CVE-2022-2941: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions up to, and including 2.88.0. This is due to the fact that all fields in the "Naming Conventions" section do not properly sanitize user input, nor escape it on output. This makes it possible for authenticated attackers, with administrative privileges, to inject JavaScript code into the setting that will execute whenever a user accesses the injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2022-09-06T18:15Z
Repository: https://github.com/lesterchan/wp-useronline
Language: PHP
Files changed: README.md, admin.php, wp-useronline.php
Commit date: 2022-08-14 14:17:45 +0800
Commit message: Fixed XSS. Props Juampa Rodriguez

Diff: diff --git a/README.md b/README.md
index 44168af..4545f2d 100644
--- a/README.md
+++ b/README.md
@@ -2,11 +2,11 @@
 Contributors: GamerZ  
 Donate link: https://lesterchan.net/site/donation/  
 Tags: useronline, usersonline, wp-useronline, online, users, user, ajax, widget  
 Requires at least: 4.0  
 Tested up to: 6.0  
-Stable tag: 2.88.0  
+Stable tag: 2.88.1  
 License: GPLv2 or later  
 License URI: http://www.gnu.org/licenses/gpl-2.0.html  
 
 Enable you to display how many users are online on your Wordpress blog with detailed statistics.
 
@@ -86,10 +86,13 @@ If you ARE NOT using nice permalinks, you need to go to `WP-Admin -> Settings ->
 Make sure your host is running PHP 5. The only foolproof way to do this is to add this line to wp-config.php (after the opening `<?php` tag):
 
 `var_dump(PHP_VERSION);`
 
 ## Changelog
+### 2.88.1
+* FIXED: Fixed XSS. Props Juampa Rodriguez.
+
 ### 2.88.0
 * NEW: Bump to WordPress 6.0.
 * FIXED: Fixed XSS. Props @steffinstanly.
 
 ### 2.85.6
diff --git a/admin.php b/admin.php
index dc3ef21..c7ed614 100644
--- a/admin.php
+++ b/admin.php
@@ -63,15 +63,25 @@ class UserOnline_Options extends scbAdminPage {
 	public function validate( $options, $old_data = array() ) {
 		$options['timeout'] = isset( $options['timeout'] ) ? absint( $options['timeout'] ) : 0;
 		$options['url'] = ! empty( $options['url'] ) ? esc_url_raw( trim( $options['url'] ) ) : '';
 		$options['names'] = ! empty( $options['names'] ) ? (int) $options['names'] : 0;
 
-		foreach ( $options['templates'] as $key => $template )
-			if ( is_array( $template ) )
+		foreach ( $options['naming'] as $key => $template ) {
+			$options['naming'][$key] = wp_kses_post( trim( $template ) );
+		}
+		foreach ( $options['templates'] as $key => $template ) {
+			if ( is_array( $template ) ) {
 				$options['templates'][$key]['text'] = wp_kses_post( trim( $template['text'] ) );
-			else
+				if ( ! empty( $template['separators'] ) && is_array( $template['separators'] ) ) {
+						foreach( $template['separators'] as $seperator_key => $seperator_value ) {
+							$options['templates'][$key]['separators'][$seperator_key] = wp_kses_post( trim( $seperator_value ) );
+						}
+				}
+			} else {
 				$options['templates'][$key] = wp_kses_post( trim( $template ) );
+			}
+		}
 
 		return $options;
 	}
 
 	public function page_head() {
@@ -204,11 +214,11 @@ class UserOnline_Options extends scbAdminPage {
 								foreach ( array( $tmp, $tmp . 's' ) as $type ) {
 									echo $this->input( array(
 										'type' => 'text',
 										'name' => array( 'naming', $type ),
 										'extra' => 'size="30"',
-										'desc' => html( 'td', '%input%' )
+										'desc' => html( 'td', $type )
 									), $data );
 								}
 								echo "\n</tr>\n";
 							}
 						?>
diff --git a/wp-useronline.php b/wp-useronline.php
index 8212164..1fdaa43 100644
--- a/wp-useronline.php
+++ b/wp-useronline.php
@@ -1,11 +1,11 @@
 <?php
 /*
 Plugin Name: WP-UserOnline
 Plugin URI: https://lesterchan.net/portfolio/programming/php/
 Description: Enable you to display how many users are online on your Wordpress site
-Version: 2.88.0
+Version: 2.88.1
 Author: Lester 'GaMerZ' Chan
 Author URI: https://lesterchan.net
 Text Domain: wp-useronline
 */
 

Vulnerable code: Stable tag: 2.88.0  
		foreach ( $options['templates'] as $key => $template )
			if ( is_array( $template ) )
			else
										'desc' => html( 'td', '%input%' )
Version: 2.88.0
Fixed code: Stable tag: 2.88.1  
### 2.88.1
* FIXED: Fixed XSS. Props Juampa Rodriguez.

		foreach ( $options['naming'] as $key => $template ) {
			$options['naming'][$key] = wp_kses_post( trim( $template ) );
		}
		foreach ( $options['templates'] as $key => $template ) {
			if ( is_array( $template ) ) {
				if ( ! empty( $template['separators'] ) && is_array( $template['separators'] ) ) {
						foreach( $template['separators'] as $seperator_key => $seperator_value ) {
							$options['templates'][$key]['separators'][$seperator_key] = wp_kses_post( trim( $seperator_value ) );
						}
				}
			} else {
			}
		}
										'desc' => html( 'td', $type )
Version: 2.88.1