CVE-2014-125111: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in namithjawahar Wp-Insert up to 2.0.8 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.0.9 is able to address this issue. The name of the patch is a07b7b08084b9b85859f3968ce7fde0fd1fcbba3. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-259628.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2024-04-08T13:15Z
Repository: https://github.com/wp-plugins/wp-insert
Language: PHP
Files changed: includes/common/popups/categories.php, includes/common/popups/chitika.php, includes/common/popups/countries.php, includes/common/popups/instances.php, includes/common/popups/pages.php, includes/common/popups/posts.php, readme.txt, wp-insert.php
Commit date: 2014-01-02 04:05:54 +0000
Commit message: XSS Exploit Fix.

git-svn-id: https://plugins.svn.wordpress.org/wp-insert/trunk@831372 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/includes/common/popups/categories.php b/includes/common/popups/categories.php
index 205dc9d..716bf56 100644
--- a/includes/common/popups/categories.php
+++ b/includes/common/popups/categories.php
@@ -20,11 +20,11 @@ require('../../../../../../wp-blog-header.php');
 				var pagePicker = document.getElementById('category_picker');
 				while (pagePicker.selectedIndex != -1) {
 					selectedItems.push(pagePicker.options[pagePicker.selectedIndex].value);
 					pagePicker.options[pagePicker.selectedIndex].selected = false;
 				}
-				parent.jQuery('#<?php echo (string)$_GET['target']; ?>').val(selectedItems.join(','));
+				parent.jQuery('#<?php echo wp_kses((string)$_GET['target'], ''); ?>').val(selectedItems.join(','));
 				parent.jQuery.colorbox.close();
 			}
 		</script>
 	</head>
 	<body>
diff --git a/includes/common/popups/chitika.php b/includes/common/popups/chitika.php
index a808c26..ef61802 100644
--- a/includes/common/popups/chitika.php
+++ b/includes/common/popups/chitika.php
@@ -30,11 +30,11 @@ require('../../../../../../wp-blog-header.php');
 				adCode += 'ch_color_border = "'+jQuery("#chitikaBorderColor").val()+'";\n';
 				adCode += 'ch_color_text = "'+jQuery("#chitikaTextColor").val()+'";\n';
 				adCode += 'ch_color_bg = "'+jQuery("#chitikaBackgroundColor").val()+'";\n';
 				adCode += '</'+'script>\n';
 				adCode += '<script src="http://scripts.chitika.net/eminimalls/amm.js" type="text/javascript"></'+'script>';
-				parent.jQuery('#<?php echo (string)$_GET['target']; ?>').val(adCode);
+				parent.jQuery('#<?php echo wp_kses((string)$_GET['target'], ''); ?>').val(adCode);
 				parent.jQuery.colorbox.close();
 			}
 			function validateUsername(sender) {
 				if(sender.value != '') {
 					jQuery("#submitButton").css("display", "inline");
diff --git a/includes/common/popups/countries.php b/includes/common/popups/countries.php
index 8653f95..b30cccc 100644
--- a/includes/common/popups/countries.php
+++ b/includes/common/popups/countries.php
@@ -20,11 +20,11 @@ require('../../../../../../wp-blog-header.php');
 				var pagePicker = document.getElementById('country_picker');
 				while (pagePicker.selectedIndex != -1) {
 					selectedItems.push(pagePicker.options[pagePicker.selectedIndex].value);
 					pagePicker.options[pagePicker.selectedIndex].selected = false;
 				}
-				parent.jQuery('#<?php echo (string)$_GET['target']; ?>').val(selectedItems.join(','));
+				parent.jQuery('#<?php echo wp_kses((string)$_GET['target'], ''); ?>').val(selectedItems.join(','));
 				parent.jQuery.colorbox.close();
 			}
 		</script>
 	</head>
 	<body>
diff --git a/includes/common/popups/instances.php b/includes/common/popups/instances.php
index de2a206..89cb4eb 100644
--- a/includes/common/popups/instances.php
+++ b/includes/common/popups/instances.php
@@ -31,11 +31,11 @@ function wp_insert_add_ordinal_number_suffix($num) {
 				var pagePicker = document.getElementById('instance_picker');
 				while (pagePicker.selectedIndex != -1) {
 					selectedItems.push(pagePicker.options[pagePicker.selectedIndex].value);
 					pagePicker.options[pagePicker.selectedIndex].selected = false;
 				}
-				parent.jQuery('#<?php echo (string)$_GET['target']; ?>').val(selectedItems.join(','));
+				parent.jQuery('#<?php echo wp_kses((string)$_GET['target'], ''); ?>').val(selectedItems.join(','));
 				parent.jQuery.colorbox.close();
 			}
 		</script>
 	</head>
 	<body>
diff --git a/includes/common/popups/pages.php b/includes/common/popups/pages.php
index 15403f0..124499e 100644
--- a/includes/common/popups/pages.php
+++ b/includes/common/popups/pages.php
@@ -20,11 +20,11 @@ require('../../../../../../wp-blog-header.php');
 				var pagePicker = document.getElementById('page_picker');
 				while (pagePicker.selectedIndex != -1) {
 					selectedItems.push(pagePicker.options[pagePicker.selectedIndex].value);
 					pagePicker.options[pagePicker.selectedIndex].selected = false;
 				}
-				parent.jQuery('#<?php echo (string)$_GET['target']; ?>').val(selectedItems.join(','));
+				parent.jQuery('#<?php echo wp_kses((string)$_GET['target'], ''); ?>').val(selectedItems.join(','));
 				parent.jQuery.colorbox.close();
 			}
 		</script>
 	</head>
 	<body>
diff --git a/includes/common/popups/posts.php b/includes/common/popups/posts.php
index ec78c92..ef890d9 100644
--- a/includes/common/popups/posts.php
+++ b/includes/common/popups/posts.php
@@ -20,11 +20,11 @@ require('../../../../../../wp-blog-header.php');
 				var pagePicker = document.getElementById('post_picker');
 				while (pagePicker.selectedIndex != -1) {
 					selectedItems.push(pagePicker.options[pagePicker.selectedIndex].value);
 					pagePicker.options[pagePicker.selectedIndex].selected = false;
 				}
-				parent.jQuery('#<?php echo (string)$_GET['target']; ?>').val(selectedItems.join(','));
+				parent.jQuery('#<?php echo wp_kses((string)$_GET['target'], ''); ?>').val(selectedItems.join(','));
 				parent.jQuery.colorbox.close();
 			}
 		</script>
 	</head>
 	<body>
diff --git a/readme.txt b/readme.txt
index 144a8b8..a17982b 100644
--- a/readme.txt
+++ b/readme.txt
@@ -2,11 +2,11 @@
 Contributors: Namith Jawahar 
 Donate link:www.wp-insert.smartlogix.co.in/support
 Tags: adsense,google,widget,post,admin,plugin,ads,in post ads,feed logo,smartlogix,ads in feeds,analytics,google analytics,header,footer,ad management,advertisements,content,ad,advertising,privacy policy,privacy,policy,automatic privacy policy,blog,feed,feeds,formatting,html,javascript,manage,post,posts,seo,sidebar,widget,widgets,wordpress,tracking,syntex highlighter,highlighting,theme tools,plugin tools,developer tools,highlighting,theme editor,plugin editor,middle ad,ad filtration,pagewise ad filtration,template ads,ad tags,adbrite ads,adsense ready,easy adsense,adsense optimized,terms and conditions,terms,conditions,automatic terms and conditions
 Requires at least: 3.2
 Tested up to: 3.8
-Stable tag: 2.0.8
+Stable tag: 2.0.9
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 
 Wp-Insert is the most powerful yet easiest to use WordPress ad management plugin which does a lot more than ad management.
 
