CVE-2016-15027 (PHP, published 2023-02-20T17:15Z)
Description: value: A vulnerability was found in meta4creations Post Duplicator Plugin 2.18 on WordPress. It has been classified as problematic. Affected is the function mtphr_post_duplicator_notice of the file includes/notices.php. The manipulation of the argument post-duplicated leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.19 is able to address this issue. The name of the patch is ca67c05e490c0cf93a1e9b2d93bfeff3dd96f594. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221496.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/meta4creations/post-duplicator
Files changed:
includes/notices.php
includes/settings.php
languages/post-duplicator-de_DE.po
languages/post-duplicator-fr.po
languages/post-duplicator-fr_FR.po
m4c-postduplicator.php
readme.txt
Commit message: XSS vulnerability fix

git-svn-id: http://plugins.svn.wordpress.org/post-duplicator/trunk@1388319 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
	$duplicated_id = isset($_GET['post-duplicated']) ? $_GET['post-duplicated'] : '';
		'Post Duplicator',														// The value used to populate the browser's title bar when the menu page is active
		'Post Duplicator',														// The label of this submenu item displayed in the menu
"Project-Id-Version: Post Duplicator v2.8\n"
"PO-Revision-Date: 2015-09-18 01:48:47+0000\n"
"X-Generator: Poedit 1.7.4\n"
"X-Poedit-Language: \n"
"X-Poedit-Country: \n"
"X-Poedit-KeywordsList: __;_e;__ngettext:1,2;_n:1,2;__ngettext_noop:1,2;_n_noop:1,2;_c,_nc:4c,1,2;_x:1,2c;_ex:1,2c;_nx:4c,1,2;_nx_noop:4c,1,2;\n"
"X-Poedit-Bookmarks: \n"
"X-Textdomain-Support: yes"
#: includes/edit.php:17
#@ post-duplicator
#@ post-duplicator
#: includes/settings.php:35
#@ post-duplicator
#@ post-duplicator
#@ post-duplicator
#@ post-duplicator
#: includes/settings.php:44
#@ post-duplicator
#: includes/settings.php:47
#@ post-duplicator
#: includes/settings.php:48
#@ post-duplicator
#: includes/settings.php:55
#@ post-duplicator
#: includes/settings.php:61
#@ post-duplicator
#: includes/settings.php:68
#@ post-duplicator
#: includes/settings.php:75
#@ post-duplicator
#: includes/settings.php:82
#@ post-duplicator
#: includes/settings.php:89
#@ post-duplicator
#: includes/settings.php:90
#@ post-duplicator
#: includes/settings.php:136
#@ post-duplicator
#: includes/settings.php:160
#@ post-duplicator
# Translation of Development (trunk) in French (France)
# This file is distributed under the same license as the Development (trunk) package.
"PO-Revision-Date: 2015-12-07 07:08:49+0000\n"
"Plural-Forms: nplurals=2; plural=n > 1;\n"
"X-Generator: GlotPress/1.0-alpha-1100\n"
"Project-Id-Version: Development (trunk)\n"

#: includes/settings.php:63
msgstr ""
#: includes/settings.php:62
msgstr ""
msgstr ""
msgstr ""
msgstr ""
msgstr ""
msgstr ""
msgstr ""
msgstr ""
msgstr ""
#: includes/settings.php:70
msgstr ""
#: includes/settings.php:76
msgstr ""
#: includes/settings.php:83
msgstr ""
#: includes/settings.php:90
msgstr ""
#: includes/settings.php:97
msgstr ""
#: includes/settings.php:104
msgstr ""
#: includes/settings.php:105
msgstr ""
#: includes/settings.php:151
msgstr ""
#: includes/settings.php:175
msgstr ""
#. Plugin Name of the plugin/theme
msgid "Post Duplicator"
msgstr ""
#. Description of the plugin/theme
msgid "Creates functionality to duplicate any and all post types, including taxonomies & custom fields"
msgstr ""
#. Author of the plugin/theme
msgid "Metaphor Creations"
msgstr ""
#. Author URI of the plugin/theme
msgid "http://www.metaphorcreations.com"
msgstr ""
Version: 2.16
define ( 'MTPHR_POST_DUPLICATOR_VERSION', '2.16' );
Multiple updates

