CVE-2022-4631 (PHP, published 2022-12-21T19:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in WP-Ban. Affected is an unknown function of the file ban-options.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 22b925449c84faa9b7496abe4f8f5661cb5eb3bf. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216480.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/lesterchan/wp-ban
Files changed:
README.md
ban-options.php
wp-ban.php
Commit message: Fixed XSS


Vulnerable code:
language: php
php:
  - "7.3"
  - "7.2"
  - "7.1"
  - "7.0"
  - "5.6"

script:
  - find . \( -name '*.php' \) -exec php -lf {} \;

notifications:
  email: false
Tested up to: 5.9  
Stable tag: 1.69  
### Build Status
[![Build Status](https://travis-ci.org/lesterchan/wp-ban.svg?branch=master)](https://travis-ci.org/lesterchan/wp-ban)

    $banned_message             = ! empty( $_POST['banned_template_message'] )  ? trim( $_POST['banned_template_message'] ) : '';
    if(!empty($banned_ips_post)) {
        foreach($banned_ips_post as $banned_ip) {
            if($admin_login == 'admin' && ($banned_ip == ban_get_ip() || is_admin_ip($banned_ip))) {
                $text .= '<p style="color: blue;">'.sprintf(__('This IP \'%s\' Belongs To The Admin And Will Not Be Added To Ban List', 'wp-ban'),$banned_ip).'</p>';
                $banned_ips[] = trim($banned_ip);
    if( ! empty( $banned_ips_range_post ) ) {
            if( sizeof( $range ) === 2 ) {
                if( $admin_login === 'admin' && ( check_ip_within_range( ban_get_ip(), $range_start, $range_end ) ) ) {
                    $text .= '<p style="color: blue;">'.sprintf( __( 'The Admin\'s IP \'%s\' Fall Within This Range (%s - %s) And Will Not Be Added To Ban List', 'wp-ban' ), ban_get_ip(), $range_start, $range_end ).'</p>';
                    $banned_ips_range[] = trim( $banned_ip_range );
    if(!empty($banned_hosts_post)) {
        foreach($banned_hosts_post as $banned_host) {
            if($admin_login == 'admin' && ($banned_host == @gethostbyaddr(ban_get_ip()) || is_admin_hostname($banned_host))) {
                $text .= '<p style="color: blue;">'.sprintf(__('This Hostname \'%s\' Belongs To The Admin And Will Not Be Added To Ban List', 'wp-ban'), $banned_host).'</p>';
                $banned_hosts[] = trim($banned_host);
    if(!empty($banned_referers_post)) {
        foreach($banned_referers_post as $banned_referer) {
            if(is_admin_referer($banned_referer)) {
                $text .= '<p style="color: blue;">'.sprintf(__('This Referer \'%s\' Belongs To This Site And Will Not Be Added To Ban List', 'wp-ban'), $banned_referer).'</p>';
                $banned_referers[] = trim($banned_referer);
    if(!empty($banned_user_agents_post)) {
        foreach($banned_user_agents_post as $banned_user_agent) {
            if(is_admin_user_agent($banned_user_agent)) {
                $text .= '<p style="color: blue;">'.sprintf(__('This User Agent \'%s\' Is Used By The Current Admin And Will Not Be Added To Ban List', 'wp-ban'), $banned_user_agent).'</p>';
                $banned_user_agents[] = trim($banned_user_agent);
    if(!empty($banned_exclude_ips_post)) {
        foreach($banned_exclude_ips_post as $banned_exclude_ip) {
            $banned_exclude_ips[] = trim($banned_exclude_ip);
    $update_ban_queries[] = update_option('banned_ips', $banned_ips);
    $update_ban_queries[] = update_option('banned_ips_range', $banned_ips_range);
    $update_ban_queries[] = update_option('banned_hosts', $banned_hosts);
    $update_ban_queries[] = update_option('banned_referers', $banned_referers);
    $update_ban_queries[] = update_option('banned_user_agents', $banned_user_agents);
    $update_ban_queries[] = update_option('banned_exclude_ips', $banned_exclude_ips);
    $update_ban_queries[] = update_option('banned_message', $banned_message);
    $update_ban_text[] = __('Banned IPs', 'wp-ban');
    $update_ban_text[] = __('Banned IP Range', 'wp-ban');
    $update_ban_text[] = __('Banned Host Names', 'wp-ban');
    $update_ban_text[] = __('Banned Referers', 'wp-ban');
    $update_ban_text[] = __('Banned User Agents', 'wp-ban');
    $update_ban_text[] = __('Banned Excluded IPs', 'wp-ban');
    $update_ban_text[] = __('Banned Message', 'wp-ban');
    $i=0;
    foreach($update_ban_queries as $update_ban_query) {
        if($update_ban_query) {
            $text .= '<p style="color: green;">'.$update_ban_text[$i].' '.__('Updated', 'wp-ban').'</p>';
    if(empty($text)) {
        $text = '<p style="color: red;">'.__('No Ban Option Updated', 'wp-ban').'</p>';
                default_template = "<!DOCTYPE html>\n<html>\n<head>\n<meta charset=\"utf-8\">\n<title>%SITE_NAME% - %SITE_URL%</title>\n</head>\n<body>\n<div id=\"wp-ban-container\">\n<p style=\"text-align: center; font-weight: bold;\"><?php _e('You Are Banned.', 'wp-ban'); ?></p>\n</div>\n</body>\n</html>";
            <td valign="top" colspan="2" align="center">
Version: 1.69
	Copyright 2016  Lester Chan  (email : lesterchan@gmail.com)
	if( isset( $banned_stats['count'] ) ) {
	if( isset( $banned_stats['users'][$banned_ip] ) ) {
add_action('init', 'banned');
	if($ip == 'unknown') {
	$banned_ips = get_option('banned_ips');
	if(is_array($banned_ips))
		$banned_ips = array_filter($banned_ips);
	$banned_ips_range = get_option('banned_ips_range');
	if(is_array($banned_ips_range))
		$banned_ips_range = array_filter($banned_ips_range);
	$banned_hosts = get_option('banned_hosts');
	if(is_array($banned_hosts))
		$banned_hosts = array_filter($banned_hosts);
	$banned_referers = get_option('banned_referers');
	if(is_array($banned_referers))
		$banned_referers = array_filter($banned_referers);
	$banned_user_agents = get_option('banned_user_agents');
	if(is_array($banned_user_agents))
		$banned_user_agents = array_filter($banned_user_agents);
	if(is_array($banned_exclude_ips))
		$banned_exclude_ips = array_filter($banned_exclude_ips);
	if(!empty($banned_exclude_ips)) {
		foreach($banned_exclude_ips as $banned_exclude_ip) {
			if($ip == $banned_exclude_ip) {
	if( ! $is_excluded ) {
		if( ! empty( $banned_ips_range ) ) {
		if( ! empty( $banned_hosts ) ) {
		if( ! empty( $banned_referers ) && ! empty( $_SERVER['HTTP_REFERER'] ) ) {
		if( ! empty( $banned_user_agents ) && ! empty( $_SERVER['HTTP_USER_AGENT'] ) ) {
	add_option('banned_message', '<!DOCTYPE html>'."\n".
	'<html>'."\n".

