Security vulnerability

I am getting notices that this plugin has a security vulnerability for cross site scripting. Is there a fix coming? https://patchstack.com/database/vulnerability/weather-atlas/wordpress-weather-atlas-widget-plugin-3-0-1-cross-site-scripting-xss-vulnerability?_a_id=431 Same issue here, WPToolkit Shows WordPress Weather Atlas Widget plugin <= 3.0.1 – Cross Site Scripting (XSS) vulnerability Cross Site Scripting (XSS) vulnerability discovered by LVT-tholv2k (Patchstack Alliance) in WordPress Plugin Weather Atlas Widget (versions <= 3.0.1) Date: 18.11.2024 | Source: https://patchstack.com/database/vulnerability/weather-atlas/wordpress-weather-atlas-widget-plugin-3-0-1-cross-site-scripting-xss-vulnerability?_a_id=110 I Disabled the plugin, I will wait a couple of days and if there is no patch or version update I will try to find where vulnerabillity is and update it myown or I will change the plugin with another one, its a pitty This is a very nice plugin. Thank you for the heads-up. We will most definitely try to identify the vulnerability. If/When we find the issue, we will fix it, hopefully before it is announced on the mentioned website. If it is published, we will address it promptly. Thx again @weatheratlas thanks for the update. dj https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/weather-atlas/weather-atlas-widget-301-unauthenticated-cross-site-scripting Dear Plugin Authors, Check the file class-weather-atlas-rest-api.php (I beleive here lies the XSSVulnerability) 1.) The maybe_unserialize and unserialize Mitigation: Escape all output data using esc_html() , esc_attr() , 2.) The widget_name might not be sanitized. Mitigation: Sanitize or validate all fields to ensure they meet expected formats before returning them. maybe this <?php // Assuming your namespace and use declarations here if you have any class Weather_Atlas_REST_API { public function __construct() { add_action('rest_api_init', array($this, 'register_routes')); } public function register_routes() { register_rest_route('weather-atlas/v1', '/widgets', array( 'methods' => 'GET', 'callback' => array($this, 'get_weather_widgets'), 'permission_callback' => '__return_true' )); } public function get_weather_widgets() { global $wpdb; $prefix = 'weather_atlas_widget_'; // Prepare the query securely $query = $wpdb->prepare("SELECT * FROM {$wpdb->options} WHERE option_name LIKE %s", $prefix . '%'); $widgets = $wpdb->get_results($query); // Safely sort widgets by 'widget_name' usort($widgets, function ($a, $b) { $a_data = maybe_unserialize($a->option_value); $b_data = maybe_unserialize($b->option_value); $a_name = isset($a_data['widget_name']) ? esc_html($a_data['widget_name']) : ''; $b_name = isset($b_data['widget_name']) ? esc_html($b_data['widget_name']) : ''; return strcmp($a_name, $b_name); }); // Prepare the response with sanitized data $formatted_widgets = array(); foreach ($widgets as $widget) { $widget_data = maybe_unserialize($widget->option_value); $formatted_widgets[] = array( 'id' => esc_attr(str_replace('weather_atlas_widget_', '', $widget->option_name)), 'widget_name' => isset($widget_data['widget_name']) ? esc_html($widget_data['widget_name']) : 'Unnamed Widget' ); } return $formatted_widgets; } } @weatheratlas any update on this? Several security sites are reporting this now. Please address this. @manos4wpsites Thank you for assisting with the patch. We have used your fix and updated a bit.. The old script had potential XSS issues because widget_name was returned without sanitization or escaping, allowing malicious data from the database to be exposed in the API response. This was resolved by sanitizing with sanitize_text_field() and escaping with esc_html() to ensure safe output. Commit Comments – Fixed XSS vulnerability by sanitizing widget_name with sanitize_text_field() during processing. – Escaped API output using esc_html() to ensure safe rendering of data. – Improved data handling with maybe_unserialize() to safely process serialized database values. – Enhanced API security by validating and escaping user-controlled data before returning responses. Fingers crossed this solved potential XSS issue Hello, unfortunately the problem has not yet been resolved in version 3.0.2. A security risk is still detected: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/weather-atlas/weather-atlas-widget-301-unauthenticated-cross-site-scripting You marked this issue as resolved, but it seems this XSS vulnerability remains even on this 3.0.2 version. Do you have any plans to address