Fixed code:
	$duplicated_id = isset($_GET['post-duplicated']) ? htmlspecialchars($_GET['post-duplicated'], ENT_QUOTES, 'UTF-8') : '';
		__('Post Duplicator', 'post-duplicator'),														// The value used to populate the browser's title bar when the menu page is active
		__('Post Duplicator', 'post-duplicator'),														// The label of this submenu item displayed in the menu
"Project-Id-Version: Post Duplicator v2.16\n"
"PO-Revision-Date: 2016-03-11 12:49-0600\n"
"X-Generator: Poedit 1.8.7\n"
"X-Poedit-KeywordsList: __;_e;__ngettext:1,2;_n:1,2;__ngettext_noop:1,2;_n_noop:1,2;_c,_nc:4c,1,2;_x:1,2c;_ex:1,2c;_nx:4c,1,2;_nx_noop:4c,1,2\n"
"X-Textdomain-Support: yes\n"
"Language: de_DE\n"
# @ post-duplicator
#: includes/edit.php:16
# @ post-duplicator
# @ post-duplicator
#: includes/helpers.php:10 includes/settings.php:35
# @ post-duplicator
# @ post-duplicator
# @ post-duplicator
# @ post-duplicator
#: includes/settings.php:51
# @ post-duplicator
#: includes/settings.php:54
# @ post-duplicator
#: includes/settings.php:55
# @ post-duplicator
#: includes/settings.php:78
# @ post-duplicator
#: includes/settings.php:84
# @ post-duplicator
#: includes/settings.php:91
# @ post-duplicator
#: includes/settings.php:98
# @ post-duplicator
#: includes/settings.php:105
# @ post-duplicator
#: includes/settings.php:112
# @ post-duplicator
#: includes/settings.php:113
# @ post-duplicator
#: includes/settings.php:159
# @ post-duplicator
#: includes/settings.php:183
# @ post-duplicator
#: includes/edit.php:22
#, php-format
msgid "Duplicate %1$s to %2$s"
msgstr "Doppelte %1$s auf %2$s"

# @ post-duplicator
#: includes/functions.php:18 includes/settings.php:66
msgid "Copy"
msgstr "Kopieren"

# @ post-duplicator
#: includes/notices.php:20
msgid "here"
msgstr "hier"

# @ post-duplicator
#: includes/notices.php:21
#, php-format
msgid "Successfully Duplicated! You can edit your new %1$s %2$s."
msgstr "Erfolgreich dupliziert! Sie können Ihre neue %1$s %2$s bearbeiten."

# @ post-duplicator
#: includes/settings.php:12 includes/settings.php:13
msgid "Post Duplicator"
msgstr "Post-Duplizierer"

# @ post-duplicator
#: includes/settings.php:44
msgid "Post Type"
msgstr "Beitragstyp"

# @ post-duplicator
#: includes/settings.php:62
msgid "Duplicate Title"
msgstr "Doppelte Titel"

# @ post-duplicator
#: includes/settings.php:63
msgid "String that should be appended to the duplicate post's title"
msgstr "Zeichenfolge, die an den doppelten Post-Titel angefügt werden soll"

