Changeset 3362830

Timestamp:

09/17/2025 01:22:05 AM (6 months ago)

Author:

marceljm

Message:

Fixing vulnerabilities

Location:

featured-image-from-url/trunk

Files:

• admin/cron.php (modified) (1 diff)
• admin/db.php (modified) (55 diffs)
• admin/debug.php (modified) (2 diffs)
• admin/html/column.html (modified) (1 diff)
• admin/html/js/support-data.js (added)
• admin/html/support-data.html (modified) (1 diff)
• admin/log.php (modified) (1 diff)
• admin/menu.php (modified) (1 diff)
• featured-image-from-url.php (modified) (2 diffs)
• includes/attachment.php (modified) (2 diffs)
• includes/html/og-image.html (modified) (1 diff)
• includes/html/twitter-image.html (modified) (1 diff)
• includes/speedup.php (modified) (3 diffs)
• includes/util.php (modified) (1 diff)
• readme.txt (modified) (4 diffs)

featured-image-from-url/trunk/admin/cron.php

@@ -66 +66 @@
 }
 
-function fifu_should_stop_job($option_name) {
-    $field = $option_name . '_stop';
-
-    global $wpdb;
-    if ($wpdb->get_col("SELECT 1 FROM " . $wpdb->options . " WHERE option_name = '" . $field . "'")) {
-        delete_option($field);
-        return true;
-    }
-    return false;
-}
-
 function fifu_run_cron_now() {
     wp_remote_request(site_url('wp-cron.php'));

featured-image-from-url/trunk/admin/db.php

@@ -35 +35 @@
     }
 
-    function get_types() {
-        $post_types = fifu_get_post_types();
-        return join("','", $post_types);
+    function get_types(): string {
+        $raw = (array) fifu_get_post_types();
+
+        // Sanitize and validate against registered post types
+        $registered = get_post_types([], 'names'); // array of valid names
+        $safe = [];
+        foreach ($raw as $pt) {
+            $pt = sanitize_key($pt);
+            if ($pt !== '' && isset($registered[$pt])) {
+                $safe[] = $pt;
+            }
+        }
+        // Deduplicate while preserving order
+        $safe = array_values(array_unique($safe));
+        return implode("','", $safe);
+    }
+
+    function sanitize_ids_csv($ids, bool $allow_zero = false): string {
+        // Normalize $ids to an array
+        if (is_string($ids)) {
+            $ids = explode(',', $ids);
+        } elseif (is_int($ids)) {
+            $ids = [$ids];
+        } elseif (!is_array($ids)) {
+            $ids = [];
+        }
+
+        $set = [];
+        foreach ($ids as $id) {
+            if (is_int($id)) {
+                $n = $id;
+            } elseif (is_string($id)) {
+                $id = trim($id);
+                if ($id === '' || !ctype_digit($id)) { // digits only
+                    continue;
+                }
+                $n = (int) $id; // safe after ctype_digit
+            } else {
+                continue;
+            }
+
+            if ($n > 0 || ($allow_zero && $n === 0)) {
+                $set[$n] = true; // dedupe
+            }
+        }
+
+        if (!$set) {
+            return '0'; // ensures valid "IN (0)" => no matches
+        }
+
+        return implode(',', array_keys($set));
+    }
+
+    // Sanitize a list of post types (array or CSV string) for safe IN (...) usage
+    function sanitize_post_types_list($post_types) {
+        // Normalize input to array
+        if (is_string($post_types)) {
+            $post_types = explode(',', str_replace(['"', "'"], '', $post_types));
+        } elseif (!is_array($post_types)) {
+            $post_types = [];
+        }
+
+        // Whitelist of registered post types
+        $registered = array_flip(get_post_types([], 'names'));
+
+        // Sanitize + dedupe
+        $set = [];
+        foreach ($post_types as $pt) {
+            $pt = sanitize_key(trim((string) $pt)); // [a-z0-9_-], lowercased
+            if ($pt === '' || !isset($registered[$pt])) {
+                continue;
+            }
+            $set[$pt] = true;
+        }
+
+        if (!$set) {
+            // If used in a class context that defines $this->types, keep compatibility
+            if (isset($this) && isset($this->types) && is_string($this->types) && $this->types !== '') {
+                return $this->types;
+            }
+            // Safe default: match nothing
+            return "''";
+        }
+
+        $items = array_keys($set);
+        // sanitize_key already guarantees safe charset; quoting is enough for IN (...)
+        return "'" . implode("','", $items) . "'";
+    }
+
+    function build_in_from_option_csv(string $base_key, string $option_name): array {
+        $field = (string) get_option($option_name);
+
+        $keys = [$base_key];
+        if ($field !== '') {
+            foreach (explode(',', $field) as $k) {
+                $k = trim($k);
+                if ($k !== '')
+                    $keys[] = $k;
+            }
+        }
+        $keys = array_values(array_unique($keys));
+
+        $in = implode(',', array_fill(0, count($keys), '%s')); // e.g. ['fifu_isbn','custom1'] -> IN ('fifu_isbn','custom1')
+        return [$in, $keys];
     }
 
@@ -45 +146 @@
     function delete_attachment_meta($ids, $is_ctgr) {
         $ctgr_sql = $is_ctgr ? "AND p.post_name LIKE 'fifu-category%'" : "";
-
-        $this->wpdb->query("
+        $ids_csv = $this->sanitize_ids_csv($ids);
+        $author = $this->author;
+        $sql = "
             DELETE pm
             FROM {$this->postmeta} pm JOIN {$this->posts} p ON pm.post_id = p.id
             WHERE pm.meta_key IN ('_wp_attached_file', '_wp_attachment_image_alt', '_wp_attachment_metadata')
-            AND p.post_parent IN ({$ids})
-            AND p.post_author = {$this->author} 
+            AND p.post_parent IN ({$ids_csv})
+            AND p.post_author = %d 
             {$ctgr_sql}
-        ");
+        ";
+        $this->wpdb->query($this->wpdb->prepare($sql, $author));
     }
 
@@ -73 +176 @@
     // has attachment created by FIFU
     function is_fifu_attachment($att_id) {
-        return $this->wpdb->get_row("
-            SELECT 1 
-            FROM {$this->posts} 
-            WHERE id = {$att_id} 
-            AND post_author = {$this->author}"
-                ) != null;
+        $sql = $this->wpdb->prepare(
+                "SELECT 1 FROM {$this->posts} WHERE id = %d AND post_author = %d",
+                (int) $att_id,
+                $this->author
+        );
+        return $this->wpdb->get_row($sql) != null;
     }
 
@@ -84 +187 @@
     function get_att_id($post_parent, $url, $is_ctgr) {
         $ctgr_sql = $is_ctgr ? "AND p.post_name LIKE 'fifu-category%'" : "";
-        $result = $this->wpdb->get_results("
-            SELECT pm.post_id
-            FROM {$this->postmeta} pm
-            WHERE pm.meta_key = '_wp_attached_file'
-            AND pm.meta_value = '{$url}'
-            AND pm.post_id IN (
-                SELECT p.id
-                FROM {$this->posts} p 
-                WHERE p.post_parent = {$post_parent}
-                AND post_author = {$this->author}
-                {$ctgr_sql} 
-            )
-            LIMIT 1
-        ");
-        return $result ? $result[0]->post_id : null;
+        $sql = $this->wpdb->prepare(
+                "SELECT pm.post_id
+             FROM {$this->postmeta} pm
+             WHERE pm.meta_key = '_wp_attached_file'
+               AND pm.meta_value = %s
+               AND pm.post_id IN (
+                   SELECT p.id
+                   FROM {$this->posts} p 
+                   WHERE p.post_parent = %d
+                     AND post_author = %d {$ctgr_sql}
+               )
+             LIMIT 1",
+                $url,
+                (int) $post_parent,
+                $this->author
+        );
+        $row = $this->wpdb->get_row($sql);
+        return $row ? (int) $row->post_id : null;
     }
 
@@ -116 +222 @@
 
     function get_count_wp_posts_fifu() {
-        return $this->wpdb->get_results("
-            SELECT COUNT(1) AS amount
-            FROM {$this->posts}
-            WHERE post_author = {$this->author}
-        ");
+        $sql = $this->wpdb->prepare(
+                "SELECT COUNT(1) AS amount FROM {$this->posts} WHERE post_author = %d",
+                $this->author
+        );
+        return $this->wpdb->get_results($sql);
     }
 
     function get_count_wp_postmeta_fifu() {
-        return $this->wpdb->get_results("
-            SELECT COUNT(1) AS amount
-            FROM {$this->postmeta}
-            WHERE meta_key = '_wp_attached_file'
-            AND EXISTS (
-                SELECT 1
-                FROM {$this->posts}
-                WHERE id = post_id
-                AND post_author = {$this->author}
-            )
-        ");
+        $sql = $this->wpdb->prepare(
+                "SELECT COUNT(1) AS amount
+             FROM {$this->postmeta}
+             WHERE meta_key = '_wp_attached_file'
+               AND EXISTS (
+                   SELECT 1 FROM {$this->posts}
+                   WHERE id = post_id AND post_author = %d
+               )",
+                $this->author
+        );
+        return $this->wpdb->get_results($sql);
     }
 
