CVE-2016-15027: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in meta4creations Post Duplicator Plugin 2.18 on WordPress. It has been classified as problematic. Affected is the function mtphr_post_duplicator_notice of the file includes/notices.php. The manipulation of the argument post-duplicated leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.19 is able to address this issue. The name of the patch is ca67c05e490c0cf93a1e9b2d93bfeff3dd96f594. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221496.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-02-20T17:15Z
Repository: https://github.com/meta4creations/post-duplicator
Language: PHP
Files changed: includes/notices.php, includes/settings.php, languages/post-duplicator-de_DE.po, languages/post-duplicator-fr.po, languages/post-duplicator-fr_FR.po, m4c-postduplicator.php, readme.txt
Commit date: 2016-04-06 15:49:12 +0000
Commit message: XSS vulnerability fix

git-svn-id: http://plugins.svn.wordpress.org/post-duplicator/trunk@1388319 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/includes/notices.php b/includes/notices.php
index 1e7d509..9312f8a 100755
--- a/includes/notices.php
+++ b/includes/notices.php
@@ -4,11 +4,11 @@
 /* !Create an admin notice that a post has been duplicated - 2.11 */
 /* --------------------------------------------------------- */
 
 function mtphr_post_duplicator_notice() {
 	
-	$duplicated_id = isset($_GET['post-duplicated']) ? $_GET['post-duplicated'] : '';
+	$duplicated_id = isset($_GET['post-duplicated']) ? htmlspecialchars($_GET['post-duplicated'], ENT_QUOTES, 'UTF-8') : '';
 	if( $duplicated_id != '' ) {
 		
 		$settings = get_mtphr_post_duplicator_settings();
 	
 		// Get the post type object
diff --git a/includes/settings.php b/includes/settings.php
index 21019a8..8ad51fe 100755
--- a/includes/settings.php
+++ b/includes/settings.php
@@ -7,12 +7,12 @@ add_action( 'admin_menu', 'mtphr_post_duplicator_settings_page' );
  * @since 2.0
  */
 function mtphr_post_duplicator_settings_page() {
 
 	add_management_page(
-		'Post Duplicator',														// The value used to populate the browser's title bar when the menu page is active
-		'Post Duplicator',														// The label of this submenu item displayed in the menu
+		__('Post Duplicator', 'post-duplicator'),														// The value used to populate the browser's title bar when the menu page is active
+		__('Post Duplicator', 'post-duplicator'),														// The label of this submenu item displayed in the menu
 		'administrator',															// What roles are able to access this submenu item
 		'mtphr_post_duplicator_settings_menu',				// The ID used to represent this submenu item
 		'mtphr_post_duplicator_settings_display'			// The callback function used to render the options for this submenu item
 	);
 }
diff --git a/languages/post-duplicator-de_DE.mo b/languages/post-duplicator-de_DE.mo
index e9f550a..7b5d673 100755
Binary files a/languages/post-duplicator-de_DE.mo and b/languages/post-duplicator-de_DE.mo differ
diff --git a/languages/post-duplicator-de_DE.po b/languages/post-duplicator-de_DE.po
index 7864eeb..6b47f19 100755
--- a/languages/post-duplicator-de_DE.po
+++ b/languages/post-duplicator-de_DE.po
@@ -1,113 +1,162 @@
 msgid ""
 msgstr ""
-"Project-Id-Version: Post Duplicator v2.8\n"
+"Project-Id-Version: Post Duplicator v2.16\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2015-09-17 10:33+0100\n"
-"PO-Revision-Date: 2015-09-18 01:48:47+0000\n"
+"PO-Revision-Date: 2016-03-11 12:49-0600\n"
 "Last-Translator: \n"
 "Language-Team: \n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Poedit 1.7.4\n"
-"X-Poedit-Language: \n"
-"X-Poedit-Country: \n"
+"X-Generator: Poedit 1.8.7\n"
 "X-Poedit-SourceCharset: utf-8\n"
-"X-Poedit-KeywordsList: __;_e;__ngettext:1,2;_n:1,2;__ngettext_noop:1,2;_n_noop:1,2;_c,_nc:4c,1,2;_x:1,2c;_ex:1,2c;_nx:4c,1,2;_nx_noop:4c,1,2;\n"
+"X-Poedit-KeywordsList: __;_e;__ngettext:1,2;_n:1,2;__ngettext_noop:1,2;_n_noop:1,2;_c,_nc:4c,1,2;_x:1,2c;_ex:1,2c;_nx:4c,1,2;_nx_noop:4c,1,2\n"
 "X-Poedit-Basepath: ..\n"
-"X-Poedit-Bookmarks: \n"
+"X-Textdomain-Support: yes\n"
+"Language: de_DE\n"
 "X-Poedit-SearchPath-0: .\n"
-"X-Textdomain-Support: yes"
 
