CVE-2015-5532 (PHP, published 2017-10-23T18:29Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1.8.4.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) s parameter to membershiplevels.php, (2) memberslist.php, or (3) orders.php in adminpages/ or the (4) edit parameter to adminpages/membershiplevels.php.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/strangerstudios/paid-memberships-pro
Files changed:
adminpages/advancedsettings.php
adminpages/discountcodes.php
adminpages/membershiplevels.php
adminpages/memberslist-csv.php
adminpages/memberslist.php
adminpages/orders-csv.php
adminpages/orders.php
adminpages/reports.php
readme.txt
Commit message: SECURITY PATCH: Fixes to Cross Site Scripting vulnerabilities in the PMPro settings pages in the WordPress dashboard. [Advisory ID HTB23264](https://www.htbridge.com/advisory/HTB23264). (Thanks, High-Tech Bridge Security Research Lab)


Vulnerable code:
					<input type="text" name="recaptcha_publickey" size="60" value="<?php echo $recaptcha_publickey?>" />
					<input type="text" name="recaptcha_privatekey" size="60" value="<?php echo $recaptcha_privatekey?>" />
                                   value="<?php echo pmpro_getOption($field['field_name']); ?> ">
                                <?php echo pmpro_getOption($field['field_name']); ?>
		$edit = $_REQUEST['edit'];
		$delete = $_REQUEST['delete'];
		$saveid = $_POST['saveid'];
		$code = $_POST['code'];
		$starts_month = $_POST['starts_month'];
		$starts_day = $_POST['starts_day'];
		$starts_year = $_POST['starts_year'];
		$expires_month = $_POST['expires_month'];
		$expires_day = $_POST['expires_day'];
		$expires_year = $_POST['expires_year'];
		$uses = $_POST['uses'];
					$initial_payment = $initial_payment_a[$n];
						$billing_amount = $billing_amount_a[$n];
						$cycle_number = $cycle_number_a[$n];
						$cycle_period = $cycle_period_a[$n];
						$billing_limit = $billing_limit_a[$n];
							$trial_amount = $trial_amount_a[$n];
							$trial_limit = $trial_limit_a[$n];
						$expiration_number = $expiration_number_a[$n];
						$expiration_period = $expiration_period_a[$n];
		$edit = $_REQUEST['edit'];	
		$copy = $_REQUEST['copy'];
		$s = $_REQUEST['s'];
		$action = $_REQUEST['action'];
		$saveandnext = $_REQUEST['saveandnext'];
		$saveid = $_REQUEST['saveid'];
		$deleteid = $_REQUEST['deleteid'];
		$ml_id = $_REQUEST['deleteid'];
			<input name="saveid" type="hidden" value="<?php echo $edit?>" />
			<input id="post-search-input" type="text" value="<?php echo $s?>" name="s" size="30" />
		$s = $_REQUEST['s'];
		$l = $_REQUEST['l'];
		$s = trim($_REQUEST['s']);
		$l = $_REQUEST['l'];
		<a target="_blank" href="<?php echo admin_url('admin-ajax.php');?>?action=memberslist_csv&s=<?php echo $s?>&l=<?php echo $l?>" class="add-new-h2"><?php _e('Export to CSV', 'pmpro');?></a>
		<input id="post-search-input" type="text" value="<?php echo $s?>" name="s"/>
							<td><a href="mailto:<?php echo $theuser->user_email?>"><?php echo $theuser->user_email?></a></td>
					<td colspan="9"><p><?php _e("No members found.", "pmpro");?> <?php if($l) { ?><a href="?page=pmpro-memberslist&s=<?php echo $s?>"><?php _e("Search all levels", "pmpro");?></a>.<?php } ?></p></td>
		$s = $_REQUEST['s'];
		$l = $_REQUEST['l'];
		$start_month = $_REQUEST['start-month'];
		$start_day = $_REQUEST['start-day'];
		$start_year = $_REQUEST['start-year'];
		$end_month = $_REQUEST['end-month'];
		$end_day = $_REQUEST['end-day'];
		$end_year = $_REQUEST['end-year'];
		$predefined_date = $_REQUEST['predefined-date'];
		$status = $_REQUEST['status'];
		$s = trim($_REQUEST['s']);
		$l = $_REQUEST['l'];
		$start_month = $_REQUEST['start-month'];
		$start_day = $_REQUEST['start-day'];
		$start_year = $_REQUEST['start-year'];
		$end_month = $_REQUEST['end-month'];
		$end_day = $_REQUEST['end-day'];
		$end_year = $_REQUEST['end-year'];
		$predefined_date = $_REQUEST['predefined-date'];
		$status = $_REQUEST['status'];
						<input name="ts_day" type="text" size="2" value="<?php echo $day?>" />
						<input name="ts_year" type="text" size="4" value="<?php echo $year?>" />
			<input id='start-day' name="start-day" type="text" size="2" value="<?php echo $start_day?>" />
			<input id='start-year' name="start-year" type="text" size="4" value="<?php echo $start_year?>" />
			<input id='end-day' name="end-day" type="text" size="2" value="<?php echo $end_day?>" />
			<input id='end-year' name="end-year" type="text" size="4" value="<?php echo $end_year?>" />
		<input id="post-search-input" type="text" value="<?php echo $s?>" name="s"/>
		$report = $_REQUEST['report'];

Fixed code:
					<input type="text" name="recaptcha_publickey" size="60" value="<?php echo esc_attr($recaptcha_publickey);?>" />