@@ -142 +248 @@
 
     function debug_slug($slug) {
-        $sql = $this->wpdb->prepare("SELECT ID, post_author, post_content, post_title, post_status, post_parent, post_content_filtered, guid, post_type FROM {$this->posts} WHERE post_name = %s", $slug);
+        $sql = $this->wpdb->prepare(
+                "SELECT ID, post_author, post_content, post_title, post_status, post_parent, post_content_filtered, guid, post_type 
+             FROM {$this->posts} 
+             WHERE post_name = %s
+               AND post_status <> 'private'
+               AND (post_password = '' OR post_password IS NULL)",
+                $slug
+        );
         return $this->wpdb->get_results($sql);
     }
@@ -148 +261 @@
     function debug_postmeta($post_id) {
         $sql = $this->wpdb->prepare("
-            SELECT meta_key, meta_value
-            FROM {$this->postmeta} 
-            WHERE post_id = %d 
-            AND (
-                meta_key LIKE 'fifu%'
-                OR meta_key IN ('_thumbnail_id', '_wp_attached_file', '_wp_attachment_image_alt', '_product_image_gallery', '_wc_additional_variation_images')
-            )"
+            SELECT pm.meta_key, pm.meta_value
+            FROM {$this->postmeta} pm
+            INNER JOIN {$this->posts} p ON p.ID = pm.post_id
+            WHERE pm.post_id = %d 
+              AND p.post_status <> 'private'
+              AND (p.post_password = '' OR p.post_password IS NULL)
+              AND (
+                  pm.meta_key LIKE 'fifu%'
+                  OR pm.meta_key IN ('_thumbnail_id', '_wp_attached_file', '_wp_attachment_image_alt', '_product_image_gallery', '_wc_additional_variation_images')
+              )"
                 , $post_id);
         return $this->wpdb->get_results($sql);
@@ -163 +279 @@
             SELECT post_author, post_content, post_title, post_status, post_parent, post_content_filtered, guid, post_type
             FROM {$this->posts} 
-            WHERE id = %d"
+            WHERE id = %d
+            AND post_status <> 'private'
+            AND (post_password = '' OR post_password IS NULL)"
                 , $id);
         return $this->wpdb->get_results($sql);
@@ -169 +287 @@
 
     function debug_metain() {
-        $sql = $this->wpdb->prepare("SELECT * FROM {$this->fifu_meta_in}");
-        return $this->wpdb->get_results($sql);
+        // No placeholders here; do not call prepare()
+        return $this->wpdb->get_results("SELECT * FROM {$this->fifu_meta_in}");
     }
 
     function debug_metaout() {
-        $sql = $this->wpdb->prepare("SELECT * FROM {$this->fifu_meta_out}");
-        return $this->wpdb->get_results($sql);
+        // No placeholders here; do not call prepare()
+        return $this->wpdb->get_results("SELECT * FROM {$this->fifu_meta_out}");
     }
 
     // count images without dimensions
     function get_count_posts_without_dimensions() {
-        return $this->wpdb->get_results("
+        $author = $this->author;
+        $sql = $this->wpdb->prepare("
             SELECT COUNT(1) AS amount
             FROM {$this->posts} p
@@ -188 +307 @@
                 WHERE p.id = b.post_id AND meta_key = '_wp_attachment_metadata'
             )
-            AND p.post_author = {$this->author}
-        ");
+            AND p.post_author = %d
+        ", $author);
+        return $this->wpdb->get_results($sql);
     }
 
     // count urls with metadata
     function get_count_urls_with_metadata() {
-        return $this->wpdb->get_results("
+        $author = $this->author;
+        $sql = $this->wpdb->prepare("
             SELECT COUNT(1) AS amount
             FROM {$this->posts} p
-            WHERE p.post_author = {$this->author}
-        ");
-    }
-
-    // count urls
+            WHERE p.post_author = %d
+        ", $author);
+        return $this->wpdb->get_results($sql);
+    }
+
+    // Count URLs across postmeta and termmeta (no UNION; no meta_value filters; no tm '%list%' filter)
     function get_count_urls() {
-        return $this->wpdb->get_results("
-            SELECT SUM(id) AS amount
-            FROM (
-                SELECT count(post_id) AS id
-                FROM {$this->postmeta} pm
-                WHERE pm.meta_key LIKE 'fifu_%'
-                AND pm.meta_key LIKE '%url%'
-                AND pm.meta_key NOT LIKE '%list%'
-                UNION 
-                SELECT count(term_id) AS id
-                FROM {$this->termmeta} tm
-                WHERE tm.meta_key LIKE 'fifu_%'
-                AND tm.meta_key LIKE '%url%'
-            ) x
-        ");
+        $sql = "
+            SELECT
+                (
+                    SELECT COUNT(*)
+                    FROM {$this->postmeta} AS pm
+                    WHERE pm.meta_key LIKE 'fifu!_%' ESCAPE '!'
+                    AND pm.meta_key LIKE '%url%'
+                    AND pm.meta_key NOT LIKE '%list%'
+                ) +
+                (
+                    SELECT COUNT(*)
+                    FROM {$this->termmeta} AS tm
+                    WHERE tm.meta_key LIKE 'fifu!_%' ESCAPE '!'
+                    AND tm.meta_key LIKE '%url%'
+                ) AS amount
+        ";
+        return (int) $this->wpdb->get_var($sql);
     }
 
@@ -250 +374 @@
     // get last (images/videos/sliders)
     function get_last($meta_key) {
-        return $this->wpdb->get_results("
-            SELECT p.id, pm.meta_value
+        $sql = $this->wpdb->prepare(
+                "SELECT p.id, pm.meta_value
             FROM {$this->posts} p
             INNER JOIN {$this->postmeta} pm ON p.id = pm.post_id
-            WHERE pm.meta_key = '{$meta_key}'
+            WHERE pm.meta_key = %s
             ORDER BY p.post_date DESC
-            LIMIT 3
-        ");
+            LIMIT 3",
+                $meta_key
+        );
+        return $this->wpdb->get_results($sql);
     }
 
@@ -270 +396 @@
     }
 
-    // get attachments without post
+    // get child posts (excluding the featured image) for a given post
     function get_attachments_without_post($post_id) {
-        $result = $this->wpdb->get_results("
-            SELECT GROUP_CONCAT(id) AS ids 
-            FROM {$this->posts} 
-            WHERE post_parent = {$post_id} 
-            AND post_author = {$this->author}
-            AND post_name NOT LIKE 'fifu-category%' 
+        $sql = $this->wpdb->prepare(
+                "SELECT GROUP_CONCAT(p.ID) AS ids
+            FROM {$this->posts} p
+            WHERE p.post_parent = %d
+            AND p.post_author = %d
+            AND p.post_name NOT LIKE %s
             AND NOT EXISTS (
-                SELECT 1
-                FROM {$this->postmeta}
-                WHERE post_id = post_parent
-                AND meta_key = '_thumbnail_id'
-                AND meta_value = id
-            )
-            GROUP BY post_parent
-        ");
-        return $result ? $result[0]->ids : null;
+                SELECT 1
+                FROM {$this->postmeta} pm2
+                WHERE pm2.post_id = p.post_parent
+                    AND pm2.meta_key = '_thumbnail_id'
+                    AND pm2.meta_value = p.ID
+            )",
+                (int) $post_id,
+                (int) $this->author,
+                'fifu-category%' // no need for %% since it's a %s value
+        );
+
+        // One row expected; return CSV string or null
+        $ids_csv = $this->wpdb->get_var($sql);
+        return $ids_csv ?: null;
     }
 
     function get_ctgr_attachments_without_post($term_id) {
-        $result = $this->wpdb->get_results("
-            SELECT GROUP_CONCAT(id) AS ids 
-            FROM {$this->posts} 
-            WHERE post_parent = {$term_id} 
-            AND post_author = {$this->author} 
-            AND post_name LIKE 'fifu-category%' 
+        $sql = $this->wpdb->prepare(
+                "SELECT GROUP_CONCAT(p.ID) AS ids
+            FROM {$this->posts} p
+            WHERE p.post_parent = %d
+            AND p.post_author = %d
+            AND p.post_name LIKE %s
             AND NOT EXISTS (
-                SELECT 1
-                FROM {$this->termmeta}
-                WHERE term_id = post_parent
-                AND meta_key = 'thumbnail_id'
-                AND meta_value = id
-            )
-            GROUP BY post_parent
-        ");
-        return $result ? $result[0]->ids : null;
+                SELECT 1
+                FROM {$this->termmeta} tm
+                WHERE tm.term_id = p.post_parent
+                    AND tm.meta_key = 'thumbnail_id'
+                    AND tm.meta_value = p.ID
+            )",
+                (int) $term_id,
+                (int) $this->author,
+                'fifu-category%' // pass pattern as a value; no %% needed
+        );
+
+        $ids_csv = $this->wpdb->get_var($sql);
+        return $ids_csv ?: null;
     }
 
     function get_posts_without_featured_image($post_types) {
+        $safe = $this->sanitize_post_types_list($post_types);
         return $this->wpdb->get_results("
             SELECT id, post_title
             FROM {$this->posts} 
-            WHERE post_type IN ('$post_types')
+            WHERE post_type IN ($safe)
             AND post_status = 'publish'
             AND NOT EXISTS (
@@ -335 +471 @@
 
     function get_featured_and_gallery_ids($post_id) {
-        return $this->wpdb->get_results("
-            SELECT GROUP_CONCAT(meta_value SEPARATOR ',') as 'ids'
+        $sql = $this->wpdb->prepare(
+                "SELECT GROUP_CONCAT(meta_value SEPARATOR ',') as 'ids'
             FROM {$this->postmeta}
-            WHERE post_id = {$post_id}
-            AND meta_key IN ('_thumbnail_id')
-        ");
+            WHERE post_id = %d
+              AND meta_key IN ('_thumbnail_id')",
+                (int) $post_id
+        );
+        return $this->wpdb->get_results($sql);
     }
 