-#: includes/edit.php:17
+# @ post-duplicator
+#: includes/edit.php:16
 #, php-format
-#@ post-duplicator
 msgid "Duplicate %s"
 msgstr "Kopiere %s"
 
+# @ post-duplicator
 #: includes/settings.php:32
-#@ post-duplicator
 msgid "Post Status"
 msgstr "Status"
 
-#: includes/settings.php:35
-#@ post-duplicator
+# @ post-duplicator
+#: includes/helpers.php:10 includes/settings.php:35
 msgid "Same as original"
 msgstr "Wie Original"
 
+# @ post-duplicator
 #: includes/settings.php:36
-#@ post-duplicator
 msgid "Draft"
 msgstr "Entwurf"
 
+# @ post-duplicator
 #: includes/settings.php:37
-#@ post-duplicator
 msgid "Published"
 msgstr "VerÃ¶ffentlicht"
 
+# @ post-duplicator
 #: includes/settings.php:38
-#@ post-duplicator
 msgid "Pending"
 msgstr "Ausstehend"
 
-#: includes/settings.php:44
-#@ post-duplicator
+# @ post-duplicator
+#: includes/settings.php:51
 msgid "Post Date"
 msgstr "Datum"
 
-#: includes/settings.php:47
-#@ post-duplicator
+# @ post-duplicator
+#: includes/settings.php:54
 msgid "Duplicate Timestamp"
 msgstr "Kopiere Zeitstempel"
 
-#: includes/settings.php:48
-#@ post-duplicator
+# @ post-duplicator
+#: includes/settings.php:55
 msgid "Current Time"
 msgstr "Aktuelle Zeit"
 
-#: includes/settings.php:55
-#@ post-duplicator
+# @ post-duplicator
+#: includes/settings.php:78
 msgid "Offset Date"
 msgstr "Datums-Abweichung"
 
-#: includes/settings.php:61
-#@ post-duplicator
+# @ post-duplicator
+#: includes/settings.php:84
 msgid " days"
 msgstr "Tage"
 
-#: includes/settings.php:68
-#@ post-duplicator
+# @ post-duplicator
+#: includes/settings.php:91
 msgid " hours"
 msgstr "Stunden"
 
-#: includes/settings.php:75
-#@ post-duplicator
+# @ post-duplicator
+#: includes/settings.php:98
 msgid " minutes"
 msgstr "Minuten"
 
-#: includes/settings.php:82
-#@ post-duplicator
+# @ post-duplicator
+#: includes/settings.php:105
 msgid " seconds"
 msgstr "Sekunden"
 
-#: includes/settings.php:89
-#@ post-duplicator
+# @ post-duplicator
+#: includes/settings.php:112
 msgid "newer"
 msgstr "frÃ¼her"
 
-#: includes/settings.php:90
-#@ post-duplicator
+# @ post-duplicator
+#: includes/settings.php:113
 msgid "older"
 msgstr "spÃ¤ter"
 
-#: includes/settings.php:136
-#@ post-duplicator
+# @ post-duplicator
+#: includes/settings.php:159
 msgid "Post Duplicator Settings"
 msgstr "Post Duplicator Einstellungen"
 
-#: includes/settings.php:160
-#@ post-duplicator
+# @ post-duplicator
+#: includes/settings.php:183
 msgid "Customize the settings for duplicated posts."
 msgstr "Konfiguriere die Einstellungen fÃ¼r kopierte \"Posts\"."
 
