CVE-2023-48300: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The `Embed Privacy` plugin for WordPress that prevents the loading of embedded external content is vulnerable to Stored Cross-Site Scripting via `embed_privacy_opt_out` shortcode in versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Version 1.8.1 contains a patch for this issue.

CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-11-20T19:15Z
Repository: https://github.com/epiphyt/embed-privacy
Language: PHP
Files changed: CHANGELOG.md, SECURITY.md, embed-privacy.php, inc/class-embed-privacy.php, readme.txt
Commit date: 2023-11-01 16:50:06 +0100
Commit message: 🔒️ Properly sanitize show_all attribute in shortcode
Closes #199

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 85eb1aa..a47b3d1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,7 +1,10 @@
 # Changelog
 
+## 1.8.1
+* Fixed the output of the opt-out shortcode
+
 ## 1.8.0
 * Added support for Anghami
 * Added filter to prevent thumbnail orphan deletion
 * Added check for PHP DOM extension
 * Improved loading embed providers
diff --git a/SECURITY.md b/SECURITY.md
index 1b544b0..580f26c 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -4,12 +4,12 @@
 
 We usually only support the latest major version.
 
 | Version | Supported          |
 | ------- | ------------------ |
-| 1.7.x   | :white_check_mark: |
-| < 1.7   | :x:                |
+| 1.8.x   | :white_check_mark: |
+| < 1.8   | :x:                |
 
 ## Reporting a Vulnerability
 
 Please report any vulnerability via <hey.security@epiph.yt>. You should receive
 an answer within 24 hours. You will be informed about if the vulnerability is
diff --git a/embed-privacy.php b/embed-privacy.php
index 9349ce6..c7cf700 100644
--- a/embed-privacy.php
+++ b/embed-privacy.php
@@ -2,11 +2,11 @@
 namespace epiphyt\Embed_Privacy;
 
 /*
 Plugin Name:	Embed Privacy
 Description:	Embed Privacy prevents from loading external embeds directly and lets the user control which one should be loaded.
-Version:		1.8.0
+Version:		1.8.1
 Author:			Epiphyt
 Author URI:		https://epiph.yt
 License:		GPL2
 License URI:	https://www.gnu.org/licenses/gpl-2.0.html
 Text Domain:	embed-privacy
@@ -27,11 +27,11 @@ along with Embed Privacy. If not, see https://www.gnu.org/licenses/gpl-2.0.html.
 */
 
 // exit if ABSPATH is not defined
 \defined( 'ABSPATH' ) || exit;
 
-\define( 'EMBED_PRIVACY_VERSION', '1.8.0' );
+\define( 'EMBED_PRIVACY_VERSION', '1.8.1' );
 
 if ( ! \defined( 'EPI_EMBED_PRIVACY_BASE' ) ) {
 	\define( 'EPI_EMBED_PRIVACY_BASE', \WP_PLUGIN_DIR . '/embed-privacy/' );
 }
 
diff --git a/inc/class-embed-privacy.php b/inc/class-embed-privacy.php
index e1063de..d180c09 100644
--- a/inc/class-embed-privacy.php
+++ b/inc/class-embed-privacy.php
@@ -2161,11 +2161,11 @@ class Embed_Privacy {
 		 * @param	string	$subline Current subline HTML
 		 * @param	array	$attributes Shortcode attributes
 		 */
 		$subline = \apply_filters( 'embed_privacy_opt_out_subline', '<p>' . \esc_html( $attributes['subline'] ) . '</p>' . \PHP_EOL, $attributes );
 		
-		$output = '<div class="embed-privacy-opt-out" data-show-all="' . $attributes['show_all'] . '">' . \PHP_EOL . $headline . $subline;
+		$output = '<div class="embed-privacy-opt-out" data-show-all="' . ( $attributes['show_all'] ? 1 : 0 ) . '">' . \PHP_EOL . $headline . $subline;
 		
 		foreach ( $embed_providers as $provider ) {
 			if ( $is_javascript_detection ) {
 				$is_checked = false;
 			}
diff --git a/readme.txt b/readme.txt
index e9460ce..b3ff775 100644
--- a/readme.txt
+++ b/readme.txt
@@ -167,10 +167,13 @@ Check out our documentation: [https://epiph.yt/en/embed-privacy/documentation/](
 We are [Epiphyt](https://epiph.yt/), your friendly neighborhood WordPress plugin shop from southern Germany.
 
 
 == Changelog ==
 
+= 1.8.1 =
+* Fixed the output of the opt-out shortcode
+
 = 1.8.0 =
 * Added support for Anghami
 * Added filter to prevent thumbnail orphan deletion
 * Added check for PHP DOM extension
 * Improved loading embed providers

Vulnerable code: | 1.7.x   | :white_check_mark: |
| < 1.7   | :x:                |
Version:		1.8.0
\define( 'EMBED_PRIVACY_VERSION', '1.8.0' );
		$output = '<div class="embed-privacy-opt-out" data-show-all="' . $attributes['show_all'] . '">' . \PHP_EOL . $headline . $subline;
Fixed code: ## 1.8.1
* Fixed the output of the opt-out shortcode

| 1.8.x   | :white_check_mark: |
| < 1.8   | :x:                |
Version:		1.8.1
\define( 'EMBED_PRIVACY_VERSION', '1.8.1' );
		$output = '<div class="embed-privacy-opt-out" data-show-all="' . ( $attributes['show_all'] ? 1 : 0 ) . '">' . \PHP_EOL . $headline . $subline;
= 1.8.1 =
* Fixed the output of the opt-out shortcode