CVE-2015-10075 (PHP, published 2023-02-07T12:15Z)
Description: value: A vulnerability was found in Custom-Content-Width 1.0. It has been declared as problematic. Affected by this vulnerability is the function override_content_width/register_settings of the file custom-content-width.php. The manipulation leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.1 is able to address this issue. The patch is named e05e0104fc42ad13b57e2b2cb2d1857432624d39. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220219. NOTE: This attack is not very likely.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/georgestephanis/Custom-Content-Width
Files changed:
custom-content-width.php
readme.txt
Commit message: Validate width values to avoid unlikely security vulnerabilities.

If the database were compromised, a value like `500" onclick="alert(1)" foo="` could be inserted into the `custom_content_width` option, resulting in XSS. If the attacker had full access to the database, then they could obviously do much more damage, regardless of whether the widths are validated or not, but there are other scenarios where validating the widths could mitigate an attack, like if a vulnerability elsewhere allowed an attacker to insert an arbitrary value into an arbitrary option record, but they needed to find one that wasn't being escaped.

That's not very likely, but it's better to be safe than sorry.


Vulnerable code:

Fixed code:
<?php
/*
 * Plugin Name: Custom Content Width
 * Plugin URI: http://wordpress.org/plugins/custom-content-width/
 * Description: Adds a 'Custom Content Width' setting to the Settings > Media screen, to let users override their theme's content width.
 * Author: George Stephanis
 * Version: 1.0.1
 * Author URI: http://stephanis.info/
 */

class Stephanis_Custom_Content_Width {
	static $instance;

	function __construct() {
		self::$instance = $this;
		add_action( 'init', array( $this, 'override_content_width' ) );
		add_action( 'admin_init', array( $this, 'register_settings' ) );
	}

	function override_content_width() {
		global $content_width;

		if( ! empty( $content_width ) )
			$this->original_content_width = $content_width;

		if( $custom_content_width = get_option( 'custom_content_width' ) )
			$content_width = absint( $custom_content_width );
	}

	function register_settings() {
		register_setting( 'media', 'custom_content_width', 'intval' );
		$label = __('Custom Content Width', 'custom_content_width' );
		add_settings_field( 'custom_content_width', "<label for='custom_content_width'>{$label}</label>" , array( $this, 'custom_content_width_cb' ) , 'media' );
	}

	function custom_content_width_cb() {
		$value = get_option( 'custom_content_width' );
		?>
		<input type="number" class="small-text" min="0" id="custom_content_width" name="custom_content_width" value="<?php echo $value ? absint( $value ) : ''; ?>" />
		<label for="custom_content_width">px</label>
		<?php if( ! empty( $this->original_content_width ) ): ?>
			<?php if( $value ): ?>
				<small><a href="javascript:;" onclick="jQuery('#custom_content_width').val('');"><?php _e('clear custom value', 'custom_content_width'); ?></a></small>
			<?php endif; ?>
			<br /><em><?php printf( __('Your theme&rsquo;s default content width is %s pixels.', 'custom_content_width'), absint( $this->original_content_width ) ); ?></em>
		<?php endif;
	}
}
new Stephanis_Custom_Content_Width;
=== Custom Content Width ===
Contributors: georgestephanis
Donate link: https://www.charitywater.org/donate
Tags: Theme, Content Width
Requires at least: 2.7
Tested up to: 4.1
Stable tag: 1.0.1
License: GPLv2 or later
License URI: http://www.gnu.org/licenses/gpl-2.0.html

Adds a 'Custom Content Width' setting to the Settings > Media screen, to let users override their theme's content width.

== Description ==

Occasionally, themes forget to set the `$content_width` variable in functions.php.  If they forgot, or if you'd like to change the value that they've set, this will let you in your Settings > Media screen.

== Installation ==

1. Install and activate the plugin via the WordPress Plugin Installer.
2. Go to the Settings > Media screen, and set the Content Width!
3. There is no step three!

== Changelog ==

= 1.0.1 =
* Validate width values to avoid unlikely security vulnerabilities.

= 1.0 =
* Initial release.