+# @ post-duplicator
+#: includes/edit.php:22
+#, php-format
+msgid "Duplicate %1$s to %2$s"
+msgstr "Doppelte %1$s auf %2$s"
+
+# @ post-duplicator
+#: includes/functions.php:18 includes/settings.php:66
+msgid "Copy"
+msgstr "Kopieren"
+
+# @ post-duplicator
+#: includes/notices.php:20
+msgid "here"
+msgstr "hier"
+
+# @ post-duplicator
+#: includes/notices.php:21
+#, php-format
+msgid "Successfully Duplicated! You can edit your new %1$s %2$s."
+msgstr "Erfolgreich dupliziert! Sie können Ihre neue %1$s %2$s bearbeiten."
+
+# @ post-duplicator
+#: includes/settings.php:12 includes/settings.php:13
+msgid "Post Duplicator"
+msgstr "Post-Duplizierer"
+
+# @ post-duplicator
+#: includes/settings.php:44
+msgid "Post Type"
+msgstr "Beitragstyp"
+
+# @ post-duplicator
+#: includes/settings.php:62
+msgid "Duplicate Title"
+msgstr "Doppelte Titel"
+
+# @ post-duplicator
+#: includes/settings.php:63
+msgid "String that should be appended to the duplicate post's title"
+msgstr "Zeichenfolge, die an den doppelten Post-Titel angefügt werden soll"
+
+# @ post-duplicator
+#: includes/settings.php:70
+msgid "Duplicate Slug"
+msgstr "Doppelte Schnecke"
+
+# @ post-duplicator
+#: includes/settings.php:71
+msgid "String that should be appended to the duplicate post's slug"
+msgstr "Zeichenfolge, die an den doppelten Post Flug angefügt werden soll"
diff --git a/languages/post-duplicator-fr.mo b/languages/post-duplicator-fr.mo
index ef2944d..b7a594d 100755
Binary files a/languages/post-duplicator-fr.mo and b/languages/post-duplicator-fr.mo differ
diff --git a/languages/post-duplicator-fr.po b/languages/post-duplicator-fr.po
index 1d6de55..b4186d3 100755
--- a/languages/post-duplicator-fr.po
+++ b/languages/post-duplicator-fr.po
@@ -1,123 +1,161 @@
-# Translation of Development (trunk) in French (France)
-# This file is distributed under the same license as the Development (trunk) package.
 msgid ""
 msgstr ""
-"PO-Revision-Date: 2015-12-07 07:08:49+0000\n"
+"Project-Id-Version: Post Duplicator v2.16\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: \n"
+"PO-Revision-Date: 2016-03-11 12:47-0600\n"
+"Last-Translator: \n"
+"Language-Team: \n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"Plural-Forms: nplurals=2; plural=n > 1;\n"
-"X-Generator: GlotPress/1.0-alpha-1100\n"
-"Project-Id-Version: Development (trunk)\n"
-
-#: includes/settings.php:63
+"Plural-Forms: nplurals=2; plural=n>1;\n"
+"X-Generator: Poedit 1.8.7\n"
+"X-Poedit-SourceCharset: utf-8\n"
+"X-Poedit-KeywordsList: __;_e;__ngettext:1,2;_n:1,2;__ngettext_noop:1,2;_n_noop:1,2;_c,_nc:4c,1,2;_x:1,2c;_ex:1,2c;_nx:4c,1,2;_nx_noop:4c,1,2\n"
+"X-Textdomain-Support: yes\n"
+"Language: fr\n"
+"X-Poedit-SearchPath-0: .\n"
+
+# @ post-duplicator
+#: includes/settings.php:71
 msgid "String that should be appended to the duplicate post's slug"
-msgstr ""
+msgstr "Chaîne qui doit être ajoutée au plug du double post"
 
-#: includes/settings.php:62
+# @ post-duplicator
+#: includes/settings.php:70
 msgid "Duplicate Slug"
-msgstr ""
+msgstr "Plug en double"
 
+# @ post-duplicator
 #: includes/edit.php:22
+#, php-format
 msgid "Duplicate %1$s to %2$s"
-msgstr ""
+msgstr "Dupliquer %1$s %2$s"
 
+# @ post-duplicator
 #: includes/notices.php:20
 msgid "here"
 msgstr "ici"
 
+# @ post-duplicator
 #: includes/notices.php:21
+#, php-format
 msgid "Successfully Duplicated! You can edit your new %1$s %2$s."
-msgstr ""
+msgstr "Reproduit avec succès ! Vous pouvez modifier votre nouveau %1$s %2$s."
 
+# @ post-duplicator
 #: includes/settings.php:44
 msgid "Post Type"
 msgstr "Type de contenu"
 
+# @ post-duplicator
 #: includes/edit.php:16
+#, php-format
 msgid "Duplicate %s"
-msgstr ""
+msgstr "Dupliquer %s"
 
+# @ post-duplicator
 #: includes/settings.php:32
 msgid "Post Status"
-msgstr ""
+msgstr "Statut"
 
+# @ post-duplicator
 #: includes/helpers.php:10 includes/settings.php:35
 msgid "Same as original"
-msgstr ""
+msgstr "Identique à l’original"
 
+# @ post-duplicator
 #: includes/settings.php:36
 msgid "Draft"
 msgstr "Brouillon"
 
+# @ post-duplicator
 #: includes/settings.php:37
 msgid "Published"
 msgstr "Publié"
 
+# @ post-duplicator
 #: includes/settings.php:38
 msgid "Pending"
 msgstr "En attente"
 
+# @ post-duplicator
 #: includes/settings.php:51
 msgid "Post Date"
-msgstr ""
+msgstr "Date de l’article"
 
+# @ post-duplicator
 #: includes/settings.php:54
 msgid "Duplicate Timestamp"
-msgstr ""
+msgstr "Plug en double"
 
+# @ post-duplicator
 #: includes/settings.php:55
 msgid "Current Time"
-msgstr ""
+msgstr "Heure actuelle"
 
-#: includes/settings.php:70
+# @ post-duplicator
+#: includes/settings.php:78
 msgid "Offset Date"
-msgstr ""
+msgstr "Décalage de date"
 
-#: includes/settings.php:76
+# @ post-duplicator
+#: includes/settings.php:84
 msgid " days"
-msgstr ""
+msgstr "jours"
 