Fixed code:
Tested up to: 6.1  
Stable tag: 1.69.1  
### Version 1.69.1
* NEW: Fixed XSS

# Allow HTML
$allowed_tags = wp_kses_allowed_html( 'post' );
$allowed_tags['html'] = true;
$allowed_tags['head'] = true;
$allowed_tags['meta'] = array(
    'charset' => true,
);
$allowed_tags['body'] = true;

    $banned_message             = ! empty( $_POST['banned_template_message'] )  ? wp_kses( trim( $_POST['banned_template_message'] ), $allowed_tags ) : '';
    if ( ! empty( $banned_ips_post ) ) {
        foreach ( $banned_ips_post as $banned_ip ) {
            if( $admin_login === 'admin' && ( $banned_ip === ban_get_ip() || is_admin_ip( $banned_ip ) ) ) {
                $text .= '<p style="color: blue;">' . sprintf( __( 'This IP \'%s\' Belongs To The Admin And Will Not Be Added To Ban List', 'wp-ban' ), $banned_ip ) . '</p>';
                $banned_ips[] = esc_html( trim( $banned_ip ) );
    if ( ! empty( $banned_ips_range_post ) ) {
            if ( sizeof( $range ) === 2 ) {
                if ( $admin_login === 'admin' && ( check_ip_within_range( ban_get_ip(), $range_start, $range_end ) ) ) {
                    $text .= '<p style="color: blue;">' . sprintf( __( 'The Admin\'s IP \'%s\' Fall Within This Range (%s - %s) And Will Not Be Added To Ban List', 'wp-ban' ), ban_get_ip(), $range_start, $range_end ) . '</p>';
                    $banned_ips_range[] = esc_html( trim( $banned_ip_range ) );
    if ( ! empty( $banned_hosts_post ) ) {
        foreach ( $banned_hosts_post as $banned_host ) {
            if ( $admin_login === 'admin' && ( $banned_host === @gethostbyaddr( ban_get_ip() ) || is_admin_hostname( $banned_host ) ) ) {
                $text .= '<p style="color: blue;">' . sprintf( __( 'This Hostname \'%s\' Belongs To The Admin And Will Not Be Added To Ban List', 'wp-ban' ), $banned_host ) . '</p>';
                $banned_hosts[] = esc_html( trim( $banned_host ) );
    if ( ! empty( $banned_referers_post ) ) {
        foreach ( $banned_referers_post as $banned_referer ) {
            if ( is_admin_referer( $banned_referer ) ) {
                $text .= '<p style="color: blue;">' . sprintf( __( 'This Referer \'%s\' Belongs To This Site And Will Not Be Added To Ban List', 'wp-ban' ), $banned_referer ) . '</p>';
                $banned_referers[] = esc_html( trim( $banned_referer ) );
    if ( ! empty( $banned_user_agents_post ) ) {
        foreach ( $banned_user_agents_post as $banned_user_agent ) {
            if ( is_admin_user_agent( $banned_user_agent ) ) {
                $text .= '<p style="color: blue;">' . sprintf( __( 'This User Agent \'%s\' Is Used By The Current Admin And Will Not Be Added To Ban List', 'wp-ban' ), $banned_user_agent ) . '</p>';
                $banned_user_agents[] = esc_html( trim( $banned_user_agent ) );
    if ( ! empty( $banned_exclude_ips_post ) ) {
        foreach ( $banned_exclude_ips_post as $banned_exclude_ip ) {
            $banned_exclude_ips[] = esc_html( trim( $banned_exclude_ip ) );
    $update_ban_queries[] = update_option( 'banned_ips', $banned_ips );