@@ -353 +491 @@
 
     function delete_attachments($ids) {
-        $this->wpdb->query("
-            DELETE FROM {$this->posts} 
-            WHERE id IN ({$ids})
-            AND post_author = {$this->author}
-        ");
+        $ids_csv = $this->sanitize_ids_csv($ids);
+        $sql = $this->wpdb->prepare(
+                "DELETE FROM {$this->posts} WHERE id IN ({$ids_csv}) AND post_author = %d",
+                $this->author
+        );
+        $this->wpdb->query($sql);
     }
 
     function delete_attachment_meta_url_and_alt($ids) {
-        $this->wpdb->query("
-            DELETE FROM {$this->postmeta} 
+        $ids_csv = $this->sanitize_ids_csv($ids);
+        $sql = $this->wpdb->prepare(
+                "DELETE FROM {$this->postmeta}
             WHERE meta_key IN ('_wp_attached_file', '_wp_attachment_image_alt', '_wp_attachment_metadata')
-            AND post_id IN ({$ids})
-            AND EXISTS (
-                SELECT 1 
-                FROM {$this->posts} 
-                WHERE id = post_id 
-                AND post_author = {$this->author}
-            )
-        ");
+              AND post_id IN ({$ids_csv})
+              AND EXISTS (SELECT 1 FROM {$this->posts} WHERE id = post_id AND post_author = %d)",
+                $this->author
+        );
+        $this->wpdb->query($sql);
     }
 
@@ -399 +536 @@
 
     function select_option_prefix($prefix) {
-        return $this->wpdb->get_results("
-            SELECT option_name, option_value
+        if ($prefix === '')
+            return []; // avoid SELECT all
+        $like = $this->wpdb->esc_like($prefix) . '%'; // escape LIKE wildcards safely
+        $sql = $this->wpdb->prepare(
+                "SELECT option_name, option_value
             FROM {$this->options}
-            WHERE option_name LIKE '{$prefix}%'
-            ORDER BY option_name
-        ");
+            WHERE option_name LIKE %s
+            ORDER BY option_name",
+                $like
+        );
+        return $this->wpdb->get_results($sql);
     }
 
     function delete_option_prefix($prefix) {
-        $this->wpdb->query("
-            DELETE
-            FROM {$this->options}
-            WHERE option_name LIKE '{$prefix}%'
-        ");
+        if ($prefix === '') {
+            return 0; // safety: avoid deleting everything
+        }
+        $like = $this->wpdb->esc_like($prefix) . '%'; // escape % and _
+        $sql_select = $this->wpdb->prepare(
+                "SELECT option_name FROM {$this->options} WHERE option_name LIKE %s",
+                $like
+        );
+        $options_to_delete = $this->wpdb->get_col($sql_select);
+        $sql_delete = $this->wpdb->prepare(
+                "DELETE FROM {$this->options} WHERE option_name LIKE %s",
+                $like
+        );
+        $deleted_count = (int) $this->wpdb->query($sql_delete);
+        // Clear cache for deleted options
+        foreach ($options_to_delete as $option_name) {
+            wp_cache_delete($option_name, 'options');
+        }
+        return $deleted_count;
     }
 
@@ -418 +574 @@
 
     function get_all_urls($page, $type, $keyword) {
+        $page = max(0, (int) $page); // Ensure page is non-negative
         $start = $page * 1000;
 
-        $filter = "";
+        // Posts filter
+        $filter_posts = '';
         if ($keyword) {
+            $like = '%' . $this->wpdb->esc_like($keyword) . '%';
             if ($type == 'title')
-                $filter = "AND p.post_title LIKE '%{$keyword}%'";
+                $filter_posts = $this->wpdb->prepare('AND p.post_title LIKE %s', $like);
             elseif ($type == 'url')
-                $filter = "AND pm.meta_value LIKE '%{$keyword}%'";
+                $filter_posts = $this->wpdb->prepare('AND pm.meta_value LIKE %s', $like);
         }
 
@@ -432 +591 @@
                 SELECT pm.meta_id, pm.post_id, pm.meta_value AS url, pm.meta_key, p.post_name, p.post_title, p.post_date, false AS category, null AS video_url
                 FROM {$this->postmeta} pm
-                INNER JOIN {$this->posts} p ON pm.post_id = p.id {$filter}
+                INNER JOIN {$this->posts} p ON pm.post_id = p.id {$filter_posts}
                 WHERE pm.meta_key = 'fifu_image_url'
                 AND pm.meta_value NOT LIKE '%https://cdn.fifu.app/%'
@@ -440 +599 @@
         ";
         if (class_exists('WooCommerce')) {
-            $filter = "";
+            // Terms filter
+            $filter_terms = '';
             if ($keyword) {
+                $like = '%' . $this->wpdb->esc_like($keyword) . '%';
                 if ($type == 'title')
-                    $filter = "AND t.name LIKE '%{$keyword}%'";
+                    $filter_terms = $this->wpdb->prepare('AND t.name LIKE %s', $like);
                 elseif ($type == 'url')
-                    $filter = "AND tm.meta_value LIKE '%{$keyword}%'";
+                    $filter_terms = $this->wpdb->prepare('AND tm.meta_value LIKE %s', $like);
             }
             $sql .= " 
@@ -452 +613 @@
                     SELECT tm.meta_id, tm.term_id AS post_id, tm.meta_value AS url, tm.meta_key, null AS post_name, t.name AS post_title, null AS post_date, true AS category, null AS video_url
                     FROM {$this->termmeta} tm
-                    INNER JOIN {$this->terms} t ON tm.term_id = t.term_id {$filter}
+                    INNER JOIN {$this->terms} t ON tm.term_id = t.term_id {$filter_terms}
                     WHERE tm.meta_key IN ('fifu_image_url')
                     AND tm.meta_value NOT LIKE '%https://cdn.fifu.app/%'
@@ -495 +656 @@
 
     function get_posts_with_internal_featured_image($page, $type, $keyword) {
-        $start = $page * 1000;
+        $start = max(0, (int) $page) * 1000;
 
         $filter = "";
         if ($keyword) {
-            if ($type == 'title')
-                $filter = "AND p.post_title LIKE '%{$keyword}%'";
-            elseif ($type == 'postid')
-                $filter = "AND pm.post_id = {$keyword}";
-        }
+            if ($type == 'title') {
+                $like = '%' . $this->wpdb->esc_like($keyword) . '%';
+                $filter = $this->wpdb->prepare('AND p.post_title LIKE %s', $like);
+            } elseif ($type == 'postid') {
+                $filter = $this->wpdb->prepare('AND pm.post_id = %d', (int) $keyword);
+            }
+        }
+
+        // Prepare author filter fragments once to avoid preparing the whole query later
+        $author_clause_posts = $this->wpdb->prepare('AND att.post_author <> %d', $this->author);
+        $author_clause_terms = $author_clause_posts;
 
         $sql = "
@@ -521 +688 @@
                     pm.meta_key = '_thumbnail_id'
                     AND pm.meta_value = att.id
-                    AND att.post_author <> {$this->author}
+                    {$author_clause_posts}
                 )
                 WHERE NOT EXISTS (
@@ -541 +708 @@
             $filter = "";
             if ($keyword) {
-                if ($type == 'title')
-                    $filter = "AND t.name LIKE '%{$keyword}%'";
-                elseif ($type == 'postid')
-                    $filter = "AND tm.term_id = {$keyword}";
+                if ($type == 'title') {
+                    $like = '%' . $this->wpdb->esc_like($keyword) . '%';
+                    $filter = $this->wpdb->prepare('AND t.name LIKE %s', $like);
+                } elseif ($type == 'postid') {
+                    $filter = $this->wpdb->prepare('AND tm.term_id = %d', (int) $keyword);
+                }
             }
             $sql .= " 
@@ -563 +732 @@
                         tm.meta_key = 'thumbnail_id'
                         AND tm.meta_value = att.id
-                        AND att.post_author <> {$this->author}
+                        {$author_clause_terms}
                     )
                     WHERE NOT EXISTS (
@@ -582 +751 @@
 
     function get_posts_su($storage_ids) {
-        if ($storage_ids) {
-            $storage_ids = '"' . implode('","', $storage_ids) . '"';
-            $filter_post_image = "AND SUBSTRING_INDEX(SUBSTRING_INDEX(pm.meta_value, '/', 5), '/', -1) IN ({$storage_ids})";
-            $filter_term_image = "AND SUBSTRING_INDEX(SUBSTRING_INDEX(tm.meta_value, '/', 5), '/', -1) IN ({$storage_ids})";
-        } else
+        if (!empty($storage_ids)) {
+            // normalize and drop empties
+            $ids = array_values(array_filter(array_map('strval', (array) $storage_ids), static fn($v) => $v !== ''));
+            if ($ids) {
+                $in = implode(',', array_fill(0, count($ids), '%s'));
+                $filter_post_image = $this->wpdb->prepare(
+                        "AND SUBSTRING_INDEX(SUBSTRING_INDEX(pm.meta_value, '/', 5), '/', -1) IN ($in)", $ids
+                );
+                $filter_term_image = $this->wpdb->prepare(
+                        "AND SUBSTRING_INDEX(SUBSTRING_INDEX(tm.meta_value, '/', 5), '/', -1) IN ($in)", $ids
+                );
+            } else {
+                $filter_post_image = $filter_term_image = "";
+            }
+        } else {
             $filter_post_image = $filter_term_image = "";
+        }
 
