options_submit['plscptf_display_date_time'] = tags(isset($_REQUEST['plscptf_display_date_time'])) ? 1 : 0;
      $plscptf_options_submit['plscptf_display_coming_from'] = tags(isset($_REQUEST['plscptf_display_coming_from'])) ? 1 : 0;
      $plscptf_options_submit['plscptf_display_user_agent'] = tags(isset($_REQUEST['plscptf_display_user_agent'])) ? 1 : 0;
      $plscptf_options_submit['plscptf_name_label'] = tags(isset($_REQUEST['plscptf_name_label'])) ? tags($_REQUEST['plscptf_name_label']) : $plscptf_options_submit['plscptf_name_label'];
      $plscptf_options_submit['plscptf_email_label'] = tags(isset($_REQUEST['plscptf_email_label'])) ? tags($_REQUEST['plscptf_email_label']) : $plscptf_options_submit['plscptf_email_label'];
      $plscptf_options_submit['plscptf_subject_label'] = tags(isset($_REQUEST['plscptf_subject_label'])) ? tags($_REQUEST['plscptf_subject_label']) : $plscptf_options_submit['plscptf_subject_label'];
      $plscptf_options_submit['plscptf_message_label'] = tags(isset($_REQUEST['plscptf_message_label'])) ? tags($_REQUEST['plscptf_message_label']) : $plscptf_options_submit['plscptf_message_label'];
    $plscptf_options_submit['plscptf_action_after_send'] = tags($_REQUEST['plscptf_action_after_send']);
    $plscptf_options_submit['plscptf_thank_text'] = tags($_REQUEST['plscptf_thank_text']);
    $plscptf_options_submit['plscptf_redirect_url'] = tags($_REQUEST['plscptf_redirect_url']);
    if ( tags(isset($_REQUEST['PlusCaptcha_form_contact'])) ) {
if (!function_exists('tags')) {
	# Clean
	# Limpiar data
	function tags($tags){  
		$tags = strip_tags($tags);  
		$tags = stripslashes($tags);  
		$tags = htmlentities($tags);
		$tags = addslashes($tags);
		return trim($tags);  
	}
}

