CVE-2021-24366 (published 2021-06-21T20:15Z)

The Admin Columns WordPress plugin before 4.3 and Admin Columns Pro WordPress plugin before 5.5.1 do not sanitise and escape its Label settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Severity: LOW
CVSS v2 base score: 3.5 (AV:N/AC:M/Au:S/C:N/I:P/A:N)
CVSS v3 base score: 5.4, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/codepress/admin-columns
commit_details: repo_url: https://github.com/codepress/admin-columns
author: Tobias Schutter
author_date: 2021-03-26 13:08:45+01:00
msg: Sanitise label + title
repository: repo_url: https://github.com/codepress/admin-columns
repo_name: codepress/admin-columns
description: Admin Columns allows you to manage and organize columns in the posts, users, comments, and media lists tables in the WordPress admin panel. Transform the WordPress admin screens into beautiful, clear overviews.
repo_language: PHP
owner: codepress
file_changes: filename: FormData.php
change_type: ModificationType.ADD
diff: @@ -0,0 +1,22 @@
+<?php
+
+namespace AC\Controller\ListScreen\Sanitize;
+
+use AC\Sanitize;
+
+class FormData implements Sanitize {
+
+	/**
+	 * @param array $data
+	 *
+	 * @return array
+	 */
+	public function sanitize( $data ) {
+		if ( isset( $data[ Title::FIELD ] ) ) {
+			$data[ Title::FIELD ] = ( new Title() )->sanitize( $data[ Title::FIELD ] );
+		}
+
+		return $data;
+	}
+
+}
\ No newline at end of file

programming_language: PHP
filename: Title.php
change_type: ModificationType.ADD
diff: @@ -0,0 +1,15 @@
+<?php
+
+namespace AC\Controller\ListScreen\Sanitize;
+
+use AC\Sanitize;
+
+class Title implements Sanitize {
+
+	const FIELD = 'title';
+
+	public function sanitize( $data ) {
+		return wp_kses( $data, true );
+	}
+
+}
\ No newline at end of file

programming_language: PHP
filename: Save.php
change_type: ModificationType.MODIFY
diff: @@ -14,8 +14,14 @@ class Save {
 	 */
 	private $storage;
 
+	/**
+	 * @var Sanitize\FormData
+	 */
+	private $sanitizer;
+
 	public function __construct( Storage $storage ) {
 		$this->storage = $storage;
+		$this->sanitizer = new Sanitize\FormData();
 	}
 
 	public function request( Request $request ) {
@@ -35,6 +41,8 @@ class Save {
 			wp_send_json_error( [ 'message' => 'List screen not found' ] );
 		}
 
+		$data = $this->sanitizer->sanitize( $data );
+
 		$list_screen->set_title( ! empty( $data['title'] ) ? $data['title'] : $list_screen->get_label() )
 		            ->set_settings( isset( $data['columns'] ) ? $this->maybe_encode_urls( $data['columns'] ) : [] )
 		            ->set_layout_id( $data['list_screen_id'] )

programming_language: PHP
filename: Sanitize.php
change_type: ModificationType.ADD
diff: @@ -0,0 +1,9 @@
+<?php
+
+namespace AC;
+
+interface Sanitize {
+
+	public function sanitize( $data );
+
+}
\ No newline at end of file

programming_language: PHP
filename: Label.php
change_type: ModificationType.MODIFY
diff: @@ -59,7 +59,7 @@ class Label extends Settings\Column {
 	 * @param string $label
 	 */
 	public function set_label( $label ) {
-		$this->label = $label;
+		$this->label = apply_filters( 'ac/column/label', wp_kses( $label, true ), $label );;
 	}
 
 	/**

programming_language: PHP