         $sql = "
@@ -601 +781 @@
                 INNER JOIN {$this->posts} p ON pm.post_id = p.id
                 WHERE pm.meta_key LIKE 'fifu_%image_url%'
-                AND pm.meta_value LIKE 'https://cdn.fifu.app/%'" .
-                $filter_post_image . "
+                AND pm.meta_value LIKE 'https://cdn.fifu.app/%'
+                {$filter_post_image}
             )
         ";
         if (class_exists('WooCommerce')) {
-            $sql .= "            
+            $sql .= "
                 UNION
                 (
                     SELECT SUBSTRING_INDEX(SUBSTRING_INDEX(tm.meta_value, '/', 5), '/', -1) AS storage_id, 
                         t.name AS post_title, 
-                        null AS post_date, 
+                        NULL AS post_date, 
                         tm.meta_id, 
                         tm.term_id AS post_id, 
@@ -619 +799 @@
                     INNER JOIN {$this->terms} t ON tm.term_id = t.term_id
                     WHERE tm.meta_key = 'fifu_image_url'
-                    AND tm.meta_value LIKE 'https://cdn.fifu.app/%'" .
-                    $filter_term_image . "
+                    AND tm.meta_value LIKE 'https://cdn.fifu.app/%'
+                    {$filter_term_image}
                 )
             ";
         }
+
         return $this->wpdb->get_results($sql);
     }
@@ -679 +860 @@
         $table = $is_ctgr ? $this->termmeta : $this->postmeta;
 
-        $query = "
-            INSERT INTO {$table} (meta_id, meta_value) VALUES ";
-        $count = 0;
+        $values = [];
+        $args = [];
+
         foreach ($thumbnails as $thumbnail) {
             $su_url = $this->get_su_url($bucket_id, $thumbnail->storage_id);
 
-            if ($count++ != 0)
-                $query .= ", ";
-            $query .= "({$thumbnail->meta_id},'{$su_url}') ";
-        }
-        $query .= "ON DUPLICATE KEY UPDATE meta_value=VALUES(meta_value)";
-        return $this->wpdb->get_results($query);
+            $values[] = '(%d,%s)';
+            $args[] = (int) $thumbnail->meta_id;
+            $args[] = $su_url;
+        }
+
+        if (!$values)
+            return 0;
+
+        $query = "
+            INSERT INTO {$table} (meta_id, meta_value)
+            VALUES " . implode(', ', $values) . "
+            ON DUPLICATE KEY UPDATE meta_value = VALUES(meta_value)
+        ";
+
+        return $this->wpdb->query($this->wpdb->prepare($query, $args));
     }
 
     function get_thumbnail_ids($thumbnails, $is_ctgr) {
-        // join post_ids
-        $i = 0;
-        $ids = null;
+        // join post_ids (sanitized)
+        $ids_list = array();
         foreach ($thumbnails as $thumbnail)
-            $ids = ($i++ == 0) ? $thumbnail->post_id : ($ids . "," . $thumbnail->post_id);
+            $ids_list[] = (int) $thumbnail->post_id;
+        $ids = $this->sanitize_ids_csv($ids_list);
 
         // get featured ids
@@ -746 +936 @@
             if ($count++ != 0)
                 $query .= ", ";
-            $query .= "(" . $att_ids_map[$thumbnail->meta_id] . ",'{$su_url}') ";
+            $query .= $this->wpdb->prepare("(%d, %s)", $att_ids_map[$thumbnail->meta_id], $su_url) . " ";
         }
         $query .= "ON DUPLICATE KEY UPDATE post_content_filtered=VALUES(post_content_filtered)";
@@ -753 +943 @@
 
     function get_thumbnail_meta_ids($thumbnails, $att_ids_map) {
-        // join post_ids
-        $i = 0;
-        $ids = null;
+        // Collect distinct numeric attachment post_ids
+        $ids_arr = array();
         foreach ($thumbnails as $thumbnail) {
             if (!isset($att_ids_map[$thumbnail->meta_id])) // no metadata, only custom field
                 continue;
-            $ids = ($i++ == 0) ? $att_ids_map[$thumbnail->meta_id] : ($ids . "," . $att_ids_map[$thumbnail->meta_id]);
-        }
-
-        // get meta ids
-        $result = $this->wpdb->get_results("
+            $ids_arr[] = (int) $att_ids_map[$thumbnail->meta_id];
+        }
+        $ids_arr = array_values(array_unique(array_filter($ids_arr, function ($v) {
+                            return $v > 0;
+                        })));
+
+        // No IDs -> nothing to query
+        if (empty($ids_arr)) {
+            return array();
+        }
+
+        // Build prepared IN(...) and run the safe query
+        $placeholders = implode(',', array_fill(0, count($ids_arr), '%d'));
+        $sql = "
             SELECT meta_id, post_id
-            FROM {$this->postmeta} 
-            WHERE post_id IN ({$ids}) 
-            AND meta_key = '_wp_attached_file'
-        ");
+            FROM {$this->postmeta}
+            WHERE post_id IN ($placeholders)
+            AND meta_key = %s
+        ";
+        $params = array_merge($ids_arr, array('_wp_attached_file'));
+        $result = $this->wpdb->get_results($this->wpdb->prepare($sql, $params));
 
         // map att_id -> meta_id
         $attid_metaid_map = array();
-        foreach ($result as $res)
+        foreach ($result as $res) {
             $attid_metaid_map[$res->post_id] = $res->meta_id;
-
-        // map meta_id (fifu metadata) -> meta_id (atachment metadata)
+        }
+
+        // map meta_id (fifu metadata) -> meta_id (attachment metadata)
         $map = array();
         foreach ($thumbnails as $thumbnail) {
             if (!isset($att_ids_map[$thumbnail->meta_id])) // no metadata, only custom field
                 continue;
-            if (!isset($attid_metaid_map[$att_ids_map[$thumbnail->meta_id]])) // no metadata, only custom field
+            $att_id = (int) $att_ids_map[$thumbnail->meta_id];
+            if (!isset($attid_metaid_map[$att_id])) // no attachment metadata
                 continue;
-            $att_meta_id = $attid_metaid_map[$att_ids_map[$thumbnail->meta_id]];
-            $map[$thumbnail->meta_id] = $att_meta_id;
-        }
+            $map[$thumbnail->meta_id] = $attid_metaid_map[$att_id];
+        }
+
         return $map;
     }
@@ -792 +994 @@
         $query = "
             INSERT INTO {$this->postmeta} (meta_id, meta_value) VALUES ";
+
         foreach ($thumbnails as $thumbnail) {
             if (!isset($meta_ids_map[$thumbnail->meta_id])) // no metadata, only custom field
@@ -800 +1003 @@
             if ($count++ != 0)
                 $query .= ", ";
-            $query .= "(" . $meta_ids_map[$thumbnail->meta_id] . ",'{$su_url}') ";
-        }
+
+            // Minimal change: use prepare to safely build each VALUES tuple
+            $query .= $this->wpdb->prepare("(%d, %s)", $meta_ids_map[$thumbnail->meta_id], $su_url) . " ";
+        }
+
         $query .= "ON DUPLICATE KEY UPDATE meta_value=VALUES(meta_value)";
         return $this->wpdb->get_results($query);
@@ -908 +1114 @@
         $table = $is_ctgr ? $this->termmeta : $this->postmeta;
 
+        // Return early if no thumbnails to process
+        if (empty($thumbnails)) {
+            return null;
+        }
+
         $query = "
             INSERT INTO {$table} (meta_id, meta_value) VALUES ";
         $count = 0;
+
         foreach ($thumbnails as $thumbnail) {
-            if ($count++ != 0)
+            if ($count++ != 0) {
                 $query .= ", ";
-            $url = $urls[$thumbnail->storage_id];
-            $query .= "({$thumbnail->meta_id},'{$url}')";
-        }
-        $query .= "ON DUPLICATE KEY UPDATE meta_value=VALUES(meta_value)";
+            }
+
+            $url = (isset($urls[$thumbnail->storage_id]) ? $urls[$thumbnail->storage_id] : '');
+
+            // Minimal change: build each VALUES tuple with prepare to avoid SQL injection
+            $query .= $this->wpdb->prepare("(%d, %s)", (int) $thumbnail->meta_id, $url);
+        }
+
+        $query .= " ON DUPLICATE KEY UPDATE meta_value=VALUES(meta_value)";
         return $this->wpdb->get_results($query);
     }
 
