Changeset 2956968

Timestamp:

08/22/2023 06:46:43 PM (3 years ago)

Author:

sparkpost

Message:

Fix xss vulnerability

Location:

sparkpost/trunk

Files:

• admin.widget.class.php (modified) (1 diff)
• readme.txt (modified) (2 diffs)
• wordpress-sparkpost.php (modified) (2 diffs)

sparkpost/trunk/admin.widget.class.php

@@ -399 +399 @@
         ?>
         <input type="text" id="template" name="sp_settings_basic[template]" class="regular-text"
-               value="<?php echo $this->settings['template']; ?>"/><br/>
+            value="<?php echo esc_attr($this->settings['template']); ?>"/><br/>
         <small>
             <ul>

sparkpost/trunk/readme.txt

@@ -3 +3 @@
 Tags: sparkpost, smtp, wp_mail, mail, email
 Requires at least: 5.5
-Tested up to: 5.5
-Stable tag: 3.2.5
+Tested up to: 6.2.2
+Stable tag: 3.2.8
 License: GPLv2 or later
 
@@ -52 +52 @@
 
 == Changelog ==
+
+= 3.2.8 =
+- Fixed XSS Vulnerability ([168](https://github.com/SparkPost/wordpress-sparkpost/pull/169))
+
+= 3.2.7 =
+- Fixed CVE-2017-9841 ([168](https://github.com/SparkPost/wordpress-sparkpost/pull/168))
+
+= 3.2.6 =
+- Fixed CVE-2017-9841 ([166](https://github.com/SparkPost/wordpress-sparkpost/pull/166))
 
 = 3.2.5 =

sparkpost/trunk/wordpress-sparkpost.php

@@ -6 +6 @@
 Plugin URI: http://sparkpost.com/
 Description: Send all your email from Wordpress through SparkPost, the world's most advanced email delivery service.
-Version: 3.2.5
+Version: 3.2.6
 Author: SparkPost
 Author URI: http://sparkpost.com
@@ -19 +19 @@
 define('WPSP_PLUGIN_DIR', plugin_dir_path(__FILE__));
 define('WPSP_PLUGIN_PATH', WPSP_PLUGIN_DIR . basename(__FILE__));
-define('WPSP_PLUGIN_VERSION', '3.2.5');
+define('WPSP_PLUGIN_VERSION', '3.2.6');
 
 require_once(WPSP_PLUGIN_DIR . 'sparkpost.class.php');