CVE-2014-7138: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gce_feed_ids parameter in a gce_ajax action to wp-admin/admin-ajax.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-10-16T19:55Z
Repository: https://github.com/pderksen/WP-Google-Calendar-Events
Language: PHP
Files changed: google-calendar-events/includes/misc-functions.php
Commit date: 2014-10-06 14:25:05 -0600
Commit message: Added esc_html to ajax post values

Diff: diff --git a/google-calendar-events/includes/misc-functions.php b/google-calendar-events/includes/misc-functions.php
index e27017c..d7c5098 100644
--- a/google-calendar-events/includes/misc-functions.php
+++ b/google-calendar-events/includes/misc-functions.php
@@ -111,16 +111,16 @@ function gce_ajax() {
     // generated nonce we created earlier
     if ( ! wp_verify_nonce( $nonce, 'gce_ajax_nonce' ) ) {
         die ( 'Request has failed.');
 	} 
    
-	   $ids    = $_POST['gce_feed_ids'];
-	   $title  = $_POST['gce_title_text'];
-	   $month  = $_POST['gce_month'];
-	   $year   = $_POST['gce_year'];
-	   $paging = $_POST['gce_paging'];
-	   $type   = $_POST['gce_type'];
+	   $ids    = esc_html( $_POST['gce_feed_ids'] );
+	   $title  = esc_html( $_POST['gce_title_text'] );
+	   $month  = esc_html( $_POST['gce_month'] );
+	   $year   = esc_html( $_POST['gce_year'] );
+	   $paging = esc_html( $_POST['gce_paging'] );
+	   $type   = esc_html( $_POST['gce_type'] );
 
 	   $title = ( 'null' == $title ) ? null : $title;
 
 	   $args = array(
 		   'title_text' => $title,
@@ -155,20 +155,20 @@ function gce_ajax_list() {
     // generated nonce we created earlier
     if ( ! wp_verify_nonce( $nonce, 'gce_ajax_nonce' ) ) {
         die ( 'Request has failed.');
 	}
   
-	$grouped          = $_POST['gce_grouped'];
-	$start            = $_POST['gce_start'];
-	$ids              = $_POST['gce_feed_ids'];
-	$title_text       = $_POST['gce_title_text'];
-	$sort             = $_POST['gce_sort'];
-	$paging           = $_POST['gce_paging'];
-	$paging_interval  = $_POST['gce_paging_interval'];
-	$paging_direction = $_POST['gce_paging_direction'];
-	$start_offset     = $_POST['gce_start_offset'];
-	$paging_type      = $_POST['gce_paging_type'];
+	$grouped          = esc_html( $_POST['gce_grouped'] );
+	$start            = esc_html( $_POST['gce_start'] );
+	$ids              = esc_html( $_POST['gce_feed_ids'] );
+	$title_text       = esc_html( $_POST['gce_title_text'] );
+	$sort             = esc_html( $_POST['gce_sort'] );
+	$paging           = esc_html( $_POST['gce_paging'] );
+	$paging_interval  = esc_html( $_POST['gce_paging_interval'] );
+	$paging_direction = esc_html( $_POST['gce_paging_direction'] );
+	$start_offset     = esc_html( $_POST['gce_start_offset'] );
+	$paging_type      = esc_html( $_POST['gce_paging_type'] );
 	
 	if( $paging_direction == 'back' ) {
 		if( $paging_type == 'month' ) {
 
 			$this_month = mktime( 0, 0, 0, date( 'm', $start ) - 1, 1, date( 'Y', $start ) );

Vulnerable code: 	   $ids    = $_POST['gce_feed_ids'];
	   $title  = $_POST['gce_title_text'];
	   $month  = $_POST['gce_month'];
	   $year   = $_POST['gce_year'];
	   $paging = $_POST['gce_paging'];
	   $type   = $_POST['gce_type'];
	$grouped          = $_POST['gce_grouped'];
	$start            = $_POST['gce_start'];
	$ids              = $_POST['gce_feed_ids'];
	$title_text       = $_POST['gce_title_text'];
	$sort             = $_POST['gce_sort'];
	$paging           = $_POST['gce_paging'];
	$paging_interval  = $_POST['gce_paging_interval'];
	$paging_direction = $_POST['gce_paging_direction'];
	$start_offset     = $_POST['gce_start_offset'];
	$paging_type      = $_POST['gce_paging_type'];
Fixed code: 	   $ids    = esc_html( $_POST['gce_feed_ids'] );
	   $title  = esc_html( $_POST['gce_title_text'] );
	   $month  = esc_html( $_POST['gce_month'] );
	   $year   = esc_html( $_POST['gce_year'] );
	   $paging = esc_html( $_POST['gce_paging'] );
	   $type   = esc_html( $_POST['gce_type'] );
	$grouped          = esc_html( $_POST['gce_grouped'] );
	$start            = esc_html( $_POST['gce_start'] );
	$ids              = esc_html( $_POST['gce_feed_ids'] );
	$title_text       = esc_html( $_POST['gce_title_text'] );
	$sort             = esc_html( $_POST['gce_sort'] );
	$paging           = esc_html( $_POST['gce_paging'] );
	$paging_interval  = esc_html( $_POST['gce_paging_interval'] );
	$paging_direction = esc_html( $_POST['gce_paging_direction'] );
	$start_offset     = esc_html( $_POST['gce_start_offset'] );
	$paging_type      = esc_html( $_POST['gce_paging_type'] );