-#: includes/settings.php:83
+# @ post-duplicator
+#: includes/settings.php:91
 msgid " hours"
-msgstr ""
+msgstr "heures"
 
-#: includes/settings.php:90
+# @ post-duplicator
+#: includes/settings.php:98
 msgid " minutes"
-msgstr ""
+msgstr "minutes"
 
-#: includes/settings.php:97
+# @ post-duplicator
+#: includes/settings.php:105
 msgid " seconds"
-msgstr ""
+msgstr "secondes"
 
-#: includes/settings.php:104
+# @ post-duplicator
+#: includes/settings.php:112
 msgid "newer"
-msgstr ""
+msgstr "plus récent"
 
-#: includes/settings.php:105
+# @ post-duplicator
+#: includes/settings.php:113
 msgid "older"
-msgstr ""
+msgstr "précédents"
 
-#: includes/settings.php:151
+# @ post-duplicator
+#: includes/settings.php:159
 msgid "Post Duplicator Settings"
-msgstr ""
+msgstr "Paramètres"
 
-#: includes/settings.php:175
+# @ post-duplicator
+#: includes/settings.php:183
 msgid "Customize the settings for duplicated posts."
-msgstr ""
+msgstr "Personnaliser les paramètres des messages dupliqués."
 
-#. Plugin Name of the plugin/theme
-msgid "Post Duplicator"
-msgstr ""
+# @ post-duplicator
+#: includes/functions.php:18 includes/settings.php:66
+msgid "Copy"
+msgstr "Exemplaire"
 
-#. Description of the plugin/theme
-msgid "Creates functionality to duplicate any and all post types, including taxonomies & custom fields"
-msgstr ""
+# @ post-duplicator
+#: includes/settings.php:62
+msgid "Duplicate Title"
+msgstr "Titre en double"
 
-#. Author of the plugin/theme
-msgid "Metaphor Creations"
-msgstr ""
+# @ post-duplicator
+#: includes/settings.php:63
+msgid "String that should be appended to the duplicate post's title"
+msgstr "Chaîne qui doit être ajoutée au titre de la double post"
 
