diff --git a/includes/class-import-export.php b/includes/class-import-export.php index 945df785..be5c3ad8 100644 --- a/includes/class-import-export.php +++ b/includes/class-import-export.php @@ -631,12 +631,12 @@ public function process_import_step() { continue; } - $username = isset($row['username']) ? $row['username'] : ''; - $email = isset($row['email']) ? $row['email'] : ''; - $first_name = isset($row['first_name']) ? $row['first_name'] : ''; - $last_name = isset($row['last_name']) ? $row['last_name'] : ''; - $bio = isset($row['bio']) ? $row['bio'] : ''; - $display_name = isset($row['display_name']) ? $row['display_name'] : ''; + $username = isset($row['username']) ? sanitize_user($row['username']) : ''; + $email = isset($row['email']) ? sanitize_email($row['email']) : ''; + $first_name = isset($row['first_name']) ? sanitize_text_field($row['first_name']) : ''; + $last_name = isset($row['last_name']) ? sanitize_text_field($row['last_name']) : ''; + $bio = isset($row['bio']) ? sanitize_textarea_field($row['bio']) : ''; + $display_name = isset($row['display_name']) ? sanitize_text_field($row['display_name']) : ''; $password = wp_generate_password(); $exclude = array('user_id'); $exclude = apply_filters('uwp_import_exclude_columns', $exclude, $row); @@ -644,7 +644,6 @@ public function process_import_step() { if(isset($row['username']) && username_exists($row['username'])){ $user = get_user_by('login', $row['username']); $user_id = $user->ID; - $email = $row['email']; if( !empty( $email ) && $update_existing = apply_filters('uwp_import_update_users', false, $row, $user_id) ) { $args = array( 'ID' => $user_id, @@ -663,7 +662,7 @@ public function process_import_step() { $user = get_user_by('ID', $row['user_id']); if(false === $user){ $userdata = array( - 'user_login' => $row['username'], + 'user_login' => $username, 'user_email' => $email, 'user_pass' => $password, 'first_name' => $first_name, diff --git a/includes/helpers/pages.php b/includes/helpers/pages.php index ae792cd0..b8263b29 100644 --- a/includes/helpers/pages.php +++ b/includes/helpers/pages.php @@ -381,10 +381,16 @@ function uwp_get_user_badge($args){ if ( empty( $badge ) && empty($args['icon_class']) ) { $badge = isset($field->site_title) ? $field->site_title : ''; } - if( !empty( $badge ) && $badge = str_replace("%%input%%", $match_value,$badge) ){ + // Decode entities in the admin-authored template text now, before any + // untrusted user values are substituted in below. Decoding after + // substitution would undo the escaping applied to those values. + if ( ! empty( $badge ) ) { + $badge = wp_specialchars_decode( $badge, ENT_QUOTES ); + } + if( !empty( $badge ) && $badge = str_replace("%%input%%", esc_html( (string) $match_value ), $badge) ){ // will be replace in condition check } - if( !empty( $badge ) && $user_id && $badge = str_replace("%%profile_url%%", uwp_build_profile_tab_url($user_id),$badge) ){ + if( !empty( $badge ) && $user_id && $badge = str_replace("%%profile_url%%", esc_url( uwp_build_profile_tab_url($user_id) ),$badge) ){ // will be replace in condition check } @@ -429,7 +435,7 @@ function uwp_get_user_badge($args){ $new_window = ' target="_blank" '; } - $badge = ! empty( $badge ) ? __( wp_specialchars_decode( $badge, ENT_QUOTES ), 'userswp' ) : ''; + $badge = ! empty( $badge ) ? __( $badge, 'userswp' ) : ''; // phone & email link if ( ! empty( $field ) && ! empty( $field->field_type ) && ! empty( $args['link'] ) && strpos( $args['link'], 'http' ) !