this? https://patchstack.com/database/wordpress/plugin/weather-atlas/vulnerability/wordpress-weather-atlas-widget-plugin-3-0-1-cross-site-scripting-xss-vulnerability I am having same issue on the latest copy of the plugin version 3.0.2 see screemshot attached https://tinyurl.com/26qxna65 Hi Developer could you please check below and see if this can help you apply the necessary fixes to these vulnerabilities please. I have listed potential issues and their fixes. <?php /** * Weather Atlas Widget Security Fixes Documentation * Version: 3.0.2 * * This file documents the XSS vulnerabilities and their fixes. * DO NOT USE THIS FILE IN PRODUCTION - FOR DOCUMENTATION PURPOSES ONLY */ /** * 1. public/partials/weather-atlas-public-display.php Fixes * Problem: Unescaped output in widget display */ // Vulnerable code example: $widget_title = $instance['title']; echo $widget_title; // VULNERABLE // Fix: Proper escaping $widget_title = $instance['title']; echo esc_html($widget_title); // FIXED // Location display fix // Vulnerable: echo $location_name; // VULNERABLE // Fix: echo esc_html($location_name); // FIXED /** * 2. includes/class-weather-atlas.php Fixes * Problem: Unescaped widget output in widget() method */ // Vulnerable code example: $city_selector = $instance['city_selector']; $country_selector = $instance['country_selector']; echo '<div class="weather-atlas-wrapper" data-city="' . $city_selector . '" data-country="' . $country_selector . '">'; // VULNERABLE // Fix: Proper escaping and sanitization $city_selector = absint($instance['city_selector']); $country_selector = absint($instance['country_selector']); echo '<div class="weather-atlas-wrapper" data-city="' . esc_attr($city_selector) . '" data-country="' . esc_attr($country_selector) . '">'; // FIXED /** * 3. admin/weather-atlas-settings.php Fixes * Problem: Insufficient input validation in admin settings */ // Vulnerable code example: $api_settings = $_POST['weather_atlas_settings']; // VULNERABLE update_option('weather_atlas_settings', $api_settings); // Fix: Proper validation and sanitization if (!isset($_POST['weather_atlas_nonce']) || !wp_verify_nonce($_POST['weather_atlas_nonce'], 'weather_atlas_settings')) { wp_die('Security check failed'); } $api_settings = array( 'city_name' => sanitize_text_field($_POST['weather_atlas_settings']['city_name']), 'api_key' => sanitize_text_field($_POST['weather_atlas_settings']['api_key']), 'layout' => in_array($_POST['weather_atlas_settings']['layout'], array('horizontal', 'vertical')) ? $_POST['weather_atlas_settings']['layout'] : 'horizontal', 'temperature_unit' => in_array($_POST['weather_atlas_settings']['temperature_unit'], array('C', 'F')) ? $_POST['weather_atlas_settings']['temperature_unit'] : 'C' ); update_option('weather_atlas_settings', $api_settings); // FIXED /** * 4. block/block.js Fixes (JavaScript) * Problem: Potential XSS in Gutenberg block rendering * Note: While this is JavaScript, showing the vulnerable parts and fixes */ // Vulnerable code example: /* // VULNERABLE const widgetContent = <br> <div class="weather-widget"><br> ${props.attributes.location}<br> </div><br> ; element.innerHTML = widgetContent; */ // Fix: Proper escaping in JavaScript /* // FIXED const widgetContent = <br> <div class="weather-widget"><br> ${wp.escapeHtml(props.attributes.location)}<br> </div><br> ; element.innerHTML = wp.element.renderToString(widgetContent); */ /** * Additional Security Measures to Implement: * * 1. Input Validation: * - Always validate user input before processing * - Use WordPress sanitization functions * - Implement type checking * * 2. Output Escaping: * - esc_html() for plain text * - esc_attr() for HTML attributes * - esc_url() for URLs * - wp_kses() for allowing specific HTML tags * * 3. Form Security: * - Implement nonce checks * - Add capability checks * - Validate form submissions * * 4. API Security: * - Sanitize API responses * - Implement rate limiting * - Use wp_remote_get() instead of file_get_contents() * * 5. Database Security: * - Use prepared statements * - Sanitize data before storage * - Escape data on retrieval */ // END OF DOCUMENTATION Any updates forthcoming? Looks like this plugin may have fallen into the Abandoned bucket, which is a shame because I really like this plugin. It’s also a shame that after a month of no response from the developer, I will be forced to uninstall this plugin and replace it with an alternative. https://patchstack.com/database/wordpress/plugin/weather-atlas/vulnerability/wordpress-weather-atlas-widget-plugin-3-0-1-cross-site-scripting-xss-vulnerability v3.0.4 is fixed. Update to version 3.0.4 (or later).