-#. Author URI of the plugin/theme
-msgid "http://www.metaphorcreations.com"
-msgstr ""
\ No newline at end of file
+# @ post-duplicator
+#: includes/settings.php:12 includes/settings.php:13
+msgid "Post Duplicator"
+msgstr "Duplicateur de post"
diff --git a/languages/post-duplicator-fr_FR.mo b/languages/post-duplicator-fr_FR.mo
new file mode 100755
index 0000000..c8dff05
Binary files /dev/null and b/languages/post-duplicator-fr_FR.mo differ
diff --git a/languages/post-duplicator-fr_FR.po b/languages/post-duplicator-fr_FR.po
new file mode 100755
index 0000000..368f965
--- /dev/null
+++ b/languages/post-duplicator-fr_FR.po
@@ -0,0 +1,161 @@
+msgid ""
+msgstr ""
+"Project-Id-Version: Post Duplicator v2.16\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: \n"
+"PO-Revision-Date: 2016-03-11 12:47-0600\n"
+"Last-Translator: \n"
+"Language-Team: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=2; plural=n>1;\n"
+"X-Generator: Poedit 1.8.7\n"
+"X-Poedit-SourceCharset: utf-8\n"
+"X-Poedit-KeywordsList: __;_e;__ngettext:1,2;_n:1,2;__ngettext_noop:1,2;_n_noop:1,2;_c,_nc:4c,1,2;_x:1,2c;_ex:1,2c;_nx:4c,1,2;_nx_noop:4c,1,2\n"
+"X-Textdomain-Support: yes\n"
+"Language: fr_FR\n"
+"X-Poedit-SearchPath-0: .\n"
+
+# @ post-duplicator
+#: includes/settings.php:71
+msgid "String that should be appended to the duplicate post's slug"
+msgstr "Chaîne qui doit être ajoutée au plug du double post"
+
+# @ post-duplicator
+#: includes/settings.php:70
+msgid "Duplicate Slug"
+msgstr "Plug en double"
+
+# @ post-duplicator
+#: includes/edit.php:22
+#, php-format
+msgid "Duplicate %1$s to %2$s"
+msgstr "Dupliquer %1$s %2$s"
+
+# @ post-duplicator
+#: includes/notices.php:20
+msgid "here"
+msgstr "ici"
+
+# @ post-duplicator
+#: includes/notices.php:21
+#, php-format
+msgid "Successfully Duplicated! You can edit your new %1$s %2$s."
+msgstr "Reproduit avec succès ! Vous pouvez modifier votre nouveau %1$s %2$s."
+
+# @ post-duplicator
+#: includes/settings.php:44
+msgid "Post Type"
+msgstr "Type de contenu"
+
+# @ post-duplicator
+#: includes/edit.php:16
+#, php-format
+msgid "Duplicate %s"
+msgstr "Dupliquer %s"
+
+# @ post-duplicator
+#: includes/settings.php:32
+msgid "Post Status"
+msgstr "Statut"
+
+# @ post-duplicator
+#: includes/helpers.php:10 includes/settings.php:35
+msgid "Same as original"
+msgstr "Identique à l’original"
+
+# @ post-duplicator
+#: includes/settings.php:36
+msgid "Draft"
+msgstr "Brouillon"
+
+# @ post-duplicator
+#: includes/settings.php:37
+msgid "Published"
+msgstr "Publié"
+
+# @ post-duplicator
+#: includes/settings.php:38
+msgid "Pending"
+msgstr "En attente"
+
+# @ post-duplicator
+#: includes/settings.php:51
+msgid "Post Date"
+msgstr "Date de l’article"
+
+# @ post-duplicator
+#: includes/settings.php:54
+msgid "Duplicate Timestamp"
+msgstr "Plug en double"
+
+# @ post-duplicator
+#: includes/settings.php:55
+msgid "Current Time"
+msgstr "Heure actuelle"
+
+# @ post-duplicator
+#: includes/settings.php:78
+msgid "Offset Date"
+msgstr "Décalage de date"
+
+# @ post-duplicator
+#: includes/settings.php:84
+msgid " days"
+msgstr "jours"
+
+# @ post-duplicator
+#: includes/settings.php:91
+msgid " hours"
+msgstr "heures"
+
+# @ post-duplicator
+#: includes/settings.php:98
+msgid " minutes"
+msgstr "minutes"
+
+# @ post-duplicator
+#: includes/settings.php:105
+msgid " seconds"
+msgstr "secondes"
+
+# @ post-duplicator
+#: includes/settings.php:112
+msgid "newer"
+msgstr "plus récent"
+
+# @ post-duplicator
+#: includes/settings.php:113
+msgid "older"
+msgstr "précédents"
+
+# @ post-duplicator
+#: includes/settings.php:159
+msgid "Post Duplicator Settings"
+msgstr "Paramètres"
+
+# @ post-duplicator
+#: includes/settings.php:183
+msgid "Customize the settings for duplicated posts."
+msgstr "Personnaliser les paramètres des messages dupliqués."
+
+# @ post-duplicator
+#: includes/functions.php:18 includes/settings.php:66
+msgid "Copy"
+msgstr "Exemplaire"
+
+# @ post-duplicator
+#: includes/settings.php:62
+msgid "Duplicate Title"
+msgstr "Titre en double"
+
+# @ post-duplicator
+#: includes/settings.php:63
+msgid "String that should be appended to the duplicate post's title"
+msgstr "Chaîne qui doit être ajoutée au titre de la double post"
+
+# @ post-duplicator
+#: includes/settings.php:12 includes/settings.php:13
+msgid "Post Duplicator"
+msgstr "Duplicateur de post"
diff --git a/m4c-postduplicator.php b/m4c-postduplicator.php
index 9d50355..d593d9f 100755
--- a/m4c-postduplicator.php
+++ b/m4c-postduplicator.php
@@ -1,10 +1,10 @@
 <?php
 /*
 Plugin Name: Post Duplicator
 Description: Creates functionality to duplicate any and all post types, including taxonomies & custom fields
-Version: 2.16
+Version: 2.17
 Author: Metaphor Creations
 Author URI: http://www.metaphorcreations.com
 Text Domain: post-duplicator
 License: GPL2
 */
@@ -28,11 +28,11 @@ Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 
 
 
 
 /**Define Widget Constants */
-define ( 'MTPHR_POST_DUPLICATOR_VERSION', '2.16' );
+define ( 'MTPHR_POST_DUPLICATOR_VERSION', '2.17' );
 define ( 'MTPHR_POST_DUPLICATOR_DIR', plugin_dir_path(__FILE__) );
 define ( 'MTPHR_POST_DUPLICATOR_URL', plugins_url().'/post-duplicator' );
 
 
 
diff --git a/readme.txt b/readme.txt
index d0d62e5..1b1e5ec 100755
--- a/readme.txt
+++ b/readme.txt
@@ -39,10 +39,14 @@ Check out the 'Installation' tab.
 1. Sample view of the duplicate post link
 2. View of the settings page
 
 == Changelog ==
 
+= 2.17 =
+* XSS vulnerability fix
+* Language file updates
+
 = 2.16 =
 * Modified how post meta is saved to database
 * Modified duplicate slug implementation
 * Added file duplication support for the WP Customer Area plugin
 
@@ -106,6 +110,6 @@ Upgrade Post Duplicator to add 'post status' and 'date' options to your duplicat
 = 1.1 =
 Must upgrade in order for the plugin to work. The file paths where initially wrong as the plugin upload created a different directory name.
 