# @ post-duplicator
#: includes/settings.php:70
msgid "Duplicate Slug"
msgstr "Doppelte Schnecke"

# @ post-duplicator
#: includes/settings.php:71
msgid "String that should be appended to the duplicate post's slug"
msgstr "Zeichenfolge, die an den doppelten Post Flug angefügt werden soll"
"Project-Id-Version: Post Duplicator v2.16\n"
"Report-Msgid-Bugs-To: \n"
"POT-Creation-Date: \n"
"PO-Revision-Date: 2016-03-11 12:47-0600\n"
"Last-Translator: \n"
"Language-Team: \n"
"Plural-Forms: nplurals=2; plural=n>1;\n"
"X-Generator: Poedit 1.8.7\n"
"X-Poedit-SourceCharset: utf-8\n"
"X-Poedit-KeywordsList: __;_e;__ngettext:1,2;_n:1,2;__ngettext_noop:1,2;_n_noop:1,2;_c,_nc:4c,1,2;_x:1,2c;_ex:1,2c;_nx:4c,1,2;_nx_noop:4c,1,2\n"
"X-Textdomain-Support: yes\n"
"Language: fr\n"
"X-Poedit-SearchPath-0: .\n"

# @ post-duplicator
#: includes/settings.php:71
msgstr "Chaîne qui doit être ajoutée au plug du double post"
# @ post-duplicator
#: includes/settings.php:70
msgstr "Plug en double"
# @ post-duplicator
#, php-format
msgstr "Dupliquer %1$s %2$s"
# @ post-duplicator
# @ post-duplicator
#, php-format
msgstr "Reproduit avec succès ! Vous pouvez modifier votre nouveau %1$s %2$s."
# @ post-duplicator
# @ post-duplicator
#, php-format
msgstr "Dupliquer %s"
# @ post-duplicator
msgstr "Statut"
# @ post-duplicator
msgstr "Identique à l’original"
# @ post-duplicator
# @ post-duplicator
# @ post-duplicator
# @ post-duplicator
msgstr "Date de l’article"
# @ post-duplicator
msgstr "Plug en double"
# @ post-duplicator
msgstr "Heure actuelle"
# @ post-duplicator
#: includes/settings.php:78
msgstr "Décalage de date"
# @ post-duplicator
#: includes/settings.php:84
msgstr "jours"
# @ post-duplicator
#: includes/settings.php:91
msgstr "heures"
# @ post-duplicator
#: includes/settings.php:98
msgstr "minutes"
# @ post-duplicator
#: includes/settings.php:105
msgstr "secondes"
# @ post-duplicator
#: includes/settings.php:112
msgstr "plus récent"
# @ post-duplicator
#: includes/settings.php:113
msgstr "précédents"
# @ post-duplicator
#: includes/settings.php:159
msgstr "Paramètres"
# @ post-duplicator
#: includes/settings.php:183
msgstr "Personnaliser les paramètres des messages dupliqués."
# @ post-duplicator
#: includes/functions.php:18 includes/settings.php:66
msgid "Copy"
msgstr "Exemplaire"
# @ post-duplicator
#: includes/settings.php:62
msgid "Duplicate Title"
msgstr "Titre en double"
# @ post-duplicator
#: includes/settings.php:63
msgid "String that should be appended to the duplicate post's title"
msgstr "Chaîne qui doit être ajoutée au titre de la double post"
# @ post-duplicator
#: includes/settings.php:12 includes/settings.php:13
msgid "Post Duplicator"
msgstr "Duplicateur de post"
msgid ""
msgstr ""
"Project-Id-Version: Post Duplicator v2.16\n"
"Report-Msgid-Bugs-To: \n"
"POT-Creation-Date: \n"
"PO-Revision-Date: 2016-03-11 12:47-0600\n"
"Last-Translator: \n"
"Language-Team: \n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"Plural-Forms: nplurals=2; plural=n>1;\n"
"X-Generator: Poedit 1.8.7\n"
"X-Poedit-SourceCharset: utf-8\n"
"X-Poedit-KeywordsList: __;_e;__ngettext:1,2;_n:1,2;__ngettext_noop:1,2;_n_noop:1,2;_c,_nc:4c,1,2;_x:1,2c;_ex:1,2c;_nx:4c,1,2;_nx_noop:4c,1,2\n"
"X-Textdomain-Support: yes\n"
"Language: fr_FR\n"
"X-Poedit-SearchPath-0: .\n"