					<input type="text" name="recaptcha_privatekey" size="60" value="<?php echo esc_attr($recaptcha_privatekey);?>" />
                                   value="<?php echo esc_attr(pmpro_getOption($field['field_name'])); ?> ">
                                <?php echo esc_textarea(pmpro_getOption($field['field_name'])); ?>
		$edit = intval($_REQUEST['edit']);
		$delete = intval($_REQUEST['delete']);
		$saveid = intval($_POST['saveid']);
		$code = sanitize_text_field($_POST['code']);
		$starts_month = intval($_POST['starts_month']);
		$starts_day = intval($_POST['starts_day']);
		$starts_year = intval($_POST['starts_year']);
		$expires_month = intval($_POST['expires_month']);
		$expires_day = intval($_POST['expires_day']);
		$expires_year = intval($_POST['expires_year']);
		$uses = intval($_POST['uses']);
					$initial_payment = sanitize_text_field($initial_payment_a[$n]);
						$billing_amount = sanitize_text_field($billing_amount_a[$n]);
						$cycle_number = intval($cycle_number_a[$n]);
						$cycle_period = sanitize_text_field($cycle_period_a[$n]);
						$billing_limit = intval($billing_limit_a[$n]);
							$trial_amount = sanitize_text_field($trial_amount_a[$n]);
							$trial_limit = intval($trial_limit_a[$n]);
						$expiration_number = intval($expiration_number_a[$n]);
						$expiration_period = sanitize_text_field($expiration_period_a[$n]);
		$edit = intval($_REQUEST['edit']);
		$copy = intval($_REQUEST['copy']);
		$s = sanitize_text_field($_REQUEST['s']);
		$action = sanitize_text_field($_REQUEST['action']);
		$saveandnext = intval($_REQUEST['saveandnext']);
		$saveid = intval($_REQUEST['saveid']);
		$deleteid = intval($_REQUEST['deleteid']);
		$ml_id = intval($_REQUEST['deleteid']);
			<input name="saveid" type="hidden" value="<?php echo esc_attr($edit); ?>" />
			<input id="post-search-input" type="text" value="<?php echo esc_attr($s); ?>" name="s" size="30" />
		$s = sanitize_text_field($_REQUEST['s']);
		$l = intval($_REQUEST['l']);
		$s = sanitize_text_field(trim($_REQUEST['s']));
		$l = intval($_REQUEST['l']);
		<a target="_blank" href="<?php echo admin_url('admin-ajax.php');?>?action=memberslist_csv&s=<?php echo esc_attr($s);?>&l=<?php echo $l?>" class="add-new-h2"><?php _e('Export to CSV', 'pmpro');?></a>
		<input id="post-search-input" type="text" value="<?php echo esc_attr($s);?>" name="s"/>
							<td><a href="mailto:<?php echo esc_attr($theuser->user_email)?>"><?php echo $theuser->user_email?></a></td>
					<td colspan="9"><p><?php _e("No members found.", "pmpro");?> <?php if($l) { ?><a href="?page=pmpro-memberslist&s=<?php echo esc_attr($s);?>"><?php _e("Search all levels", "pmpro");?></a>.<?php } ?></p></td>
		$s = sanitize_text_field($_REQUEST['s']);
		$l = intval($_REQUEST['l']);
		$start_month = intval($_REQUEST['start-month']);
		$start_day = intval($_REQUEST['start-day']);
		$start_year = intval($_REQUEST['start-year']);
		$end_month = intval($_REQUEST['end-month']);
		$end_day = intval($_REQUEST['end-day']);
		$end_year = intval($_REQUEST['end-year']);
		$predefined_date = sanitize_text_field($_REQUEST['predefined-date']);
		$status = sanitize_text_field($_REQUEST['status']);
		$s = sanitize_text_field(trim($_REQUEST['s']));
		$l = intval($_REQUEST['l']);
		$start_month = intval($_REQUEST['start-month']);
		$start_day = intval($_REQUEST['start-day']);
		$start_year = intval($_REQUEST['start-year']);
		$end_month = intval($_REQUEST['end-month']);
		$end_day = intval($_REQUEST['end-day']);
		$end_year = intval($_REQUEST['end-year']);
		$predefined_date = sanitize_text_field($_REQUEST['predefined-date']);
		$status = sanitize_text_field($_REQUEST['status']);
						<input name="ts_day" type="text" size="2" value="<?php echo esc_attr($day);?>" />
						<input name="ts_year" type="text" size="4" value="<?php echo esc_attr($year);?>" />
			<input id='start-day' name="start-day" type="text" size="2" value="<?php echo esc_attr($start_day);?>" />
			<input id='start-year' name="start-year" type="text" size="4" value="<?php echo esc_attr($start_year);?>" />
			<input id='end-day' name="end-day" type="text" size="2" value="<?php echo esc_attr($end_day);?>" />
			<input id='end-year' name="end-year" type="text" size="4" value="<?php echo esc_attr($end_year);?>" />
		<input id="post-search-input" type="text" value="<?php echo esc_attr($s);?>" name="s"/>
		$report = sanitize_text_field($_REQUEST['report']);
= 1.8.4.3 = 
* SECURITY PATCH: Fixes to Cross Site Scripting vulnerabilities in the PMPro settings pages in the WordPress dashboard. [Advisory ID HTB23264](https://www.htbridge.com/advisory/HTB23264). (Thanks, High-Tech Bridge Security Research Lab)