 == Upgrade Notice ==
 
-Multiple updates
\ No newline at end of file
+XSS vulnerability fix
\ No newline at end of file

Vulnerable code: 	$duplicated_id = isset($_GET['post-duplicated']) ? $_GET['post-duplicated'] : '';
		'Post Duplicator',														// The value used to populate the browser's title bar when the menu page is active
		'Post Duplicator',														// The label of this submenu item displayed in the menu
"Project-Id-Version: Post Duplicator v2.8\n"
"PO-Revision-Date: 2015-09-18 01:48:47+0000\n"
"X-Generator: Poedit 1.7.4\n"
"X-Poedit-Language: \n"
"X-Poedit-Country: \n"
"X-Poedit-KeywordsList: __;_e;__ngettext:1,2;_n:1,2;__ngettext_noop:1,2;_n_noop:1,2;_c,_nc:4c,1,2;_x:1,2c;_ex:1,2c;_nx:4c,1,2;_nx_noop:4c,1,2;\n"
"X-Poedit-Bookmarks: \n"
"X-Textdomain-Support: yes"
#: includes/edit.php:17
#@ post-duplicator
#@ post-duplicator
#: includes/settings.php:35
#@ post-duplicator
#@ post-duplicator
#@ post-duplicator
#@ post-duplicator
#: includes/settings.php:44
#@ post-duplicator
#: includes/settings.php:47
#@ post-duplicator
#: includes/settings.php:48
#@ post-duplicator
#: includes/settings.php:55
#@ post-duplicator
#: includes/settings.php:61
#@ post-duplicator
#: includes/settings.php:68
#@ post-duplicator
#: includes/settings.php:75
#@ post-duplicator
#: includes/settings.php:82
#@ post-duplicator
#: includes/settings.php:89
#@ post-duplicator
#: includes/settings.php:90
#@ post-duplicator
#: includes/settings.php:136
#@ post-duplicator
#: includes/settings.php:160
#@ post-duplicator
# Translation of Development (trunk) in French (France)
# This file is distributed under the same license as the Development (trunk) package.
"PO-Revision-Date: 2015-12-07 07:08:49+0000\n"
"Plural-Forms: nplurals=2; plural=n > 1;\n"
"X-Generator: GlotPress/1.0-alpha-1100\n"
"Project-Id-Version: Development (trunk)\n"

#: includes/settings.php:63
msgstr ""
#: includes/settings.php:62
msgstr ""
msgstr ""
msgstr ""
msgstr ""
msgstr ""
msgstr ""
msgstr ""
msgstr ""
msgstr ""
#: includes/settings.php:70
msgstr ""
#: includes/settings.php:76
msgstr ""
#: includes/settings.php:83
msgstr ""
#: includes/settings.php:90
msgstr ""
#: includes/settings.php:97
msgstr ""
#: includes/settings.php:104
msgstr ""
#: includes/settings.php:105
msgstr ""
#: includes/settings.php:151
msgstr ""
#: includes/settings.php:175
msgstr ""
#. Plugin Name of the plugin/theme
msgid "Post Duplicator"
msgstr ""
#. Description of the plugin/theme
msgid "Creates functionality to duplicate any and all post types, including taxonomies & custom fields"
msgstr ""
#. Author of the plugin/theme
msgid "Metaphor Creations"
msgstr ""
#. Author URI of the plugin/theme
msgid "http://www.metaphorcreations.com"
msgstr ""
Version: 2.16
define ( 'MTPHR_POST_DUPLICATOR_VERSION', '2.16' );
Multiple updates
Fixed code: 	$duplicated_id = isset($_GET['post-duplicated']) ? htmlspecialchars($_GET['post-duplicated'], ENT_QUOTES, 'UTF-8') : '';
		__('Post Duplicator', 'post-duplicator'),														// The value used to populate the browser's title bar when the menu page is active
		__('Post Duplicator', 'post-duplicator'),														// The label of this submenu item displayed in the menu
"Project-Id-Version: Post Duplicator v2.16\n"
"PO-Revision-Date: 2016-03-11 12:49-0600\n"
"X-Generator: Poedit 1.8.7\n"
"X-Poedit-KeywordsList: __;_e;__ngettext:1,2;_n:1,2;__ngettext_noop:1,2;_n_noop:1,2;_c,_nc:4c,1,2;_x:1,2c;_ex:1,2c;_nx:4c,1,2;_nx_noop:4c,1,2\n"
"X-Textdomain-Support: yes\n"
"Language: de_DE\n"
# @ post-duplicator
#: includes/edit.php:16
# @ post-duplicator
# @ post-duplicator
#: includes/helpers.php:10 includes/settings.php:35
# @ post-duplicator
# @ post-duplicator
# @ post-duplicator
# @ post-duplicator
#: includes/settings.php:51
# @ post-duplicator
#: includes/settings.php:54
# @ post-duplicator
#: includes/settings.php:55
# @ post-duplicator
#: includes/settings.php:78
# @ post-duplicator
#: includes/settings.php:84
# @ post-duplicator
#: includes/settings.php:91
# @ post-duplicator
#: includes/settings.php:98
# @ post-duplicator
#: includes/settings.php:105
# @ post-duplicator
#: includes/settings.php:112
# @ post-duplicator
#: includes/settings.php:113
# @ post-duplicator
#: includes/settings.php:159
# @ post-duplicator
#: includes/settings.php:183
# @ post-duplicator
#: includes/edit.php:22
#, php-format
msgid "Duplicate %1$s to %2$s"
msgstr "Doppelte %1$s auf %2$s"