    $update_ban_queries[] = update_option( 'banned_ips_range', $banned_ips_range );
    $update_ban_queries[] = update_option( 'banned_hosts', $banned_hosts );
    $update_ban_queries[] = update_option( 'banned_referers', $banned_referers );
    $update_ban_queries[] = update_option( 'banned_user_agents', $banned_user_agents );
    $update_ban_queries[] = update_option( 'banned_exclude_ips', $banned_exclude_ips );
    $update_ban_queries[] = update_option( 'banned_message', $banned_message );
    $update_ban_text[] = __( 'Banned IPs', 'wp-ban');
    $update_ban_text[] = __( 'Banned IP Range', 'wp-ban');
    $update_ban_text[] = __( 'Banned Host Names', 'wp-ban');
    $update_ban_text[] = __( 'Banned Referers', 'wp-ban');
    $update_ban_text[] = __( 'Banned User Agents', 'wp-ban');
    $update_ban_text[] = __( 'Banned Excluded IPs', 'wp-ban');
    $update_ban_text[] = __( 'Banned Message', 'wp-ban');
    $i = 0;
    foreach ( $update_ban_queries as $update_ban_query ) {
        if ( $update_ban_query ) {
            $text .= '<p style="color: green;">' . $update_ban_text[$i] . ' ' . __( 'Updated', 'wp-ban' ) . '</p>';
    if ( empty( $text ) ) {
        $text = '<p style="color: red;">' . __( 'No Ban Option Updated', 'wp-ban' ) . '</p>';
                default_template = "<html>\n<head>\n<meta charset=\"utf-8\">\n<title>%SITE_NAME% - %SITE_URL%</title>\n</head>\n<body>\n<div id=\"wp-ban-container\">\n<p style=\"text-align: center; font-weight: bold;\"><?php _e('You Are Banned.', 'wp-ban'); ?></p>\n</div>\n</body>\n</html>";
            <td valign="top" colspan="2" style="text-align: center;">
Version: 1.69.1
	Copyright 2022  Lester Chan  (email : lesterchan@gmail.com)
	if ( isset( $banned_stats['count'] ) ) {
	if ( isset( $banned_stats['users'][$banned_ip] ) ) {
	echo '<!DOCTYPE html>' . "\n";
add_action( 'init', 'banned' );
	if ( $ip === 'unknown' ) {
	$banned_ips = get_option( 'banned_ips' );
	if ( is_array( $banned_ips ) )
		$banned_ips = array_filter( $banned_ips );
	$banned_ips_range = get_option( 'banned_ips_range' );
	if ( is_array( $banned_ips_range ) )
		$banned_ips_range = array_filter( $banned_ips_range );
	$banned_hosts = get_option( 'banned_hosts' );
	if ( is_array( $banned_hosts ) )
		$banned_hosts = array_filter( $banned_hosts );
	$banned_referers = get_option( 'banned_referers' );
	if ( is_array( $banned_referers ) )
		$banned_referers = array_filter( $banned_referers );
	$banned_user_agents = get_option( 'banned_user_agents' );
	if ( is_array( $banned_user_agents ) )
		$banned_user_agents = array_filter( $banned_user_agents );
	if ( is_array( $banned_exclude_ips ) )
		$banned_exclude_ips = array_filter( $banned_exclude_ips );
	if ( ! empty( $banned_exclude_ips ) ) {
		foreach( $banned_exclude_ips as $banned_exclude_ip ) {
			if ( $ip === $banned_exclude_ip ) {
	if ( ! $is_excluded ) {
		if ( ! empty( $banned_ips_range ) ) {
		if ( ! empty( $banned_hosts ) ) {
		if ( ! empty( $banned_referers ) && ! empty( $_SERVER['HTTP_REFERER'] ) ) {
		if ( ! empty( $banned_user_agents ) && ! empty( $_SERVER['HTTP_USER_AGENT'] ) ) {
	add_option('banned_message', '<html>'."\n".