CVE-2015-10119: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, has been found in View All Posts Page Plugin up to 0.9.0 on WordPress. This issue affects the function action_admin_notices_activation of the file view-all-posts-pages.php. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 0.9.1 is able to address this issue. The patch is named bf914f3a59063fa4df8fd4925ae18a5d852396d7. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-233363.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-07-10T16:15Z
Repository: https://github.com/wp-plugins/view-all-posts-pages
Language: Other
Files changed: readme.txt, view-all-posts-pages.php
Commit date: 2015-04-20 23:14:39 +0000
Commit message: Security update: correct misuse of `add_query_arg()` as identified by Sucuri: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html.

Also bumps WP compatability


git-svn-id: https://plugins.svn.wordpress.org/view-all-posts-pages/trunk@1139958 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/readme.txt b/readme.txt
index d575dea..109476c 100644
--- a/readme.txt
+++ b/readme.txt
@@ -1,12 +1,12 @@
 === View All Post's Pages ===
 Contributors: ethitter, thinkoomph
 Donate link: http://www.thinkoomph.com/plugins-modules/view-all-posts-pages/
 Tags: view all, pages, paged, paged post, multipage, single view, single page, wp_link_pages, nextpage, next page, quicktag
 Requires at least: 3.2.1
-Tested up to: 4.1
-Stable tag: 0.9
+Tested up to: 4.2
+Stable tag: 0.9.1
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 
 Provides a "view all" (single page) option for content paged using WordPress' &lt;!--nextpage--&gt; Quicktag (multipage posts).
 == Description ==
@@ -43,10 +43,13 @@ This plugin is known to conflict with certain plugins, many pertaining to SEO an
 
 * **WordPress SEO by Yoast:** This plugin's `Permalink` options, particularly *Redirect attachment URL's to parent post URL* and *Redirect ugly URL's to clean permalinks. (Not recommended in many cases!)*, interfere with View All Post's Pages' ability to display full content. Both must be disabled, and the site's rewrite rules regenerated (by visiting Options > Permalinks and clicking *Save Changes*), for View All Post's Pages to function.
 
 == Changelog ==
 
+= 0.9.1 =
+* Security update: correct misuse of `add_query_arg()` as identified by Sucuri: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html.
+
 = 0.9 =
 * Move conditional registration of some filters to `init`, both to ensure external code can interact with filters and to avoid PHP notices.
 
 = 0.8.1 =
 * Correct translation implementation issue introduced in v0.8.
@@ -90,10 +93,13 @@ This plugin is known to conflict with certain plugins, many pertaining to SEO an
 = 0.1 =
 * Initial release
 
 == Upgrade Notice ==
 
+= 0.9.1 =
+Security update: correct misuse of `add_query_arg()` as identified by Sucuri: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html.
+
 = 0.9 =
 Recommended update for anyone hoping to use plugin's filters to modify its behaviour.
 
 = 0.8.1 =
 Recommended upgrade for anyone translating plugin's interface.
diff --git a/view-all-posts-pages.php b/view-all-posts-pages.php
index 68a38c2..a552c4d 100644
--- a/view-all-posts-pages.php
+++ b/view-all-posts-pages.php
@@ -1,13 +1,13 @@
 <?php
 /*
 Plugin Name: View All Post's Pages
-Plugin URI: http://www.thinkoomph.com/plugins-modules/view-all-posts-pages/
+Plugin URI: http://www.oomphinc.com/plugins-modules/view-all-posts-pages/
 Description: Provides a "view all" (single page) option for posts, pages, and custom post types paged using WordPress' <a href="http://codex.wordpress.org/Write_Post_SubPanel#Quicktags" target="_blank"><code>&lt;!--nextpage--&gt;</code> Quicktag</a> (multipage posts).
 Author: Erick Hitter & Oomph, Inc.
-Version: 0.9
-Author URI: http://www.thinkoomph.com/
+Version: 0.9.1
+Author URI: http://www.oomphinc.com/
 Text Domain: view_all_posts_pages
 
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or
@@ -684,13 +684,13 @@ class view_all_posts_pages {
 		?>
 
 		<div id="wpf-rewrite-flush-warning" class="error fade">
 			<p><strong><?php _e( 'View All Post\'s Pages', 'view_all_posts_pages' ); ?></strong></p>
 
-			<p><?php printf( __( 'You must refresh your site\'s permalinks before <em>View All Post\'s Pages</em> is fully activated. To do so, go to <a href="%s">Permalinks</a> and click the <strong><em>Save Changes</em></strong> button at the bottom of the screen.', 'view_all_posts_pages' ), admin_url( 'options-permalink.php' ) ); ?></p>
+			<p><?php printf( __( 'You must refresh your site\'s permalinks before <em>View All Post\'s Pages</em> is fully activated. To do so, go to <a href="%s">Permalinks</a> and click the <strong><em>Save Changes</em></strong> button at the bottom of the screen.', 'view_all_posts_pages' ), esc_url( admin_url( 'options-permalink.php' ) ) ); ?></p>
 
-			<p><?php printf( __( 'When finished, click <a href="%s">here</a> to hide this message.', 'view_all_posts_pages' ), admin_url( add_query_arg( $this->notice_key, 1, 'index.php' ) ) ); ?></p>
+			<p><?php printf( __( 'When finished, click <a href="%s">here</a> to hide this message.', 'view_all_posts_pages' ), esc_url( admin_url( add_query_arg( $this->notice_key, 1, 'index.php' ) ) ) ); ?></p>
 		</div>
 
 		<?php
 		endif;
 	}

Vulnerable code: Tested up to: 4.1
Stable tag: 0.9
Plugin URI: http://www.thinkoomph.com/plugins-modules/view-all-posts-pages/
Version: 0.9
Author URI: http://www.thinkoomph.com/
			<p><?php printf( __( 'You must refresh your site\'s permalinks before <em>View All Post\'s Pages</em> is fully activated. To do so, go to <a href="%s">Permalinks</a> and click the <strong><em>Save Changes</em></strong> button at the bottom of the screen.', 'view_all_posts_pages' ), admin_url( 'options-permalink.php' ) ); ?></p>
			<p><?php printf( __( 'When finished, click <a href="%s">here</a> to hide this message.', 'view_all_posts_pages' ), admin_url( add_query_arg( $this->notice_key, 1, 'index.php' ) ) ); ?></p>
Fixed code: Tested up to: 4.2
Stable tag: 0.9.1
= 0.9.1 =
* Security update: correct misuse of `add_query_arg()` as identified by Sucuri: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html.

= 0.9.1 =
Security update: correct misuse of `add_query_arg()` as identified by Sucuri: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html.

Plugin URI: http://www.oomphinc.com/plugins-modules/view-all-posts-pages/
Version: 0.9.1
Author URI: http://www.oomphinc.com/
			<p><?php printf( __( 'You must refresh your site\'s permalinks before <em>View All Post\'s Pages</em> is fully activated. To do so, go to <a href="%s">Permalinks</a> and click the <strong><em>Save Changes</em></strong> button at the bottom of the screen.', 'view_all_posts_pages' ), esc_url( admin_url( 'options-permalink.php' ) ) ); ?></p>
			<p><?php printf( __( 'When finished, click <a href="%s">here</a> to hide this message.', 'view_all_posts_pages' ), esc_url( admin_url( add_query_arg( $this->notice_key, 1, 'index.php' ) ) ) ); ?></p>