     function revert_attachments($urls, $thumbnails, $att_ids_map) {
+        // Handle null or invalid parameters
+        if ($urls === null || !is_array($urls))
+            $urls = [];
+        if ($thumbnails === null || !is_array($thumbnails))
+            $thumbnails = [];
+        if ($att_ids_map === null || !is_array($att_ids_map))
+            $att_ids_map = [];
+
         $count = 0;
         $query = "
             INSERT INTO {$this->posts} (id, post_content_filtered) VALUES ";
+
         foreach ($thumbnails as $thumbnail) {
             if (!isset($att_ids_map[$thumbnail->meta_id])) // no metadata, only custom field
                 continue;
+
             if ($count++ != 0)
                 $query .= ", ";
-            $query .= "(" . $att_ids_map[$thumbnail->meta_id] . ",'" . $urls[$thumbnail->storage_id] . "')";
-        }
+
+            $url = isset($urls[$thumbnail->storage_id]) ? $urls[$thumbnail->storage_id] : '';
+
+            // Minimal change: use prepare to safely build each VALUES tuple
+            $query .= $this->wpdb->prepare("(%d, %s)", (int) $att_ids_map[$thumbnail->meta_id], $url);
+        }
+
+        // If no thumbnails were processed, return early
+        if ($count == 0) {
+            return array(); // Return empty array instead of running invalid query
+        }
+
         $query .= "ON DUPLICATE KEY UPDATE post_content_filtered=VALUES(post_content_filtered)";
         return $this->wpdb->get_results($query);
@@ -940 +1177 @@
         $query = "
             INSERT INTO {$this->postmeta} (meta_id, meta_value) VALUES ";
+
         foreach ($thumbnails as $thumbnail) {
             if (!isset($meta_ids_map[$thumbnail->meta_id])) // no metadata, only custom field
                 continue;
+
             if ($count++ != 0)
                 $query .= ", ";
-            $query .= "(" . $meta_ids_map[$thumbnail->meta_id] . ",'" . $urls[$thumbnail->storage_id] . "')";
-        }
-        $query .= "ON DUPLICATE KEY UPDATE meta_value=VALUES(meta_value)";
-        return $this->wpdb->get_results($query);
+
+            $url = isset($urls[$thumbnail->storage_id]) ? $urls[$thumbnail->storage_id] : '';
+
+            // Minimal change: safely build each VALUES tuple
+            $query .= $this->wpdb->prepare("(%d, %s)", (int) $meta_ids_map[$thumbnail->meta_id], $url);
+        }
+
+        // Only execute query if there are valid operations to perform
+        if ($count > 0) {
+            $query .= "ON DUPLICATE KEY UPDATE meta_value=VALUES(meta_value)";
+            return $this->wpdb->get_results($query);
+        }
+
+        // Return empty array if no valid operations were found
+        return array();
     }
 
@@ -966 +1216 @@
 
     function insert_invalid_media_su($url) {
+        if ($url === null || $url === '')
+            return;
         if ($this->get_attempts_invalid_media_su($url)) {
             $this->update_invalid_media_su($url);
@@ -972 +1224 @@
 
         $md5 = md5($url);
-        $this->wpdb->query("
-            INSERT INTO {$this->fifu_invalid_media_su} (md5, attempts) 
-            VALUES ('{$md5}', 1)
-        ");
+        $this->wpdb->query(
+                $this->wpdb->prepare(
+                        "INSERT INTO {$this->fifu_invalid_media_su} (md5, attempts) VALUES (%s, 1)",
+                        $md5
+                )
+        );
     }
 
     function update_invalid_media_su($url) {
+        if ($url === null || $url === '')
+            return;
         $md5 = md5($url);
-        $this->wpdb->query("
-            UPDATE {$this->fifu_invalid_media_su} 
-            SET attempts = attempts + 1
-            WHERE md5 = '{$md5}'
-        ");
+        $this->wpdb->query(
+                $this->wpdb->prepare(
+                        "UPDATE {$this->fifu_invalid_media_su} SET attempts = attempts + 1 WHERE md5 = %s",
+                        $md5
+                )
+        );
     }
 
     function get_attempts_invalid_media_su($url) {
+        if ($url === null || $url === '')
+            return 0;
         $md5 = md5($url);
-        $result = $this->wpdb->get_row("
-            SELECT attempts
-            FROM {$this->fifu_invalid_media_su} 
-            WHERE md5 = '{$md5}'
-        ");
+        $result = $this->wpdb->get_row(
+                $this->wpdb->prepare(
+                        "SELECT attempts FROM {$this->fifu_invalid_media_su} WHERE md5 = %s",
+                        $md5
+                )
+        );
         return $result ? (int) $result->attempts : 0;
     }
 
     function delete_invalid_media_su($url) {
+        if ($url === null || $url === '')
+            return;
         $md5 = md5($url);
-        $this->wpdb->query("
-            DELETE FROM {$this->fifu_invalid_media_su} 
-            WHERE md5 = '{$md5}'
-        ");
+        $this->wpdb->query(
+                $this->wpdb->prepare(
+                        "DELETE FROM {$this->fifu_invalid_media_su} WHERE md5 = %s",
+                        $md5
+                )
+        );
     }
 
@@ -1042 +1306 @@
 
     function insert_attachment_by($value) {
-        $this->wpdb->query("
-            INSERT INTO {$this->posts} (post_author, guid, post_title, post_excerpt, post_mime_type, post_type, post_status, post_parent, post_date, post_date_gmt, post_modified, post_modified_gmt, post_content, to_ping, pinged, post_content_filtered) 
-            VALUES " . str_replace('\\', '', $value));
+        // $value should be a list of PREPARED tuples (e.g., from get_formatted_value), joined by ', '
+        $values_sql = is_array($value) ? implode(', ', $value) : (string) $value;
+
+        $sql = "
+            INSERT INTO {$this->posts}
+                (post_author, guid, post_title, post_excerpt, post_mime_type, post_type, post_status, post_parent,
+                post_date, post_date_gmt, post_modified, post_modified_gmt, post_content, to_ping, pinged, post_content_filtered)
+            VALUES {$values_sql}";
+        return $this->wpdb->query($sql);
     }
 
     function insert_ctgr_attachment_by($value) {
-        $this->wpdb->query("
-            INSERT INTO {$this->posts} (post_author, guid, post_title, post_excerpt, post_mime_type, post_type, post_status, post_parent, post_date, post_date_gmt, post_modified, post_modified_gmt, post_content, to_ping, pinged, post_content_filtered, post_name) 
-            VALUES " . str_replace('\\', '', $value));
+        // $value should be a list of PREPARED tuples (e.g., from get_ctgr_formatted_value), joined by ', '
+        $values_sql = is_array($value) ? implode(', ', $value) : (string) $value;
+
+        $sql = "
+            INSERT INTO {$this->posts}
+                (post_author, guid, post_title, post_excerpt, post_mime_type, post_type, post_status, post_parent,
+                post_date, post_date_gmt, post_modified, post_modified_gmt, post_content, to_ping, pinged, post_content_filtered, post_name)
+            VALUES {$values_sql}";
+        return $this->wpdb->query($sql);
     }
 
     function get_formatted_value($url, $alt, $post_parent) {
         $alt = $alt ?? '';
-        $alt = str_replace("'", "", $alt);
-        return "({$this->author}, '', '{$alt}', '{$alt}', 'image/jpeg', 'attachment', 'inherit', '{$post_parent}', now(), now(), now(), now(), '', '', '', '{$url}')";
+        // Return a PREPARED tuple; caller concatenates multiple with ", "
+        return $this->wpdb->prepare(
+                        "(%d, %s, %s, %s, %s, %s, %s, %d, NOW(), NOW(), NOW(), NOW(), %s, %s, %s, %s)",
+                        (int) $this->author, // post_author
+                        '', // guid
+                        $alt, // post_title
+                        $alt, // post_excerpt
+                        'image/jpeg', // post_mime_type
+                        'attachment', // post_type
+                        'inherit', // post_status
+                        (int) $post_parent, // post_parent
+                        '', // post_content
+                        '', // to_ping
+                        '', // pinged
+                        $url                           // post_content_filtered
+                );
     }
 
     function get_ctgr_formatted_value($url, $alt, $post_parent) {
         $alt = $alt ?? '';
-        $alt = str_replace("'", "", $alt);
-        return "({$this->author}, '', '{$alt}', '{$alt}', 'image/jpeg', 'attachment', 'inherit', '{$post_parent}', now(), now(), now(), now(), '', '', '', '{$url}', 'fifu-category-{$post_parent}')";
+        // Return a PREPARED tuple; caller concatenates multiple with ", "
+        return $this->wpdb->prepare(
+                        "(%d, %s, %s, %s, %s, %s, %s, %d, NOW(), NOW(), NOW(), NOW(), %s, %s, %s, %s, %s)",
+                        (int) $this->author, // post_author
+                        '', // guid
+                        $alt, // post_title
+                        $alt, // post_excerpt
+                        'image/jpeg', // post_mime_type
+                        'attachment', // post_type
+                        'inherit', // post_status
+                        (int) $post_parent, // post_parent
+                        '', // post_content
+                        '', // to_ping
+                        '', // pinged
+                        $url, // post_content_filtered
+                        'fifu-category-' . (int) $post_parent// post_name
+                );
     }
 
@@ -1068 +1373 @@
 
     function clean_dimensions_all() {
-        $this->wpdb->query("
-            DELETE FROM {$this->postmeta} pm            
-            WHERE pm.meta_key = '_wp_attachment_metadata'
+        // Ensure author ID is numeric
+        $author_id = (int) $this->author;
+
+        // Build a prepared statement with placeholders
+        $query = $this->wpdb->prepare(
+                "
+            DELETE FROM {$this->postmeta} pm
+            WHERE pm.meta_key = %s
             AND EXISTS (
-                SELECT 1 
-                FROM {$this->posts} p 
+                SELECT 1
+                FROM {$this->posts} p
                 WHERE p.id = pm.post_id
-                AND p.post_author = {$this->author} 
+                AND p.post_author = %d
             )
-        ");
+            ",
+                '_wp_attachment_metadata', // %s placeholder for meta_key
+                $author_id                    // %d placeholder for author
+        );
+
+        // Execute the prepared query
+        $this->wpdb->query($query);
     }
 
