{"id":17151363,"date":"2023-10-26T02:58:31","date_gmt":"2023-10-26T02:58:31","guid":{"rendered":"https:\/\/wordpress.org\/support\/topic\/security-patch-3\/"},"modified":"2023-10-26T02:58:31","modified_gmt":"2023-10-26T02:58:31","slug":"security-patch-3","status":"publish","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/security-patch-3\/","title":{"rendered":"Security Patch"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">I have not found a replacement but have not been happy about the security issue. So I have made a patch. Be warned that the patch below might break some of the advanced shortcode options. I do not use any of them so what I did was sanitize each to strip out any HTML.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Starting at line 144 in \/includes\/class-widget-shortcode.php of the plugin.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\t\t\t'before_widget' =&gt; '&lt;' . esc_html($container_tag) . ' id=\"' . esc_html($container_id) . '\" class=\"' . esc_html($container_class) . ' ' . esc_html($css_class) . '\"&gt;',\n\t\t\t'before_title' =&gt; '&lt;' . esc_html($title_tag) . ' class=\"' . esc_html($title_class) . '\"&gt;',\n\t\t\t'after_title' =&gt; '&lt;\/' . esc_html($title_tag) . '&gt;',\n\t\t\t'after_widget' =&gt; '&lt;\/' . esc_html($container_tag) . '&gt;',\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">So as you can see I have wrapped every shortcode option with an esc_html function to strip any HTML out of the inputs. If you use html in any of these such as css_class it will break things. But if you only use the plugin to place widgets on your site with the basic shortcode structure like [widget id=&#8221;text-2&#8243;] then it will still work and be secure.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you do this I also suggest you edit the version number in the main file init.php so that site scans do not show the vulnerable version number.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"template":"","class_list":["post-17151363","topic","type-topic","status-publish","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/17151363","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/17151363\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=17151363"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}