CVE-2022-4207 (published 2022-12-13T21:15Z)

The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several values that can be added to an Image Hover in versions 9.8.1 to 9.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, the plugin only allows administrators access to edit Image Hovers, however, if a site admin makes the plugin's features available to lower privileged users through the 'Who Can Edit?' setting then this can be exploited by those users.

CVSS v3 base score: 5.4, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/MrOxizen/image-hover-effects-ultimate
commit_details: repo_url: https://github.com/MrOxizen/image-hover-effects-ultimate
author: Biplob Adhikari
author_date: 2022-12-05 12:52:56+06:00
msg: Update
repository: repo_url: https://github.com/MrOxizen/image-hover-effects-ultimate
repo_name: MrOxizen/image-hover-effects-ultimate
repo_language: PHP
owner: MrOxizen
file_changes: filename: Effects1.php
change_type: ModificationType.MODIFY
diff: @@ -135,7 +135,7 @@ class Effects1 extends Public_Render {
                                         <button class="oxi_addons__button">
                                             <?php $this->text_render($value['oxi_image_light_box_button_text']); ?>
                                         </button>
-                                    </div> 
+                                    </div>
                                     <?php
                                 }
                             } elseif (array_key_exists('oxi_image_light_box_clickable', $style) && $style['oxi_image_light_box_clickable'] == 'image') {

programming_language: PHP
filename: Effects2.php
change_type: ModificationType.MODIFY
diff: @@ -45,23 +45,23 @@ class Effects2 extends Public_Render {
             ?>
             <div class="oxi_addons__light_box_style_2 oxi_addons__light_box <?php $this->column_render('oxi-image-hover-col', $style) ?>  <?php
             echo ($admin == "admin" ? 'oxi-addons-admin-edit-list' : '');
-            ?>"> 
-                <div class="oxi_addons__light_box_parent"> 
+            ?>">
+                <div class="oxi_addons__light_box_parent">
                     <?php
                     if ($this->custom_media_render('oxi_image_light_box_image', $value) != '') {
                         ?>
-                    <div class="oxi_addons__light_box_item  lightbox_key_<?php echo (int) $key; ?>" <?php
+                        <div class="oxi_addons__light_box_item  lightbox_key_<?php echo (int) $key; ?>" <?php
                         if (array_key_exists('oxi_image_light_box_clickable', $style) && $style['oxi_image_light_box_clickable'] == 'image'):
                             echo ' style="width: 100%" ';
                         endif;
-                        ?>>  
-                             <?php
+                        ?>>
+                                 <?php
                                  if (array_key_exists('oxi_image_light_box_clickable', $style) && $style['oxi_image_light_box_clickable'] == 'button') {
                                      if (array_key_exists('oxi_image_light_box_button_text', $value) && $value['oxi_image_light_box_button_text'] != '') {
                                          ?>
                                     <div class="oxi_addons__button_main">
                                         <button class="oxi_addons__button">
-                                            <?php $this->text_render($value['oxi_image_light_box_button_text']) ?> 
+                                            <?php $this->text_render($value['oxi_image_light_box_button_text']) ?>
                                         </button>
                                     </div>
                                     <?php
@@ -92,14 +92,14 @@ class Effects2 extends Public_Render {
                         </div>
                         <?php
                     }
-                    ?>  
+                    ?>
                 </div>
                 <?php
                 if ($admin == 'admin') :
                     $this->oxi_addons_admin_edit_delete_clone($val['id']);
                 endif;
                 ?>
-            </div> 
+            </div>
             <?php
         }
     }
@@ -134,9 +134,9 @@ class Effects2 extends Public_Render {
                         mainClass: "' . $this->WRAPPER . '",
                         callbacks: {
                                     beforeChange: function() {
-                                     this.items[0].src = this.items[0].src + "?=" + Math.random(); 
+                                     this.items[0].src = this.items[0].src + "?=" + Math.random();
                                     }
-                        },  
+                        },
                         closeBtnInside: true,
                         closeOnContentClick: true,
                         tLoading: "",
@@ -161,11 +161,11 @@ class Effects2 extends Public_Render {
                       z-index: ' . ($style['oxi_image_light_z_ind'] + 3) . ';
                   }
 