@@ -1183 +1499 @@
 
     function set_default_url() {
-        $att_id = get_option('fifu_default_attach_id');
+        $att_id = (int) get_option('fifu_default_attach_id');
         if (!$att_id)
             return;
-        $post_types = join("','", explode(',', str_replace(' ', '', get_option('fifu_default_cpt'))));
-        $post_types ? $post_types : $this->types;
-        $value = null;
-        foreach ($this->get_posts_without_featured_image($post_types) as $res) {
-            $aux = "({$res->id}, '_thumbnail_id', {$att_id})";
-            $value = $value ? $value . ',' . $aux : $aux;
-        }
-        if ($value) {
-            $this->insert_default_thumbnail_id($value);
-            update_post_meta($att_id, '_wp_attached_file', get_option('fifu_default_url'));
+
+        $post_types_csv = $this->sanitize_post_types_list((string) get_option('fifu_default_cpt'));
+
+        $tuples = [];
+        foreach ($this->get_posts_without_featured_image($post_types_csv) as $res) {
+            // (%d, %s, %d) -> (post_id, meta_key, meta_value)
+            $tuples[] = $this->wpdb->prepare("(%d, %s, %d)", (int) $res->id, '_thumbnail_id', $att_id);
+        }
+
+        if ($tuples) {
+            $this->insert_default_thumbnail_id(implode(',', $tuples));
+            update_post_meta($att_id, '_wp_attached_file', (string) get_option('fifu_default_url'));
         }
     }
 
     function update_default_url($url) {
-        $att_id = get_option('fifu_default_attach_id');
+        $att_id = (int) get_option('fifu_default_attach_id');
         if ($url != wp_get_attachment_url($att_id)) {
             $this->wpdb->update($this->posts, $set = array('post_content_filtered' => $url), $where = array('id' => $att_id), null, null);
@@ -1208 +1526 @@
 
     function delete_default_url() {
-        $att_id = get_option('fifu_default_attach_id');
+        $att_id = (int) get_option('fifu_default_attach_id');
         wp_delete_attachment($att_id);
         delete_option('fifu_default_attach_id');
@@ -1218 +1536 @@
     function before_delete_post($post_id) {
         $default_url_enabled = fifu_is_on('fifu_enable_default_url');
-        $default_att_id = $default_url_enabled ? get_option('fifu_default_attach_id') : null;
+        $default_att_id = $default_url_enabled ? (int) get_option('fifu_default_attach_id') : null;
         $result = $this->get_featured_and_gallery_ids($post_id);
         if ($result) {
@@ -1388 +1706 @@
         $this->wpdb->query("SET SESSION group_concat_max_len = 1048576;"); // because GROUP_CONCAT is limited to 1024 characters
 
-        $this->wpdb->query("
+        $sql = "
             INSERT INTO {$this->fifu_meta_out} (post_ids, type)
             SELECT GROUP_CONCAT(DISTINCT id ORDER BY id SEPARATOR ','), 'att'
             FROM {$this->posts} 
-            WHERE post_author = {$this->author}
+            WHERE post_author = %d
             GROUP BY FLOOR(id / 5000)
-        ");
+        ";
+        $this->wpdb->query($this->wpdb->prepare($sql, $this->author));
 
         $last_insert_id = $this->wpdb->insert_id;
@@ -1482 +1801 @@
 
     function log_prepare($last_insert_id, $table) {
-        $inserted_records = $this->wpdb->get_results("
-            SELECT id, post_ids, type
-            FROM {$table}
-            WHERE id = {$last_insert_id}
-        ");
+        $inserted_records = $this->wpdb->get_results(
+                $this->wpdb->prepare(
+                        "SELECT id, post_ids, type FROM {$table} WHERE id = %d",
+                        (int) $last_insert_id
+                )
+        );
 
         foreach ($inserted_records as $record) {
@@ -1508 +1828 @@
 
     function insert_postmeta($id) {
-        $result = $this->wpdb->get_results("
-            SELECT post_ids
-            FROM {$this->fifu_meta_in}
-            WHERE id = {$id}
-        ");
-
-        $this->wpdb->query("
-            DELETE FROM {$this->fifu_meta_in}
-            WHERE id = {$id}
-        ");
+        $result = $this->wpdb->get_results(
+                $this->wpdb->prepare(
+                        "SELECT post_ids FROM {$this->fifu_meta_in} WHERE id = %d",
+                        (int) $id
+                )
+        );
+
+        $this->wpdb->query(
+                $this->wpdb->prepare(
+                        "DELETE FROM {$this->fifu_meta_in} WHERE id = %d",
+                        (int) $id
+                )
+        );
 
         if (count($result) == 0)
@@ -1542 +1865 @@
 
     function delete_attmeta($id) {
-        $result = $this->wpdb->get_results("
-            SELECT post_ids
-            FROM {$this->fifu_meta_out}
-            WHERE id = {$id}
-        ");
-
-        $this->wpdb->query("
-            DELETE FROM {$this->fifu_meta_out}
-            WHERE id = {$id}
-        ");
+        $result = $this->wpdb->get_results(
+                $this->wpdb->prepare(
+                        "SELECT post_ids FROM {$this->fifu_meta_out} WHERE id = %d",
+                        (int) $id
+                )
+        );
+
+        $this->wpdb->query(
+                $this->wpdb->prepare(
+                        "DELETE FROM {$this->fifu_meta_out} WHERE id = %d",
+                        (int) $id
+                )
+        );
 
         if (count($result) == 0)
@@ -1569 +1895 @@
         wp_cache_flush();
 
+        // Cast option-derived IDs to integers to avoid SQL injection
+        $fake_attach_id = (int) get_option('fifu_fake_attach_id');
+        $default_attach_id = (int) get_option('fifu_default_attach_id');
+
         $this->wpdb->query('START TRANSACTION');
 
         try {
-            $fake_attach_id = get_option('fifu_fake_attach_id');
             $fake_attach_sql = $fake_attach_id ? "OR meta_value = {$fake_attach_id}" : "";
-
-            $default_attach_id = get_option('fifu_default_attach_id');
             $default_attach_sql = $default_attach_id ? "OR meta_value = {$default_attach_id}" : "";
 
@@ -1670 +1997 @@
 
     function delete_termmeta($id) {
-        $result = $this->wpdb->get_results("
-            SELECT post_ids
-            FROM {$this->fifu_meta_out}
-            WHERE id = {$id}
-        ");
-
-        $this->wpdb->query("
-            DELETE FROM {$this->fifu_meta_out}
-            WHERE id = {$id}
-        ");
+        $result = $this->wpdb->get_results(
+                $this->wpdb->prepare(
+                        "SELECT post_ids FROM {$this->fifu_meta_out} WHERE id = %d",
+                        (int) $id
+                )
+        );
+
+        $this->wpdb->query(
+                $this->wpdb->prepare(
+                        "DELETE FROM {$this->fifu_meta_out} WHERE id = %d",
+                        (int) $id
+                )
+        );
 
         if (count($result) == 0)
@@ -1696 +2026 @@
     function insert_postmeta2($value, $ids) {
         $this->wpdb->query('START TRANSACTION');
+        $ids_csv = $this->sanitize_ids_csv($ids);
 
         try {
-            $this->wpdb->query("
-                INSERT INTO {$this->posts} (post_author, guid, post_title, post_excerpt, post_mime_type, post_type, post_status, post_parent, post_date, post_date_gmt, post_modified, post_modified_gmt, post_content, to_ping, pinged, post_content_filtered) 
-                VALUES " . str_replace('\\', '', $value));
-
-            $this->wpdb->query("
+            $this->wpdb->query(
+                    "INSERT INTO {$this->posts} (post_author, guid, post_title, post_excerpt, post_mime_type, post_type, post_status, post_parent, post_date, post_date_gmt, post_modified, post_modified_gmt, post_content, to_ping, pinged, post_content_filtered) 
+                VALUES " . $value
+            );
+
+            $author = $this->author;
+            $sql_thumb = $this->wpdb->prepare("
                 INSERT INTO {$this->postmeta} (post_id, meta_key, meta_value) (
                     SELECT p.post_parent, '_thumbnail_id', p.id 
                     FROM {$this->posts} p
-                    WHERE p.post_parent IN ({$ids}) 
-                    AND p.post_author = {$this->author} 
-                )
-            ");
-
-            $this->wpdb->query("
+                    WHERE p.post_parent IN ({$ids_csv}) 
+                    AND p.post_author = %d 
+                )
+            ", $author);
+            $this->wpdb->query($sql_thumb);
+
+            $sql_file = $this->wpdb->prepare("
                 INSERT INTO {$this->postmeta} (post_id, meta_key, meta_value) (
                     SELECT p.id, '_wp_attached_file', p.post_content_filtered
                     FROM {$this->posts} p 
-                    WHERE p.post_parent IN ({$ids}) 
-                    AND p.post_author = {$this->author} 
-                )
-            ");
-
-            $this->wpdb->query("
+                    WHERE p.post_parent IN ({$ids_csv}) 
+                    AND p.post_author = %d 
+                )
+            ", $author);
+            $this->wpdb->query($sql_file);
+
+            $sql_alt = $this->wpdb->prepare("
                 INSERT INTO {$this->postmeta} (post_id, meta_key, meta_value) (
                     SELECT p.id, '_wp_attachment_image_alt', p.post_title 
                     FROM {$this->posts} p
-                    WHERE p.post_parent IN ({$ids}) 
-                    AND p.post_author = {$this->author} 
+                    WHERE p.post_parent IN ({$ids_csv}) 
+                    AND p.post_author = %d 
                     AND p.post_title IS NOT NULL 
                     AND p.post_title != ''
                 )
-            ");
+            ", $author);
+            $this->wpdb->query($sql_alt);
 