== 0 ) { @@ -596,6 +602,9 @@ function uwp_replace_variables($text, $user_id = ''){ foreach($user_data as $key => $val) { if ( ! in_array( $key, $excluded_fields ) ) { $val = apply_filters( 'uwp_replace_variables_' . $key, $val, $text ); + if ( is_scalar( $val ) ) { + $val = esc_html( (string) $val ); + } $text = str_replace( '%%' . $key . '%%', $val, $text ); } } diff --git a/languages/userswp-en_US.mo b/languages/userswp-en_US.mo index ba0b3f4c..28233aa5 100755 Binary files a/languages/userswp-en_US.mo and b/languages/userswp-en_US.mo differ diff --git a/languages/userswp-en_US.po b/languages/userswp-en_US.po index d526431b..5cd8fe9b 100644 --- a/languages/userswp-en_US.po +++ b/languages/userswp-en_US.po @@ -1,9 +1,9 @@ msgid "" msgstr "" -"Project-Id-Version: UsersWP 1.2.69\n" +"Project-Id-Version: UsersWP 1.2.70\n" "Report-Msgid-Bugs-To: \n" -"POT-Creation-Date: 2026-07-22 11:20+0530\n" -"PO-Revision-Date: 2026-07-22 11:20+0530\n" +"POT-Creation-Date: 2026-08-03 15:25+0530\n" +"PO-Revision-Date: 2026-08-03 15:26+0530\n" "Last-Translator: \n" "Language-Team: AyeCode Ltd \n" "Language: en_US\n" @@ -15,7 +15,7 @@ msgstr "" "_nx:1,2;_x;_ex;esc_attr_e;esc_attr__\n" "X-Poedit-Basepath: ..\n" "X-Poedit-SourceCharset: UTF-8\n" -"X-Generator: Poedit 3.5\n" +"X-Generator: Poedit 3.3.2\n" "X-Poedit-SearchPath-0: .\n" "X-Poedit-SearchPathExcluded-0: vendor\n" @@ -611,7 +611,7 @@ msgstr "" msgid "Let users enter their website url." msgstr "" -#: admin/settings/class-formbuilder.php:689 includes/helpers/pages.php:576 +#: admin/settings/class-formbuilder.php:689 includes/helpers/pages.php:582 msgid "Facebook" msgstr "" @@ -623,7 +623,7 @@ msgstr "" msgid "Facebook url" msgstr "" -#: admin/settings/class-formbuilder.php:710 includes/helpers/pages.php:577 +#: admin/settings/class-formbuilder.php:710 includes/helpers/pages.php:583 msgid "Twitter" msgstr "" @@ -635,7 +635,7 @@ msgstr "" msgid "Twitter url" msgstr "" -#: admin/settings/class-formbuilder.php:731 includes/helpers/pages.php:578 +#: admin/settings/class-formbuilder.php:731 includes/helpers/pages.php:584 msgid "Instagram" msgstr "" @@ -647,7 +647,7 @@ msgstr "" msgid "Instagram url" msgstr "" -#: admin/settings/class-formbuilder.php:752 includes/helpers/pages.php:579 +#: admin/settings/class-formbuilder.php:752 includes/helpers/pages.php:585 msgid "Linkedin" msgstr "" @@ -659,7 +659,7 @@ msgstr "" msgid "Linkedin url" msgstr "" -#: admin/settings/class-formbuilder.php:773 includes/helpers/pages.php:580 +#: admin/settings/class-formbuilder.php:773 includes/helpers/pages.php:586 msgid "Flickr" msgstr "" @@ -671,7 +671,7 @@ msgstr "" msgid "Flickr url" msgstr "" -#: admin/settings/class-formbuilder.php:794 includes/helpers/pages.php:581 +#: admin/settings/class-formbuilder.php:794 includes/helpers/pages.php:587 msgid "GitHub" msgstr "" @@ -683,7 +683,7 @@ msgstr "" msgid "GitHub url" msgstr "" -#: admin/settings/class-formbuilder.php:815 includes/helpers/pages.php:582 +#: admin/settings/class-formbuilder.php:815 includes/helpers/pages.php:588 msgid "YouTube" msgstr "" @@ -695,7 +695,7 @@ msgstr "" msgid "YouTube url" msgstr "" -#: admin/settings/class-formbuilder.php:836 includes/helpers/pages.php:583 +#: admin/settings/class-formbuilder.php:836 includes/helpers/pages.php:589 msgid "WordPress" msgstr "" @@ -3438,12 +3438,12 @@ msgstr "" msgid "Row - %s Error: Skipped due to invalid/no data." msgstr "" -#: includes/class-import-export.php:692 +#: includes/class-import-export.php:691 #, php-format msgid "Row - %s Error: User could not be created." msgstr "" -#: includes/class-import-export.php:721 +#: includes/class-import-export.php:720 #, php-format msgid "Row - %s Error: %s" msgstr "" @@ -4218,75 +4218,75 @@ msgid "" "plugin is updated." msgstr "" -#: includes/helpers/pages.php:550 +#: includes/helpers/pages.php:556 msgid "Primary" msgstr "" -#: includes/helpers/pages.php:551 +#: includes/helpers/pages.php:557 msgid "Secondary" msgstr "" -#: includes/helpers/pages.php:552 +#: includes/helpers/pages.php:558 msgid "Success" msgstr "" -#: includes/helpers/pages.php:553 +#: includes/helpers/pages.php:559 msgid "Danger" msgstr "" -#: includes/helpers/pages.php:554 +#: includes/helpers/pages.php:560 msgid "Warning" msgstr "" -#: includes/helpers/pages.php:555 +#: includes/helpers/pages.php:561 msgid "Info" msgstr "" -#: includes/helpers/pages.php:556 +#: includes/helpers/pages.php:562 msgid "Light" msgstr "" -#: includes/helpers/pages.php:557 +#: includes/helpers/pages.php:563 msgid "Dark" msgstr "" -#: includes/helpers/pages.php:558 +#: includes/helpers/pages.php:564 msgid "White" msgstr "" -#: includes/helpers/pages.php:559 +#: includes/helpers/pages.php:565 msgid "Purple" msgstr "" -#: includes/helpers/pages.php:560 +#: includes/helpers/pages.php:566 msgid "Salmon" msgstr "" -#: includes/helpers/pages.php:561 +#: includes/helpers/pages.php:567 msgid "Cyan" msgstr "" -#: includes/helpers/pages.php:562 +#: includes/helpers/pages.php:568 msgid "Gray" msgstr "" -#: includes/helpers/pages.php:563 +#: includes/helpers/pages.php:569 msgid "Indigo" msgstr "" -#: includes/helpers/pages.php:564 +#: includes/helpers/pages.php:570 msgid "Orange" msgstr "" -#: includes/helpers/pages.php:584 +#: includes/helpers/pages.php:590 msgid "Google" msgstr "" -#: includes/helpers/pages.php:585 +#: includes/helpers/pages.php:591 msgid "Yahoo" msgstr "" -#: includes/helpers/pages.php:586 +#: includes/helpers/pages.php:592 msgid "Vkontakte" msgstr "" diff --git a/readme.txt b/readme.txt index c39b9afa..adb7bf67 100644 --- a/readme.txt +++ b/readme.txt @@ -4,7 +4,7 @@ Donate link: https://www.ko-fi.com/stiofan Tags: login form, registration, registration form, user profile, user registration, members, membership Requires at least: 6.1 Tested up to: 7.0 -Stable tag: 1.2.69 +Stable tag: 1.2.70 License: GPLv3 License URI: http://www.gnu.org/licenses/gpl-3.0.html @@ -159,6 +159,10 @@ Yes, you can customize it with Elementor, but also with Gutenberg, Divi, Beaver == Changelog == += 1.2.70 - 2026-08-03 = +* Badge Widget Variable Substitution - FIXED/SECURITY +* Merge AUI 0.2.51 & SD 1.2.34 - CHANGED + = 1.2.69 - 2026-07-22 = * Allow username or email on the forgot Password form - FIXED diff --git a/userswp.php b/userswp.php index 1db0f92c..c08ea9ce 100644 --- a/userswp.php +++ b/userswp.php @@ -3,7 +3,7 @@ Plugin Name: UsersWP Plugin URI: https://userswp.io/ Description: The only lightweight user profile plugin for WordPress. UsersWP features front end user profile, users directory, a registration and a login form. -Version: 1.2.69 +Version: 1.2.70 Author: AyeCode Ltd Author URI: https://userswp.io License: GPL-2.0+ @@ -24,7 +24,7 @@ } if ( ! defined( 'USERSWP_VERSION' ) ) { - define( 'USERSWP_VERSION', '1.2.69' ); + define( 'USERSWP_VERSION', '1.2.70' ); } if ( ! defined( 'USERSWP_PATH' ) ) { diff --git a/vendor/ayecode/wp-super-duper/change-log.txt b/vendor/ayecode/wp-super-duper/change-log.txt index 15a5d398..ad3a676b 100644 --- a/vendor/ayecode/wp-super-duper/change-log.txt +++ b/vendor/ayecode/wp-super-duper/change-log.txt @@ -1,3 +1,6 @@ += 1.2.34 - 2026-07-29 = +* Fix missing textdomain - FIXED + = 1.2.33 - 2026-06-24 = * Fusion Builder tab errors when SD block group name contains special characters (like \/' etc) - FIXED * Validate fallback page data before rendering in block visibility - FIXED diff --git a/vendor/ayecode/wp-super-duper/sd-plugin.php b/vendor/ayecode/wp-super-duper/sd-plugin.php index 8344e049..93e7bb46 100644 --- a/vendor/ayecode/wp-super-duper/sd-plugin.php +++ b/vendor/ayecode/wp-super-duper/sd-plugin.php @@ -5,7 +5,7 @@ * @wordpress-plugin * Plugin Name: Super Duper - Examples * Description: This is a Hello World test plugin for WP Super Duper Class. - * Version: 1.2.33 + * Version: 1.2.34 * Author: AyeCode * Author URI: https://ayecode.io * Text Domain: super-duper diff --git a/vendor/ayecode/wp-super-duper/wp-super-duper.php b/vendor/ayecode/wp-super-duper/wp-super-duper.php index 175b6f05..b6e9091c 100644 --- a/vendor/ayecode/wp-super-duper/wp-super-duper.php +++ b/vendor/ayecode/wp-super-duper/wp-super-duper.php @@ -5,7 +5,7 @@ if ( ! class_exists( 'WP_Super_Duper' ) ) { - define( 'SUPER_DUPER_VER', '1.2.33' ); + define( 'SUPER_DUPER_VER', '1.2.34' ); /** * A Class to be able to create a Widget, Shortcode or Block to be able to output content for WordPress. diff --git a/vendor/composer/autoload_static.php b/vendor/composer/autoload_static.php index 93b1a636..1fe1b3c2 100644 --- a/vendor/composer/autoload_static.php +++ b/vendor/composer/autoload_static.php @@ -13,14 +13,14 @@ class ComposerStaticInitf3d2d3b01d25e99f52c2a4d35c24b58c ); public static $prefixLengthsPsr4 = array ( - 'C' => + 'C' => array ( 'Composer\\Installers\\' => 20, ), ); public static $prefixDirsPsr4 = array ( - 'Composer\\Installers\\' => + 'Composer\\Installers\\' => array ( 0 => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers', ), diff --git a/vendor/composer/installed.json b/vendor/composer/installed.json index a10626d6..2f5351fb 100644 --- a/vendor/composer/installed.json +++ b/vendor/composer/installed.json @@ -206,24 +206,24 @@ }, { "name": "ayecode/wp-super-duper", - "version": "1.2.33", - "version_normalized": "1.2.33.0", + "version": "1.2.34", + "version_normalized": "1.2.34.0", "source": { "type": "git", "url": "https://github.com/AyeCode/wp-super-duper.git", - "reference": "08d488111ffa84911162261f4ac64986cdddb230" + "reference": "c8678e97ca8ad4f5f71f946b5374ebb4f3fb1ac0" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/AyeCode/wp-super-duper/zipball/08d488111ffa84911162261f4ac64986cdddb230", - "reference": "08d488111ffa84911162261f4ac64986cdddb230", + "url": "https://api.github.com/repos/AyeCode/wp-super-duper/zipball/c8678e97ca8ad4f5f71f946b5374ebb4f3fb1ac0", + "reference": "c8678e97ca8ad4f5f71f946b5374ebb4f3fb1ac0", "shasum": "" }, "require": { "composer/installers": "~1.0", "php": ">=5.4.0" }, - "time": "2026-06-24T14:57:30+00:00", + "time": "2026-07-29T14:12:18+00:00", "type": "library", "installation-source": "dist", "autoload": { @@ -255,7 +255,7 @@ ], "support": { "issues": "https://github.com/AyeCode/wp-super-duper/issues", - "source": "https://github.com/AyeCode/wp-super-duper/tree/1.2.33" + "source": "https://github.com/AyeCode/wp-super-duper/tree/1.2.34" }, "install-path": "../ayecode/wp-super-duper" }, diff --git a/vendor/composer/installed.php b/vendor/composer/installed.php index 7115ccf5..0d3be753 100644 --- a/vendor/composer/installed.php +++ b/vendor/composer/installed.php @@ -3,7 +3,7 @@ 'name' => 'uswerwp/userswp', 'pretty_version' => 'dev-master', 'version' => 'dev-master', - 'reference' => '570126f04d37441dfc371cfa6ae4d73738ea67cf', + 'reference' => 'e9b72c7a50c333a0d507579be24fc3cecde60197', 'type' => 'project', 'install_path' => __DIR__ . '/../../', 'aliases' => array(), @@ -47,9 +47,9 @@ 'dev_requirement' => false, ), 'ayecode/wp-super-duper' => array( - 'pretty_version' => '1.2.33', - 'version' => '1.2.33.0', - 'reference' => '08d488111ffa84911162261f4ac64986cdddb230', + 'pretty_version' => '1.2.34', + 'version' => '1.2.34.0', + 'reference' => 'c8678e97ca8ad4f5f71f946b5374ebb4f3fb1ac0', 'type' => 'library', 'install_path' => __DIR__ . '/../ayecode/wp-super-duper', 'aliases' => array(), @@ -79,7 +79,7 @@ 'uswerwp/userswp' => array( 'pretty_version' => 'dev-master', 'version' => 'dev-master', - 'reference' => '570126f04d37441dfc371cfa6ae4d73738ea67cf', + 'reference' => 'e9b72c7a50c333a0d507579be24fc3cecde60197', 'type' => 'project', 'install_path' => __DIR__ . '/../../', 'aliases' => array(),