# @ post-duplicator
#: includes/functions.php:18 includes/settings.php:66
msgid "Copy"
msgstr "Kopieren"

# @ post-duplicator
#: includes/notices.php:20
msgid "here"
msgstr "hier"

# @ post-duplicator
#: includes/notices.php:21
#, php-format
msgid "Successfully Duplicated! You can edit your new %1$s %2$s."
msgstr "Erfolgreich dupliziert! Sie können Ihre neue %1$s %2$s bearbeiten."

# @ post-duplicator
#: includes/settings.php:12 includes/settings.php:13
msgid "Post Duplicator"
msgstr "Post-Duplizierer"

# @ post-duplicator
#: includes/settings.php:44
msgid "Post Type"
msgstr "Beitragstyp"

# @ post-duplicator
#: includes/settings.php:62
msgid "Duplicate Title"
msgstr "Doppelte Titel"

# @ post-duplicator
#: includes/settings.php:63
msgid "String that should be appended to the duplicate post's title"
msgstr "Zeichenfolge, die an den doppelten Post-Titel angefügt werden soll"

# @ post-duplicator
#: includes/settings.php:70
msgid "Duplicate Slug"
msgstr "Doppelte Schnecke"

# @ post-duplicator
#: includes/settings.php:71
msgid "String that should be appended to the duplicate post's slug"
msgstr "Zeichenfolge, die an den doppelten Post Flug angefügt werden soll"
"Project-Id-Version: Post Duplicator v2.16\n"
"Report-Msgid-Bugs-To: \n"
"POT-Creation-Date: \n"
"PO-Revision-Date: 2016-03-11 12:47-0600\n"
"Last-Translator: \n"
"Language-Team: \n"
"Plural-Forms: nplurals=2; plural=n>1;\n"
"X-Generator: Poedit 1.8.7\n"
"X-Poedit-SourceCharset: utf-8\n"
"X-Poedit-KeywordsList: __;_e;__ngettext:1,2;_n:1,2;__ngettext_noop:1,2;_n_noop:1,2;_c,_nc:4c,1,2;_x:1,2c;_ex:1,2c;_nx:4c,1,2;_nx_noop:4c,1,2\n"
"X-Textdomain-Support: yes\n"
"Language: fr\n"
"X-Poedit-SearchPath-0: .\n"

# @ post-duplicator
#: includes/settings.php:71
msgstr "Chaîne qui doit être ajoutée au plug du double post"
# @ post-duplicator
#: includes/settings.php:70
msgstr "Plug en double"
# @ post-duplicator
#, php-format
msgstr "Dupliquer %1$s %2$s"
# @ post-duplicator
# @ post-duplicator
#, php-format
msgstr "Reproduit avec succès ! Vous pouvez modifier votre nouveau %1$s %2$s."
# @ post-duplicator
# @ post-duplicator
#, php-format
msgstr "Dupliquer %s"
# @ post-duplicator
msgstr "Statut"
# @ post-duplicator
msgstr "Identique à l’original"
# @ post-duplicator
# @ post-duplicator
# @ post-duplicator
# @ post-duplicator
msgstr "Date de l’article"
# @ post-duplicator
msgstr "Plug en double"
# @ post-duplicator
msgstr "Heure actuelle"
# @ post-duplicator
#: includes/settings.php:78
msgstr "Décalage de date"
# @ post-duplicator
#: includes/settings.php:84
msgstr "jours"
# @ post-duplicator
#: includes/settings.php:91
msgstr "heures"
# @ post-duplicator
#: includes/settings.php:98
msgstr "minutes"
# @ post-duplicator
#: includes/settings.php:105
msgstr "secondes"
# @ post-duplicator
#: includes/settings.php:112
msgstr "plus récent"
# @ post-duplicator
#: includes/settings.php:113
msgstr "précédents"
# @ post-duplicator
#: includes/settings.php:159
msgstr "Paramètres"
# @ post-duplicator
#: includes/settings.php:183
msgstr "Personnaliser les paramètres des messages dupliqués."
# @ post-duplicator
#: includes/functions.php:18 includes/settings.php:66
msgid "Copy"
msgstr "Exemplaire"
# @ post-duplicator
#: includes/settings.php:62
msgid "Duplicate Title"
msgstr "Titre en double"
# @ post-duplicator
#: includes/settings.php:63
msgid "String that should be appended to the duplicate post's title"
msgstr "Chaîne qui doit être ajoutée au titre de la double post"
# @ post-duplicator
#: includes/settings.php:12 includes/settings.php:13
msgid "Post Duplicator"
msgstr "Duplicateur de post"
msgid ""
msgstr ""
"Project-Id-Version: Post Duplicator v2.16\n"
"Report-Msgid-Bugs-To: \n"
"POT-Creation-Date: \n"
"PO-Revision-Date: 2016-03-11 12:47-0600\n"
"Last-Translator: \n"
"Language-Team: \n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"Plural-Forms: nplurals=2; plural=n>1;\n"
"X-Generator: Poedit 1.8.7\n"
"X-Poedit-SourceCharset: utf-8\n"
"X-Poedit-KeywordsList: __;_e;__ngettext:1,2;_n:1,2;__ngettext_noop:1,2;_n_noop:1,2;_c,_nc:4c,1,2;_x:1,2c;_ex:1,2c;_nx:4c,1,2;_nx_noop:4c,1,2\n"
"X-Textdomain-Support: yes\n"
"Language: fr_FR\n"
"X-Poedit-SearchPath-0: .\n"