             $this->wpdb->query('COMMIT');
@@ -1739 +2075 @@
     function delete_attmeta2($ids) {
         $this->wpdb->query('START TRANSACTION');
+        $ids_csv = $this->sanitize_ids_csv($ids);
 
         try {
@@ -1744 +2081 @@
                 DELETE FROM {$this->postmeta} 
                 WHERE meta_key = '_thumbnail_id' 
-                AND meta_value IN (0, {$ids})
+                AND meta_value IN (0, {$ids_csv})
             ");
 
-            $this->wpdb->query("
+            $author = $this->author;
+            $sql_del_posts = $this->wpdb->prepare("
                 DELETE FROM {$this->posts} 
-                WHERE id IN ({$ids})
-                AND post_author = {$this->author}
-            ");
+                WHERE id IN ({$ids_csv})
+                AND post_author = %d
+            ", $author);
+            $this->wpdb->query($sql_del_posts);
 
             $this->wpdb->query("
                 DELETE FROM {$this->postmeta} 
                 WHERE meta_key IN ('_wp_attached_file', '_wp_attachment_image_alt', '_wp_attachment_metadata') 
-                AND post_id IN ({$ids})
+                AND post_id IN ({$ids_csv})
             ");
 
@@ -1767 +2106 @@
     function delete_termmeta2($ids) {
         $this->wpdb->query('START TRANSACTION');
+        $ids_csv = $this->sanitize_ids_csv($ids);
 
         try {
@@ -1772 +2112 @@
                 DELETE FROM {$this->termmeta} 
                 WHERE meta_key = 'thumbnail_id' 
-                AND term_id IN ({$ids})
+                AND term_id IN ({$ids_csv})
             ");
 
-            $this->wpdb->query("
+            $author = $this->author;
+            $sql_del_pm = $this->wpdb->prepare("
                 DELETE pm
                 FROM {$this->postmeta} pm JOIN {$this->posts} p ON pm.post_id = p.id
                 WHERE pm.meta_key IN ('_wp_attached_file', '_wp_attachment_image_alt', '_wp_attachment_metadata')
-                AND p.post_parent IN ({$ids})
-                AND p.post_author = {$this->author} 
+                AND p.post_parent IN ({$ids_csv})
+                AND p.post_author = %d 
                 AND p.post_name LIKE 'fifu-category%'
-            ");
+            ", $author);
+            $this->wpdb->query($sql_del_pm);
 
             $this->wpdb->query('COMMIT');
@@ -1791 +2133 @@
 
     function insert_termmeta($id) {
-        $result = $this->wpdb->get_results("
-            SELECT post_ids
-            FROM {$this->fifu_meta_in}
-            WHERE id = {$id}
-        ");
-
-        $this->wpdb->query("
-            DELETE FROM {$this->fifu_meta_in}
-            WHERE id = {$id}
-        ");
+        $result = $this->wpdb->get_results(
+                $this->wpdb->prepare(
+                        "SELECT post_ids FROM {$this->fifu_meta_in} WHERE id = %d",
+                        (int) $id
+                )
+        );
+
+        $this->wpdb->query(
+                $this->wpdb->prepare(
+                        "DELETE FROM {$this->fifu_meta_in} WHERE id = %d",
+                        (int) $id
+                )
+        );
 
         if (count($result) == 0)
@@ -1826 +2171 @@
     function insert_termmeta2($value, $ids) {
         $this->wpdb->query('START TRANSACTION');
+        $ids_csv = $this->sanitize_ids_csv($ids);
 
         try {
-            $this->wpdb->query("
-                INSERT INTO {$this->posts} (post_author, guid, post_title, post_excerpt, post_mime_type, post_type, post_status, post_parent, post_date, post_date_gmt, post_modified, post_modified_gmt, post_content, to_ping, pinged, post_content_filtered, post_name) 
-                VALUES " . str_replace('\\', '', $value));
-
-            $this->wpdb->query("
+            $this->wpdb->query(
+                    "INSERT INTO {$this->posts} (post_author, guid, post_title, post_excerpt, post_mime_type, post_type, post_status, post_parent, post_date, post_date_gmt, post_modified, post_modified_gmt, post_content, to_ping, pinged, post_content_filtered, post_name) 
+                VALUES " . $value
+            );
+
+            $author = $this->author;
+            $sql_term_thumbnail = $this->wpdb->prepare("
                 INSERT INTO {$this->termmeta} (term_id, meta_key, meta_value) (
                     SELECT p.post_parent, 'thumbnail_id', p.id 
                     FROM {$this->posts} p
-                    WHERE p.post_parent IN ({$ids}) 
-                    AND p.post_author = {$this->author} 
+                    WHERE p.post_parent IN ({$ids_csv}) 
+                    AND p.post_author = %d 
                     AND p.post_name LIKE 'fifu-category%'
                 )
-            ");
-
-            $this->wpdb->query("
+            ", $author);
+            $this->wpdb->query($sql_term_thumbnail);
+
+            $sql_term_file = $this->wpdb->prepare("
                 INSERT INTO {$this->postmeta} (post_id, meta_key, meta_value) (
                     SELECT p.id, '_wp_attached_file', p.post_content_filtered
                     FROM {$this->posts} p 
-                    WHERE p.post_parent IN ({$ids}) 
-                    AND p.post_author = {$this->author} 
+                    WHERE p.post_parent IN ({$ids_csv}) 
+                    AND p.post_author = %d 
                     AND p.post_name LIKE 'fifu-category%'
                 )
-            ");
-
-            $this->wpdb->query("
+            ", $author);
+            $this->wpdb->query($sql_term_file);
+
+            $sql_term_alt = $this->wpdb->prepare("
                 INSERT INTO {$this->postmeta} (post_id, meta_key, meta_value) (
                     SELECT p.id, '_wp_attachment_image_alt', p.post_title 
                     FROM {$this->posts} p
-                    WHERE p.post_parent IN ({$ids}) 
-                    AND p.post_author = {$this->author} 
+                    WHERE p.post_parent IN ({$ids_csv}) 
+                    AND p.post_author = %d 
                     AND p.post_title IS NOT NULL 
                     AND p.post_title != ''
                     AND p.post_name LIKE 'fifu-category%'
                 )
-            ");
+            ", $author);
+            $this->wpdb->query($sql_term_alt);
 
             $this->wpdb->query('COMMIT');
@@ -1871 +2222 @@
 
     function get_fifu_fields($ids) {
+        $ids_csv = $this->sanitize_ids_csv($ids);
         $results = $this->wpdb->get_results("
             SELECT post_id, meta_key, meta_value
             FROM {$this->postmeta}
-            WHERE post_id IN ({$ids})
+            WHERE post_id IN ({$ids_csv})
             AND meta_key IN ('fifu_image_url', 'fifu_image_alt')
         ");
@@ -1948 +2300 @@
 function fifu_db_count_urls() {
     $db = new FifuDb();
-    $aux = $db->get_count_urls()[0];
-    return $aux ? $aux->amount : 0;
+    $aux = $db->get_count_urls();
+    return $aux ? $aux : 0;
 }
 

featured-image-from-url/trunk/admin/debug.php

@@ -27 +27 @@
     $metaout = fifu_db_debug_metaout();
     return new WP_REST_Response($metaout, 200);
+}
+
+function fifu_api_debug_log(WP_REST_Request $request) {
+    $type = $request->get_param('type') ?? 'plugin';
+    $lines = intval($request->get_param('lines') ?? 200);
+    if ($lines <= 0) {
+        $lines = 200;
+    }
+    if ($lines > 5000) { // hard cap to avoid huge responses
+        $lines = 5000;
+    }
+
+    $upload_dir = wp_upload_dir();
+    $basedir = $upload_dir['basedir'] ?? '';
+    $filename = $type === 'cloud' ? 'fifu-cloud.log' : 'fifu-plugin.log';
+    $path = $basedir ? (rtrim($basedir, '/\\') . '/' . $filename) : '';
+
+    if (!$path || !file_exists($path)) {
+        return new WP_REST_Response('Log file not found', 404);
+    }
+
+    // Ensure readable for this request
+    @chmod($path, 0600);
+    $content = @file_get_contents($path);
+    // Preserve permission according to current toggle
+    $debug_on = function_exists('fifu_is_on') ? fifu_is_on('fifu_debug') : false;
+    @chmod($path, $debug_on ? 0600 : 0200);
+    if ($content === false) {
+        return new WP_REST_Response('Unable to read log file', 403);
+    }
+
+    $parts = preg_split('/\r?\n/', rtrim($content, "\r\n"));
+    $slice = array_slice($parts, -$lines);
+    $text = implode("\n", $slice) . "\n";
+
+    $response = new WP_REST_Response($text, 200);
+    $response->header('Content-Type', 'text/plain; charset=' . get_option('blog_charset'));
+    return $response;
 }
 
