Vulnerability: Cross-site scripting (XSS) vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gce_feed_ids parameter in a gce_ajax action to wp-admin/admin-ajax.php.
Vulnerability ID: CVE-2014-7138
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/pderksen/WP-Google-Calendar-Events
Published: 2014-10-16
File: google-calendar-events/includes/misc-functions.php
Commit message: Added esc_html to ajax post values
Commit author: Nick Young

Vulnerable version (before fix):
 function gce_ajax() {         die ( 'Request has failed.'); 	}      	   $ids    = $_POST['gce_feed_ids']; 	   $title  = $_POST['gce_title_text']; 	   $month  = $_POST['gce_month']; 	   $year   = $_POST['gce_year']; 	   $paging = $_POST['gce_paging']; 	   $type   = $_POST['gce_type'];  	   $title = ( 'null' == $title ) ? null : $title;  function gce_ajax_list() {         die ( 'Request has failed.'); 	}    	$grouped          = $_POST['gce_grouped']; 	$start            = $_POST['gce_start']; 	$ids              = $_POST['gce_feed_ids']; 	$title_text       = $_POST['gce_title_text']; 	$sort             = $_POST['gce_sort']; 	$paging           = $_POST['gce_paging']; 	$paging_interval  = $_POST['gce_paging_interval']; 	$paging_direction = $_POST['gce_paging_direction']; 	$start_offset     = $_POST['gce_start_offset']; 	$paging_type      = $_POST['gce_paging_type']; 	 	if( $paging_direction == 'back' ) { 		if( $paging_type == 'month' ) {

Fixed version (after fix):
 function gce_ajax() {         die ( 'Request has failed.'); 	}      	   $ids    = esc_html( $_POST['gce_feed_ids'] ); 	   $title  = esc_html( $_POST['gce_title_text'] ); 	   $month  = esc_html( $_POST['gce_month'] ); 	   $year   = esc_html( $_POST['gce_year'] ); 	   $paging = esc_html( $_POST['gce_paging'] ); 	   $type   = esc_html( $_POST['gce_type'] );  	   $title = ( 'null' == $title ) ? null : $title;  function gce_ajax_list() {         die ( 'Request has failed.'); 	}    	$grouped          = esc_html( $_POST['gce_grouped'] ); 	$start            = esc_html( $_POST['gce_start'] ); 	$ids              = esc_html( $_POST['gce_feed_ids'] ); 	$title_text       = esc_html( $_POST['gce_title_text'] ); 	$sort             = esc_html( $_POST['gce_sort'] ); 	$paging           = esc_html( $_POST['gce_paging'] ); 	$paging_interval  = esc_html( $_POST['gce_paging_interval'] ); 	$paging_direction = esc_html( $_POST['gce_paging_direction'] ); 	$start_offset     = esc_html( $_POST['gce_start_offset'] ); 	$paging_type      = esc_html( $_POST['gce_paging_type'] ); 	 	if( $paging_direction == 'back' ) { 		if( $paging_type == 'month' ) {

Patch:
patch: @@ -113,12 +113,12 @@ function gce_ajax() {
         die ( 'Request has failed.');
 	} 
    
-	   $ids    = $_POST['gce_feed_ids'];
-	   $title  = $_POST['gce_title_text'];
-	   $month  = $_POST['gce_month'];
-	   $year   = $_POST['gce_year'];
-	   $paging = $_POST['gce_paging'];
-	   $type   = $_POST['gce_type'];
+	   $ids    = esc_html( $_POST['gce_feed_ids'] );
+	   $title  = esc_html( $_POST['gce_title_text'] );
+	   $month  = esc_html( $_POST['gce_month'] );
+	   $year   = esc_html( $_POST['gce_year'] );
+	   $paging = esc_html( $_POST['gce_paging'] );
+	   $type   = esc_html( $_POST['gce_type'] );
 
 	   $title = ( 'null' == $title ) ? null : $title;
 
@@ -157,16 +157,16 @@ function gce_ajax_list() {
         die ( 'Request has failed.');
 	}
   
-	$grouped          = $_POST['gce_grouped'];
-	$start            = $_POST['gce_start'];
-	$ids              = $_POST['gce_feed_ids'];
-	$title_text       = $_POST['gce_title_text'];
-	$sort             = $_POST['gce_sort'];
-	$paging           = $_POST['gce_paging'];
-	$paging_interval  = $_POST['gce_paging_interval'];
-	$paging_direction = $_POST['gce_paging_direction'];
-	$start_offset     = $_POST['gce_start_offset'];
-	$paging_type      = $_POST['gce_paging_type'];
+	$grouped          = esc_html( $_POST['gce_grouped'] );
+	$start            = esc_html( $_POST['gce_start'] );
+	$ids              = esc_html( $_POST['gce_feed_ids'] );
+	$title_text       = esc_html( $_POST['gce_title_text'] );
+	$sort             = esc_html( $_POST['gce_sort'] );
+	$paging           = esc_html( $_POST['gce_paging'] );
+	$paging_interval  = esc_html( $_POST['gce_paging_interval'] );
+	$paging_direction = esc_html( $_POST['gce_paging_direction'] );
+	$start_offset     = esc_html( $_POST['gce_start_offset'] );
+	$paging_type      = esc_html( $_POST['gce_paging_type'] );
 	
 	if( $paging_direction == 'back' ) {
 		if( $paging_type == 'month' ) {
path: google-calendar-events/includes/misc-functions.php