# @ post-duplicator
#: includes/settings.php:71
msgid "String that should be appended to the duplicate post's slug"
msgstr "Chaîne qui doit être ajoutée au plug du double post"

# @ post-duplicator
#: includes/settings.php:70
msgid "Duplicate Slug"
msgstr "Plug en double"

# @ post-duplicator
#: includes/edit.php:22
#, php-format
msgid "Duplicate %1$s to %2$s"
msgstr "Dupliquer %1$s %2$s"

# @ post-duplicator
#: includes/notices.php:20
msgid "here"
msgstr "ici"

# @ post-duplicator
#: includes/notices.php:21
#, php-format
msgid "Successfully Duplicated! You can edit your new %1$s %2$s."
msgstr "Reproduit avec succès ! Vous pouvez modifier votre nouveau %1$s %2$s."

# @ post-duplicator
#: includes/settings.php:44
msgid "Post Type"
msgstr "Type de contenu"

# @ post-duplicator
#: includes/edit.php:16
#, php-format
msgid "Duplicate %s"
msgstr "Dupliquer %s"

# @ post-duplicator
#: includes/settings.php:32
msgid "Post Status"
msgstr "Statut"

# @ post-duplicator
#: includes/helpers.php:10 includes/settings.php:35
msgid "Same as original"
msgstr "Identique à l’original"

# @ post-duplicator
#: includes/settings.php:36
msgid "Draft"
msgstr "Brouillon"

# @ post-duplicator
#: includes/settings.php:37
msgid "Published"
msgstr "Publié"

# @ post-duplicator
#: includes/settings.php:38
msgid "Pending"
msgstr "En attente"

# @ post-duplicator
#: includes/settings.php:51
msgid "Post Date"
msgstr "Date de l’article"

# @ post-duplicator
#: includes/settings.php:54
msgid "Duplicate Timestamp"
msgstr "Plug en double"

# @ post-duplicator
#: includes/settings.php:55
msgid "Current Time"
msgstr "Heure actuelle"

# @ post-duplicator
#: includes/settings.php:78
msgid "Offset Date"
msgstr "Décalage de date"

# @ post-duplicator
#: includes/settings.php:84
msgid " days"
msgstr "jours"

# @ post-duplicator
#: includes/settings.php:91
msgid " hours"
msgstr "heures"

# @ post-duplicator
#: includes/settings.php:98
msgid " minutes"
msgstr "minutes"

# @ post-duplicator
#: includes/settings.php:105
msgid " seconds"
msgstr "secondes"

# @ post-duplicator
#: includes/settings.php:112
msgid "newer"
msgstr "plus récent"

# @ post-duplicator
#: includes/settings.php:113
msgid "older"
msgstr "précédents"

# @ post-duplicator
#: includes/settings.php:159
msgid "Post Duplicator Settings"
msgstr "Paramètres"

# @ post-duplicator
#: includes/settings.php:183
msgid "Customize the settings for duplicated posts."
msgstr "Personnaliser les paramètres des messages dupliqués."

# @ post-duplicator
#: includes/functions.php:18 includes/settings.php:66
msgid "Copy"
msgstr "Exemplaire"

# @ post-duplicator
#: includes/settings.php:62
msgid "Duplicate Title"
msgstr "Titre en double"

# @ post-duplicator
#: includes/settings.php:63
msgid "String that should be appended to the duplicate post's title"
msgstr "Chaîne qui doit être ajoutée au titre de la double post"

# @ post-duplicator
#: includes/settings.php:12 includes/settings.php:13
msgid "Post Duplicator"
msgstr "Duplicateur de post"
Version: 2.17
define ( 'MTPHR_POST_DUPLICATOR_VERSION', '2.17' );
= 2.17 =
* XSS vulnerability fix
* Language file updates

XSS vulnerability fix