CVE-2022-3506: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository barrykooij/related-posts-for-wp prior to 2.1.3.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-10-14T14:15Z
Repository: https://github.com/barrykooij/related-posts-for-wp
Language: PHP
Files changed: classes/settings/class-settings.php
Commit date: 2022-10-13 14:33:29 +0200
Commit message: Escape output in setting fields, fixes XSS CWE-79. Props @und3sc0n0c1d0

Diff: diff --git a/classes/settings/class-settings.php b/classes/settings/class-settings.php
index 457e631..52bfc76 100644
--- a/classes/settings/class-settings.php
+++ b/classes/settings/class-settings.php
@@ -207,17 +207,17 @@ class RP4WP_Settings {
 		switch ( $field['type'] ) {
 			case 'checkbox':
 				echo '<input type="checkbox" name="' . self::PAGE . '[' . $field['id'] . ']' . '" id="' . $field['id'] . '" value="1" ' . checked( 1, $this->get_option( $field['id'] ), false ) . ' />';
 				break;
 			case 'text':
-				echo '<input type="text" name="' . self::PAGE . '[' . $field['id'] . ']' . '" id="' . $field['id'] . '" value="' . $this->get_option( $field['id'] ) . '" class="rp4wp-input-text" />';
+				echo '<input type="text" name="' . self::PAGE . '[' . $field['id'] . ']' . '" id="' . $field['id'] . '" value="' . esc_attr( $this->get_option( $field['id'] ) ) . '" class="rp4wp-input-text" />';
 				break;
 			case 'textarea':
-				echo '<textarea name="' . self::PAGE . '[' . $field['id'] . ']' . '" id="' . $field['id'] . '">' . $this->get_option( $field['id'] ) . '</textarea>';
+				echo '<textarea name="' . self::PAGE . '[' . $field['id'] . ']' . '" id="' . $field['id'] . '">' . esc_html( $this->get_option( $field['id'] ) ) . '</textarea>';
 				break;
 			case 'button_link':
-				echo '<a href="' . $field['href'] . '" class="button">' . $field['default'] . '</a>';
+				echo '<a href="' . esc_attr( $field['href'] ) . '" class="button">' . esc_html( $field['default'] ) . '</a>';
 				break;
 		}
 
 		// Description
 		if ( isset( $field['description'] ) && '' != $field['description'] ) {
@@ -295,6 +295,6 @@ class RP4WP_Settings {
 		$options = $this->get_options();
 
 		return apply_filters( 'rp4wp_' . $option, isset( $options[ $option ] ) ? $options[ $option ] : false );
 	}
 
-}
\ No newline at end of file
+}

Vulnerable code: 				echo '<input type="text" name="' . self::PAGE . '[' . $field['id'] . ']' . '" id="' . $field['id'] . '" value="' . $this->get_option( $field['id'] ) . '" class="rp4wp-input-text" />';
				echo '<textarea name="' . self::PAGE . '[' . $field['id'] . ']' . '" id="' . $field['id'] . '">' . $this->get_option( $field['id'] ) . '</textarea>';
				echo '<a href="' . $field['href'] . '" class="button">' . $field['default'] . '</a>';
}
Fixed code: 				echo '<input type="text" name="' . self::PAGE . '[' . $field['id'] . ']' . '" id="' . $field['id'] . '" value="' . esc_attr( $this->get_option( $field['id'] ) ) . '" class="rp4wp-input-text" />';
				echo '<textarea name="' . self::PAGE . '[' . $field['id'] . ']' . '" id="' . $field['id'] . '">' . esc_html( $this->get_option( $field['id'] ) ) . '</textarea>';
				echo '<a href="' . esc_attr( $field['href'] ) . '" class="button">' . esc_html( $field['default'] ) . '</a>';
}