Changeset 2901397

Timestamp:

04/19/2023 06:44:13 PM (2 years ago)

Author:

activecampaign

Message:

Security fix to address XSS vulnerability

Location:

activecampaign-subscription-forms/trunk

Files:

• activecampaign-form-block/activecampaign-form-block.php (modified) (1 diff)
• activecampaign.php (modified) (2 diffs)
• readme.txt (modified) (1 diff)

activecampaign-subscription-forms/trunk/activecampaign-form-block/activecampaign-form-block.php

@@ -118 +118 @@
         $css = ' css=1';
     }
-
+    $escapedClassNames = esc_attr($attributes['className']);
     if(!empty($attributes['formId'])){
-        return "<div class=\"{$attributes['className']}\">[activecampaign form=".$attributes['formId'].$css."]</div>";
+        return "<div class=\"{$escapedClassNames}\">[activecampaign form=".$attributes['formId'].$css."]</div>";
     }
-    return "<div class=\"{$attributes['className']}\">[activecampaign]</div>";
+    return "<div class=\"{$escapedClassNames}\">[activecampaign]</div>";
 }

activecampaign-subscription-forms/trunk/activecampaign.php

@@ -5 +5 @@
 Description: Allows you to add ActiveCampaign contact forms to any post, page, or sidebar. Also allows you to embed <a href="http://www.activecampaign.com/help/site-event-tracking/" target="_blank">ActiveCampaign site tracking</a> code in your pages. To get started, please activate the plugin and add your <a href="http://www.activecampaign.com/help/using-the-api/" target="_blank">API credentials</a> in the <a href="options-general.php?page=activecampaign">plugin settings</a>.
 Author: ActiveCampaign
-Version: 8.1.11
+Version: 8.1.12
 Author URI: http://www.activecampaign.com
 */
@@ -63 +63 @@
 ## version 8.1.10: Verify 6.0 Compatibility. Updated listing
 ## version 8.1.11: Removing obsolete Javascript
+## version 8.1.12: Security fix to address XSS vulnerability
 
 define("ACTIVECAMPAIGN_URL", "");

activecampaign-subscription-forms/trunk/readme.txt

@@ -110 +110 @@
 == Changelog ==
 
+= 8.1.12 =
+* Security fix to address XSS vulnerability
+
 = 8.1.11 =
 * Removing obsolete Javascript