		'sckey'		=> ( tags( isset( $_POST[ 'sckey' ]) ) ? tags($_POST[ 'sckey' ]) : '' ),
		'scvalue'	=> ( tags( isset( $_POST[ 'scvalue' ]) ) ? tags($_POST[ 'scvalue' ]) : '' )
	if (  tags( !empty( $_POST ) ) && get_result(simpleSessionGet("contacto", "")) == false ) {
	if ( tags($_POST['stage']) == 'validate-user-signup' ) {
if (!function_exists('tags')) {
	# Clean
	# Limpiar data
	function tags($tags){  
		$tags = strip_tags($tags);  
		$tags = stripslashes($tags);  
		$tags = htmlentities($tags);
		$tags = addslashes($tags);
		return trim($tags);  
	}
}
    $page_url = ( tags(isset($_SERVER["HTTPS"])) && tags($_SERVER["HTTPS"]) == "on" ? "https://" : "http://" ) . tags($_SERVER["SERVER_NAME"]) . tags($_SERVER["REQUEST_URI"]);
    $name = tags(isset($_REQUEST['plscptf_contact_name'])) ? tags($_REQUEST['plscptf_contact_name']) : "";
    $email = tags(isset($_REQUEST['plscptf_contact_email'])) ? tags($_REQUEST['plscptf_contact_email']) : "";
    $subject = tags(isset($_REQUEST['plscptf_contact_subject'])) ? tags($_REQUEST['plscptf_contact_subject']) : "";
    $message = tags(isset($_REQUEST['plscptf_contact_message'])) ? tags($_REQUEST['plscptf_contact_message']) : "";
    $send_copy = tags(isset($_REQUEST['plscptf_contact_send_copy'])) ? tags($_REQUEST['plscptf_contact_send_copy']) : "";
    if (tags(isset($_REQUEST['plscptf_contact_action']))) {
    if ("" != tags($_REQUEST['plscptf_contact_name']))
    if ("" != tags($_REQUEST['plscptf_contact_email']) && preg_match("/^(?:[a-z0-9]+(?:[a-z0-9\-_\.]+)?@[a-z0-9]+(?:[a-z0-9\-\.]+)?\.[a-z]{2,5})$/i", tags(trim($_REQUEST['plscptf_contact_email']))))
    if ("" != tags($_REQUEST['plscptf_contact_subject']))
    if ("" != tags($_REQUEST['plscptf_contact_message']))
      $subject = tags($_REQUEST['plscptf_contact_subject']);
        $form_action_url = 'https://' . tags($_SERVER['HTTP_HOST']) . tags($_SERVER['REQUEST_URI']);
        $form_action_url = 'http://' . tags($_SERVER['HTTP_HOST']) . tags($_SERVER['REQUEST_URI']);
        $userdomain = gethostbyaddr(tags($_SERVER['REMOTE_ADDR']));
							<td>' . __('Sent from (ip address)', 'PlusCaptcha') . ':</td><td>' . tags($_SERVER['REMOTE_ADDR']) . " ( " . $userdomain . " )" . '</td>
							<td>' . __('Using (user agent)', 'PlusCaptcha') . ':</td><td>' . plscptf_clean_input(tags($_SERVER['HTTP_USER_AGENT'])) . '</td>
						<td width="160">' . __("Name", 'PlusCaptcha') . '</td><td>' . tags($_REQUEST['plscptf_contact_name']) . '</td>
						<td>' . __("Email", 'PlusCaptcha') . '</td><td>' . tags($_REQUEST['plscptf_contact_email']) . '</td>
						<td>' . __("Subject", 'PlusCaptcha') . '</td><td>' . tags($_REQUEST['plscptf_contact_subject']) . '</td>
						<td>' . __("Message", 'PlusCaptcha') . '</td><td>' . tags($_REQUEST['plscptf_contact_message']) . '</td>
        $headers .= 'From: ' . tags($_REQUEST['plscptf_contact_email']) . "\r\n";
        if (tags(isset($_REQUEST['plscptf_contact_send_copy'])) && tags($_REQUEST['plscptf_contact_send_copy']) == 1)
          wp_mail(tags($_REQUEST['plscptf_contact_email']), stripslashes($subject), stripslashes($message), $headers, $attachments);
        $headers .= 'From: ' . tags($_REQUEST['plscptf_contact_email']) . "\r\n";
        if (tags(isset($_REQUEST['plscptf_contact_send_copy'])) && tags($_REQUEST['plscptf_contact_send_copy']) == 1)
          @mail(tags($_REQUEST['plscptf_contact_email']), stripslashes($subject), stripslashes($message), $headers);
Version: 2.0.14
= 2.0.10 =
* Cross-site scripting (XSS) loged user side fixed. Thanks to Carlo Pelliccioni @ Hacktive Security

= 2.0.10 =
* Cross-site scripting (XSS) loged user side fixed. Thanks to Carlo Pelliccioni @ Hacktive Security

<?php
if (!function_exists('tags')) {
	# Clean
	# Limpiar data
	function tags($tags){  
		$tags = strip_tags($tags);  
		$tags = stripslashes($tags);  
		$tags = htmlentities($tags);
		$tags = addslashes($tags);
		return trim($tags);  
	}
}

		.'quemejorar='.substr(str_replace(".","[dot]",urlencode(tags($_POST["PlusCaptcha_feedback_quemejoraria"]))),0,299).
<?php

if (!function_exists('tags')) {
	# Clean
	# Limpiar data
	function tags($tags){  
		$tags = strip_tags($tags);  
		$tags = stripslashes($tags);  
		$tags = htmlentities($tags);
		$tags = addslashes($tags);
		return trim($tags);  
	}
}

?>