@@ -89 +127 @@
         },
     ));
+    register_rest_route('featured-image-from-url/v2', '/debug-log/(?P<type>(cloud|plugin))', array(
+        'methods' => 'GET',
+        'callback' => 'fifu_api_debug_log',
+        'permission_callback' => function ($request) {
+            return fifu_is_on('fifu_debug');
+        },
+        'args' => array(
+            'type' => array(
+                'required' => true,
+                'validate_callback' => function ($param) {
+                    return in_array($param, array('cloud', 'plugin'), true);
+                }
+            ),
+            'lines' => array(
+                'required' => false,
+                'validate_callback' => function ($param) {
+                    return is_numeric($param) && intval($param) > 0; // capped inside handler
+                }
+            ),
+        ),
+    ));
 });

featured-image-from-url/trunk/admin/html/column.html

@@ -1 +1 @@
 <div
     class="fifu-quick"
-    post-id="<?php echo $post_id ?>"
-    is-ctgr="<?php echo $is_ctgr ?>"
-    image-url="<?php echo $image_url ?>"
-    is-variable="<?php echo $is_variable ?>"
-    style="height: <?php echo $height ?>px; width: <?php echo $width ?>px; background:url('<?php echo $url ?>') no-repeat center center; background-size:cover; <?php echo $border ?>; cursor:pointer; border-radius: 8px;">
+    post-id="<?php echo esc_attr($post_id) ?>"
+    is-ctgr="<?php echo esc_attr($is_ctgr) ?>"
+    image-url="<?php echo esc_url($image_url) ?>"
+    is-variable="<?php echo esc_attr($is_variable) ?>"
+    style="height: <?php echo esc_attr($height) ?>px; width: <?php echo esc_attr($width) ?>px; background:url('<?php echo esc_url($url) ?>') no-repeat center center; background-size:cover; <?php echo esc_attr($border) ?>; cursor:pointer; border-radius: 8px;">
 </div>

featured-image-from-url/trunk/admin/html/support-data.html

@@ -13 +13 @@
 Theme:<?php echo wp_get_theme() ?><?php echo fifu_woo_theme() ? ' (WooCommerce)' : '' ?>;
 PHP:<?php echo phpversion() ?>;
+PHP_INT_SIZE:<?php echo PHP_INT_SIZE ?>;
 WooCommerce:<?php echo class_exists('WooCommerce') ? WC()->version : '' ?>;
 Pages:<?php echo wp_count_posts('page')->publish ?>;

featured-image-from-url/trunk/admin/log.php

@@ -13 +13 @@
     $filepath = "{$upload_dir}/{$file}.log";
 
-    // Remove the file
-    if (file_exists($filepath) && filesize($filepath) > 10 * 1024 * 1024)
-        unlink($filepath);
+    // Rotate the .log file if it exceeds 10MB
+    if (file_exists($filepath) && filesize($filepath) > 10 * 1024 * 1024) {
+        @unlink($filepath);
+    }
 
-    if (is_array($entry))
+    if (is_array($entry)) {
         $entry = json_encode([current_time('mysql') => $entry], JSON_UNESCAPED_SLASHES);
+    }
 
-    $file = fopen($filepath, $mode);
-    $bytes = fwrite($file, "{$entry}\n");
-    fclose($file);
+    // Ensure file exists before adjusting permissions
+    if (!file_exists($filepath)) {
+        @touch($filepath);
+    }
+
+    // Set permissions based on current debug toggle
+    $debug_on = function_exists('fifu_is_on') ? fifu_is_on('fifu_debug') : false;
+    @chmod($filepath, $debug_on ? 0600 : 0200);
+
+    $fh = fopen($filepath, $mode);
+    $bytes = fwrite($fh, "{$entry}\n");
+    fclose($fh);
 
     return $bytes;
 }
 
+// Immediately adjust log file permissions when fifu_debug changes
+function fifu_set_log_permissions($debug_on) {
+    $upload_dir = wp_upload_dir()['basedir'] ?? '';
+    if (!$upload_dir)
+        return;
+    $files = [
+        $upload_dir . '/fifu-plugin.log',
+        $upload_dir . '/fifu-cloud.log',
+    ];
+    $perm = $debug_on ? 0600 : 0200;
+    foreach ($files as $file) {
+        if (file_exists($file)) {
+            @chmod($file, $perm);
+        }
+    }
+}
+
+add_action('updated_option', function ($option, $old_value, $value) {
+    if ($option === 'fifu_debug') {
+        fifu_set_log_permissions($value === 'toggleon');
+    }
+}, 10, 3);
+
+

featured-image-from-url/trunk/admin/menu.php

@@ -162 +162 @@
     wp_enqueue_style('fifu-menu-css', plugins_url('/html/css/menu.css', __FILE__), array(), fifu_version_number_enq());
 
+    // page-specific JS to hide admin notices, matching other FIFU pages
+    wp_enqueue_script('fifu-support-data-js', plugins_url('/html/js/support-data.js', __FILE__), array('jquery', 'jquery-ui'), fifu_version_number_enq());
+
     $skip = esc_attr(get_option('fifu_skip'));
     $html_cpt = esc_attr(get_option('fifu_html_cpt'));

featured-image-from-url/trunk/featured-image-from-url.php

@@ -5 +5 @@
  * Plugin URI: https://fifu.app/
  * Description: Use remote media as the featured image and beyond.
- * Version: 5.2.7
+ * Version: 5.2.8
  * Author: fifu.app
  * Author URI: https://fifu.app/
@@ -21 +21 @@
 define('FIFU_GRAVITY_DIR', FIFU_PLUGIN_DIR . 'gravity-forms');
 define('FIFU_LANGUAGES_DIR', WP_CONTENT_DIR . '/uploads/fifu/languages/');
-define('FIFU_DELETE_ALL_URLS', false);
 define('FIFU_CLOUD_DEBUG', false);
+
+if (!defined('FIFU_DELETE_ALL_URLS')) {
+    define('FIFU_DELETE_ALL_URLS', false);
+}
 
 $FIFU_SESSION = array();

featured-image-from-url/trunk/includes/attachment.php

@@ -64 +64 @@
     global $wpdb;
     if (fifu_is_web_story() || (($_POST['action'] ?? '') == 'query-attachments' || ($_POST['action'] ?? '') == 'get-attachment'))
-        $where .= ' AND ' . $wpdb->prefix . 'posts.post_author <> ' . FIFU_AUTHOR . ' ';
+        $where .= $wpdb->prepare(" AND {$wpdb->posts}.post_author <> %d ", FIFU_AUTHOR);
     return $where;
 }
@@ -71 +71 @@
     global $wpdb;
     if (fifu_is_web_story() || (is_admin() && $q->is_main_query() && strpos($where, 'attachment') !== false))
-        $where .= ' AND ' . $wpdb->prefix . 'posts.post_author <> ' . FIFU_AUTHOR . ' ';
+        $where .= $wpdb->prepare(" AND {$wpdb->posts}.post_author <> %d ", FIFU_AUTHOR);
     return $where;
 }, 10, 2);

featured-image-from-url/trunk/includes/html/og-image.html

@@ -1 +1 @@
 <!-- FIFU:meta:begin:image -->
-<meta property="og:image" content="<?php echo $url ?>" />
+<meta property="og:image" content="<?php echo esc_attr(esc_url($url)) ?>" />
 <!-- FIFU:meta:end:image -->

featured-image-from-url/trunk/includes/html/twitter-image.html

@@ -1 +1 @@
 <!-- FIFU:meta:begin:twitter -->
-<meta name="twitter:image" content="<?php echo $url ?>" />
+<meta name="twitter:image" content="<?php echo esc_attr(esc_url($url)) ?>" />
 <!-- FIFU:meta:end:twitter -->

featured-image-from-url/trunk/includes/speedup.php

@@ -190 +190 @@
     $sizes = unserialize(FIFU_SPEEDUP_SIZES);
 
-    // Check if the width is present in the available sizes
+    // Preserve original width for aspect ratio calculation
+    $original_width = $width;
+
+    // Snap width to the next allowed size if needed
     if (!in_array($width, $sizes)) {
-        // Look for the next higher value
         foreach ($sizes as $size) {
             if ($size >= $width) {
@@ -200 +202 @@
         }
 
-        // If the next higher value is bigger than 1920, use 1920
+        // Hard cap at 1920
         if ($width > 1920) {
             $width = 1920;
@@ -206 +208 @@
     }
 
-    // Calculate the new height to maintain the aspect ratio
+    // Recalculate height to preserve original aspect ratio
     if ($height) {
-        $aspect_ratio = $height / $width;
-        $new_height = $width * $aspect_ratio;
+        $aspect_ratio = $height / max(1, $original_width);
+        $new_height = (int) round($width * $aspect_ratio);
     } else {
-        $new_height = $height;
+        $new_height = $height; // keep as is (0 or null)
     }
 

featured-image-from-url/trunk/includes/util.php

@@ -289 +289 @@
 }
 
+function fifu_unit_test() {
+    return 'Hello, World!';
+}
+
 // developers
 

featured-image-from-url/trunk/readme.txt

@@ -5 +5 @@
 Requires at least: 5.6
 Tested up to: 6.8.2
-Stable tag: 5.2.7
+Stable tag: 5.2.8
 License: GPLv3
 License URI: https://www.gnu.org/licenses/gpl-3.0.html
@@ -247 +247 @@
 == Changelog ==
 
+= 5.2.8 =
+* Fixes: vulnerabilities reported by the Wordfence Security team.
+
 = 5.2.7 =
 * New: Notice to rate the plugin; Enhancement: Auto set featured media from post content (now supports local relative URLs); Fix: Incomplete product data generated for Rich Results.
@@ -274 +277 @@
 * Notice: the plugin collects the theme name anonymously (the goal is to identify the most common themes and ensure FIFU works correctly with all of them).
 
-= 5.1.8 =
-* Fix: Optimized Images (performance issue when serving full image size and possible conflicts with images from Cloudinary); Fix: images in the WooCommerce product gallery (not displayed when Optimized Images was disabled).
-
 = others =
 * [more](https://fifu.app/changelog)
@@ -283 +283 @@
 == Upgrade Notice ==
 
-= 5.2.7 =
-* New: Notice to rate the plugin; Enhancement: Auto set featured media from post content (now supports local relative URLs); Fix: Incomplete product data generated for Rich Results.
+= 5.2.8 =
+* Fixes: vulnerabilities reported by the Wordfence Security team.