-                 .oxi-image-hover-wrapper-' . $this->oxiid . ' .Oxipopup-image-holder .Oxipopup-close, 
+                 .oxi-image-hover-wrapper-' . $this->oxiid . ' .Oxipopup-image-holder .Oxipopup-close,
                  .oxi-image-hover-wrapper-' . $this->oxiid . ' .Oxipopup-iframe-holder .Oxipopup-close{
                      color: ' . $style['oxi_image_light_cls_clr'] . ';
                   }
-                 
+
                   .oxi-image-hover-wrapper-' . $this->oxiid . ' .Oxipopup-preloader{
                      background: ' . $style['oxi_image_light_pre_clr'] . ';
                   }';

programming_language: PHP
filename: Public_Render.php
change_type: ModificationType.MODIFY
diff: @@ -11,8 +11,7 @@ if (!defined('ABSPATH')) {
  *
  * @author $biplob018
  */
-class Public_Render
-{
+class Public_Render {
 
     /**
      * Current Elements id
@@ -114,8 +113,7 @@ class Public_Render
     public $dynamicCarousel;
     public $dynamicLoad;
 
-    public function __construct(array $dbdata = [], array $child = [], $admin = 'user')
-    {
+    public function __construct(array $dbdata = [], array $child = [], $admin = 'user') {
         if (count($dbdata) > 0) :
             global $wpdb;
             $this->dbdata = $dbdata;
@@ -144,8 +142,7 @@ class Public_Render
      *
      * @since 9.3.0
      */
-    public function loader()
-    {
+    public function loader() {
         $this->style = json_decode(stripslashes($this->dbdata['rawdata']), true);
         $this->CSSDATA = $this->dbdata['stylesheet'];
         $this->WRAPPER = 'oxi-image-hover-wrapper-' . $this->dbdata['id'];
@@ -157,8 +154,7 @@ class Public_Render
      *
      * @since 9.3.0
      */
-    public function old_loader()
-    {
+    public function old_loader() {
         $this->old_render();
     }
 
@@ -167,8 +163,7 @@ class Public_Render
      *
      * @since 9.3.0
      */
-    public function public_frontend_loader()
-    {
+    public function public_frontend_loader() {
         wp_enqueue_script("jquery");
         wp_enqueue_style('oxi-animation', OXI_IMAGE_HOVER_URL . '/assets/frontend/css/animation.css', false, OXI_IMAGE_HOVER_PLUGIN_VERSION);
         wp_enqueue_style('oxi-image-hover', OXI_IMAGE_HOVER_URL . '/assets/frontend/css/style.css', false, OXI_IMAGE_HOVER_PLUGIN_VERSION);
@@ -187,8 +182,7 @@ class Public_Render
      *
      * @since 9.3.0
      */
-    public function hooks()
-    {
+    public function hooks() {
         $this->public_frontend_loader();
         $this->public_jquery();
         $this->public_css();
@@ -221,9 +215,6 @@ class Public_Render
 
         endif;
         if ($inlinecss != '') :
-
-
-
             $css = html_entity_decode(str_replace('<br>', '', str_replace('&nbsp;', ' ', $inlinecss)));
             if ($this->admin == 'admin' || $this->admin == 'web') :
                 //only load while ajax called
@@ -241,12 +232,11 @@ class Public_Render
      *
      * @since 9.3.0
      */
-    public function render()
-    {
+    public function render() {
         if ($this->admin == 'request') :
             $this->default_render($this->style, $this->child, $this->admin);
         else :
-?>
+            ?>
             <div class="oxi-addons-container noLightbox <?php echo esc_attr($this->WRAPPER); ?> <?php echo esc_attr(get_option('oxi_addons_custom_parent_class')); ?>" id="<?php echo esc_attr($this->WRAPPER); ?>">
                 <div class="oxi-addons-row">
                     <?php
@@ -257,8 +247,8 @@ class Public_Render
         <?php
         endif;
     }
-     public function oxi_addons_admin_edit_delete_clone($param)
-    {
+
+    public function oxi_addons_admin_edit_delete_clone($param) {
         ?>
         <div class="oxi-addons-admin-absulote">
             <div class="oxi-addons-admin-absulate-edit">
@@ -271,7 +261,7 @@ class Public_Render
                 <button class="btn btn-danger shortcode-addons-template-item-delete" type="submit" value="<?php echo esc_attr($param); ?>" title="Delete">Del</button>
             </div>
         </div>
-<?php
+        <?php
     }
 
     /**
@@ -279,8 +269,7 @@ class Public_Render
      *
      * @since 9.3.0
      */
-    public function old_render()
-    {
+    public function old_render() {
         echo '';
     }
 
@@ -289,8 +278,7 @@ class Public_Render
      *
      * @since 9.3.0
      */
-    public function public_jquery()
-    {
+    public function public_jquery() {
         echo '';
     }
 
