Skip to content

4.5.6

Latest
Latest

Choose a tag to compare

View all tags
@goqflash goqflash released this 18 Mar 08:18
4.5.6
dcb649e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

[4.5.6] - 2025-03-18

Security Fix: Sanitize clickToTweet Attributes to Prevent XSS

Description:
This update enhances security by properly sanitizing and escaping user inputs in the clickToTweet shortcode. It prevents potential stored XSS vulnerabilities by:

  • Sanitizing the theme attribute using sanitize_html_class().
  • Escaping output with esc_attr() and esc_html().
  • Validating tweet input with sanitize_text_field().

Fixes: https://patchstack.com/database/wordpress/plugin/social-warfare/vulnerability/wordpress-social-warfare-plugin-4-5-4-cross-site-scripting-xss-vulnerability

Assets 2
Loading