diff --git a/wp-insert.php b/wp-insert.php
index 3ea7bc8..b100395 100644
--- a/wp-insert.php
+++ b/wp-insert.php
@@ -1,11 +1,11 @@
 <?php
 /*
 Plugin Name: Wp-Insert
 Plugin URI: http://www.wp-insert.smartlogix.co.in/
 Description: WP-INSERT by SMARTLOGIX : The ultimate wordpress plugin (No1 Adsense Plugin for Wordpress)
-Version: 2.0.8
+Version: 2.0.9
 Author: Namith Jawahar
 Author URI: http://www.smartlogix.co.in/
 WP-INSERT by SMARTLOGIX : The ultimate wordpress plugin (No1 Adsense Plugin for Wordpress)
 */
 

Vulnerable code: 				parent.jQuery('#<?php echo (string)$_GET['target']; ?>').val(selectedItems.join(','));
				parent.jQuery('#<?php echo (string)$_GET['target']; ?>').val(adCode);
				parent.jQuery('#<?php echo (string)$_GET['target']; ?>').val(selectedItems.join(','));
				parent.jQuery('#<?php echo (string)$_GET['target']; ?>').val(selectedItems.join(','));
				parent.jQuery('#<?php echo (string)$_GET['target']; ?>').val(selectedItems.join(','));
				parent.jQuery('#<?php echo (string)$_GET['target']; ?>').val(selectedItems.join(','));
Stable tag: 2.0.8
Version: 2.0.8
Fixed code: 				parent.jQuery('#<?php echo wp_kses((string)$_GET['target'], ''); ?>').val(selectedItems.join(','));
				parent.jQuery('#<?php echo wp_kses((string)$_GET['target'], ''); ?>').val(adCode);
				parent.jQuery('#<?php echo wp_kses((string)$_GET['target'], ''); ?>').val(selectedItems.join(','));
				parent.jQuery('#<?php echo wp_kses((string)$_GET['target'], ''); ?>').val(selectedItems.join(','));
				parent.jQuery('#<?php echo wp_kses((string)$_GET['target'], ''); ?>').val(selectedItems.join(','));
				parent.jQuery('#<?php echo wp_kses((string)$_GET['target'], ''); ?>').val(selectedItems.join(','));
Stable tag: 2.0.9
Version: 2.0.9