@@ -299,8 +287,7 @@ class Public_Render
      *
      * @since 9.3.0
      */
-    public function public_css()
-    {
+    public function public_css() {
         echo '';
     }
 
@@ -309,8 +296,7 @@ class Public_Render
      *
      * @since 9.3.0
      */
-    public function inline_public_jquery()
-    {
+    public function inline_public_jquery() {
         echo '';
     }
 
@@ -319,8 +305,7 @@ class Public_Render
      *
      * @since 9.3.0
      */
-    public function inline_public_css()
-    {
+    public function inline_public_css() {
         echo '';
     }
 
@@ -329,8 +314,7 @@ class Public_Render
      *
      * @since 9.3.0
      */
-    public function default_render($style, $child, $admin)
-    {
+    public function default_render($style, $child, $admin) {
         echo '';
     }
 
@@ -339,21 +323,18 @@ class Public_Render
      *
      * @since 9.3.0
      */
-    public function Json_Decode($rawdata)
-    {
+    public function Json_Decode($rawdata) {
         return $rawdata != '' ? json_decode(stripcslashes($rawdata), true) : [];
     }
 
-    public function name_converter($data)
-    {
+    public function name_converter($data) {
         $data = str_replace('_', ' ', $data);
         $data = str_replace('-', ' ', $data);
         $data = str_replace('+', ' ', $data);
-        return ucwords($data);
+        return esc_attr(ucwords($data));
     }
 
-    public function font_familly_validation($data = [])
-    {
+    public function font_familly_validation($data = []) {
         $api = get_option('oxi_addons_google_font');
         if ($api == 'no') :
             return;
@@ -363,34 +344,30 @@ class Public_Render
         }
     }
 
-    public function font_familly($data = '')
-    {
+    public function font_familly($data = '') {
         $api = get_option('oxi_addons_google_font');
         if ($api != 'no') :
             wp_enqueue_style('' . $data . '', 'https://fonts.googleapis.com/css?family=' . $data . '');
         endif;
         $data = str_replace('+', ' ', $data);
         $data = explode(':', $data);
-        return '"' . $data[0] . '"';
+        return '"' . esc_attr($data[0]) . '"';
     }
 
-    public function admin_name_validation($data)
-    {
+    public function admin_name_validation($data) {
         $data = str_replace('_', ' ', $data);
         $data = str_replace('-', ' ', $data);
         $data = str_replace('+', ' ', $data);
-        return ucwords($data);
+        return esc_attr(ucwords($data));
     }
 
-    public function array_render($id, $style)
-    {
+    public function array_render($id, $style) {
         if (array_key_exists($id, $style)) :
             return $style[$id];
         endif;
     }
 
-    public function check_media_render($id, $style)
-    {
+    public function check_media_render($id, $style) {
 
         $url = '';
         if (array_key_exists($id . '-select', $style)) :
@@ -406,8 +383,7 @@ class Public_Render
         return false;
     }
 
-    public function media_render($id, $style)
-    {
+    public function media_render($id, $style) {
         $url = '';
         if (array_key_exists($id . '-select', $style)) :
             if ($style[$id . '-select'] == 'media-library') :
@@ -423,8 +399,7 @@ class Public_Render
         endif;
     }
 
-    public function media_background_render($id, $style)
-    {
+    public function media_background_render($id, $style) {
         $url = '';
         if (array_key_exists($id . '-select', $style)) :
             if ($style[$id . '-select'] == 'media-library') :
@@ -433,11 +408,10 @@ class Public_Render
                 $url = $style[$id . '-url'];
             endif;
         endif;
-        return $url;
+        return esc_url($url);
     }
 
-    public function allowed_html_sanitize($rawdata)
-    {
+    public function allowed_html_sanitize($rawdata) {
         $allowed_tags = array(
             'a' => array(
                 'class' => array(),
@@ -529,18 +503,15 @@ class Public_Render
         echo wp_kses($rawdata, $allowed_tags);
     }
 
-    public function text_render($data)
-    {
-        echo do_shortcode(str_replace('spTac', '&nbsp;', str_replace('spBac', '<br>', html_entity_decode($data))), $ignore_html = false);
+    public function text_render($data) {
+        echo wp_kses_post(do_shortcode(str_replace('spTac', '&nbsp;', str_replace('spBac', '<br>', html_entity_decode($data))), $ignore_html = false));
     }
 
-    public function return_text($data)
-    {
-        return do_shortcode(str_replace('spTac', '&nbsp;', str_replace('spBac', '<br>', html_entity_decode($data))), $ignore_html = false);
+    public function return_text($data) {
+        return wp_kses_post(do_shortcode(str_replace('spTac', '&nbsp;', str_replace('spBac', '<br>', html_entity_decode($data))), $ignore_html = false));
     }
 