# @ post-duplicator
#: includes/settings.php:71
msgid "String that should be appended to the duplicate post's slug"
msgstr "Chaîne qui doit être ajoutée au plug du double post"

# @ post-duplicator
#: includes/settings.php:70
msgid "Duplicate Slug"
msgstr "Plug en double"

# @ post-duplicator
#: includes/edit.php:22
#, php-format
msgid "Duplicate %1$s to %2$s"
msgstr "Dupliquer %1$s %2$s"

# @ post-duplicator
#: includes/notices.php:20
msgid "here"
msgstr "ici"

# @ post-duplicator
#: includes/notices.php:21
#, php-format
msgid "Successfully Duplicated! You can edit your new %1$s %2$s."
msgstr "Reproduit avec succès ! Vous pouvez modifier votre nouveau %1$s %2$s."

# @ post-duplicator
#: includes/settings.php:44
msgid "Post Type"
msgstr "Type de contenu"

# @ post-duplicator
#: includes/edit.php:16
#, php-format
msgid "Duplicate %s"
msgstr "Dupliquer %s"

# @ post-duplicator
#: includes/settings.php:32
msgid "Post Status"
msgstr "Statut"

# @ post-duplicator
#: includes/helpers.php:10 includes/settings.php:35
msgid "Same as original"
msgstr "Identique à l’original"

# @ post-duplicator
#: includes/settings.php:36
msgid "Draft"
msgstr "Brouillon"

# @ post-duplicator
#: includes/settings.php:37
msgid "Published"
msgstr "Publié"

# @ post-duplicator
#: includes/settings.php:38
msgid "Pending"
msgstr "En attente"

# @ post-duplicator
#: includes/settings.php:51
msgid "Post Date"
msgstr "Date de l’article"

# @ post-duplicator
#: includes/settings.php:54
msgid "Duplicate Timestamp"
msgstr "Plug en double"

# @ post-duplicator
#: includes/settings.php:55
msgid "Current Time"
msgstr "Heure actuelle"

# @ post-duplicator
#: includes/settings.php:78
msgid "Offset Date"
msgstr "Décalage de date"

# @ post-duplicator
#: includes/settings.php:84
msgid " days"
msgstr "jours"

# @ post-duplicator
#: includes/settings.php:91
msgid " hours"
msgstr "heures"

# @ post-duplicator
#: includes/settings.php:98
msgid " minutes"
msgstr "minutes"

# @ post-duplicator
#: includes/settings.php:105
msgid " seconds"
msgstr "secondes"

# @ post-duplicator
#: includes/settings.php:112
msgid "newer"
msgstr "plus récent"

# @ post-duplicator
#: includes/settings.php:113
msgid "older"
msgstr "précédents"

# @ post-duplicator
#: includes/settings.php:159
msgid "Post Duplicator Settings"
msgstr "Paramètres"

# @ post-duplicator
#: includes/settings.php:183
msgid "Customize the settings for duplicated posts."
msgstr "Personnaliser les paramètres des messages dupliqués."

# @ post-duplicator
#: includes/functions.php:18 includes/settings.php:66
msgid "Copy"
msgstr "Exemplaire"

# @ post-duplicator
#: includes/settings.php:62
msgid "Duplicate Title"
msgstr "Titre en double"

# @ post-duplicator
#: includes/settings.php:63
msgid "String that should be appended to the duplicate post's title"
msgstr "Chaîne qui doit être ajoutée au titre de la double post"

# @ post-duplicator
#: includes/settings.php:12 includes/settings.php:13
msgid "Post Duplicator"
msgstr "Duplicateur de post"
Version: 2.17
define ( 'MTPHR_POST_DUPLICATOR_VERSION', '2.17' );
= 2.17 =
* XSS vulnerability fix
* Language file updates

XSS vulnerability fix