-    public function font_awesome_render($data)
-    {
+    public function font_awesome_render($data) {
         $fadata = get_option('oxi_addons_font_awesome');
         if ($fadata != 'no') :
             wp_enqueue_style('font-awsome.min', OXI_IMAGE_HOVER_URL . '/assets/frontend/css/font-awsome.min.css', false, OXI_IMAGE_HOVER_PLUGIN_VERSION);
@@ -548,8 +519,7 @@ class Public_Render
         echo '<i class="' . esc_attr($data) . ' oxi-icons"></i>';
     }
 
-    public function tab_column_render($id, $style)
-    {
+    public function tab_column_render($id, $style) {
         if ($style[$id . '-lap'] == 'oxi-bt-col-lg-8') :
             return 'oxi-bt-col-md-3';
         elseif ($style[$id . '-lap'] == 'oxi-bt-col-lg-5') :
@@ -563,8 +533,7 @@ class Public_Render
         endif;
     }
 
-    public function mob_column_render($id, $style)
-    {
+    public function mob_column_render($id, $style) {
 
         if ($style[$id . '-lap'] == 'oxi-bt-col-lg-2') :
             return 'oxi-bt-col-sm-6';
@@ -577,8 +546,7 @@ class Public_Render
         endif;
     }
 
-    public function column_render($id, $style)
-    {
+    public function column_render($id, $style) {
         $file = $style[$id . '-lap'] . ' ';
         if (!array_key_exists($id . '-tab', $style) || $style[$id . '-tab'] == '') :
             $file .= $this->tab_column_render($id, $style) . ' ';
@@ -593,8 +561,7 @@ class Public_Render
         echo esc_attr($file);
     }
 
-    public function checkurl_render($id, $style)
-    {
+    public function checkurl_render($id, $style) {
 
         if (array_key_exists($id . '-url', $style) && $style[$id . '-url'] != '') :
             return true;
@@ -602,8 +569,7 @@ class Public_Render
         return false;
     }
 
-    public function url_render($id, $style)
-    {
+    public function url_render($id, $style) {
 
         if (array_key_exists($id . '-url', $style) && $style[$id . '-url'] != '') :
             echo ' href="' . esc_url($style[$id . '-url']) . '"';
@@ -619,8 +585,7 @@ class Public_Render
         endif;
     }
 
-    public function animation_render($id, $style)
-    {
+    public function animation_render($id, $style) {
 
         if (array_key_exists($id . '-type', $style) && $style[$id . '-type'] != '') :
             echo 'sa-data-animation="' . esc_attr($style[$id . '-type']);
@@ -635,8 +600,7 @@ class Public_Render
         endif;
     }
 
-    public function background_render($id, $style, $class)
-    {
+    public function background_render($id, $style, $class) {
         $backround = '';
         if (array_key_exists($id . '-color', $style)) :
             $color = $style[$id . '-color'];
@@ -672,15 +636,13 @@ class Public_Render
         return $backround;
     }
 
-    public function CatStringToClassReplacce($string, $number = '000')
-    {
+    public function CatStringToClassReplacce($string, $number = '000') {
         $entities = array('a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', "t");
         $replacements = array('!', '*', "'", "(", ")", ";", ":", "@", "&", "=", "+", "$", ",", "/", "?", "%", "#", "[", "]", " ");
         return 'sa_STCR_' . str_replace($replacements, $entities, urlencode($string)) . $number;
     }
 
-    public function old_column_render($d, $type)
-    {
+    public function old_column_render($d, $type) {
         if ($d == 'image-ultimate-responsive-1') :
             if ($type == 'lap') :
                 return 'oxi-bt-col-lg-12';
@@ -731,8 +693,8 @@ class Public_Render
             endif;
         endif;
     }
-  public function old_button_alignment_render($d)
-    {
+
+    public function old_button_alignment_render($d) {
         if ($d == 'float: left;') :
             return 'left';
         elseif ($d == 'margin: 0 auto;') :
@@ -741,8 +703,8 @@ class Public_Render
             return 'right';
         endif;
     }
-    public function old_alignment_render($d)
-    {
+
+    public function old_alignment_render($d) {
         if ($d == 'vertical-align: top;text-align: left;') :
             return 'image-hover-align-top-top';
         elseif ($d == 'vertical-align: top;text-align: center;') :
@@ -764,7 +726,4 @@ class Public_Render
         endif;
     }
 
-  
-
-   
 }

programming_language: PHP