Analysis Report · Folder Analysis cache/ultimate-member_2.11.0 → cache/ultimate-member_2.11.1 — CVE-2025-13220

I'll analyze the provided code diff for security fixes.

---

**Vulnerability 1:**

Vulnerability Existed: yes
TRUE POSITIVE

Cross-Site Scripting (XSS) - CWE-79 - includes/core/um-filters-fields.php lines 79-81

**Old Code:**
```php
$value = '<div class="um-youtube">'
    . '<iframe width="600" height="450" src="https://www.youtube.com/embed/' . $value . '" frameborder="0" allowfullscreen></iframe>'
    . '</div>';
```

**Fixed Code:**
```php
$value = 'https://www.youtube.com/embed/' . $value;
$value = '<div class="um-youtube">'
    . '<iframe width="600" height="450" src="' . esc_url( $value ) . '" frameborder="0" allowfullscreen></iframe>'
    . '</div>';
```

**Explanation:**
The original code directly concatenated the `$value` variable into the `src` attribute without proper escaping. Although `um_youtube_id_from_url()` likely extracts a clean video ID, the lack of output escaping creates an XSS vulnerability if the function fails to sanitize properly or if the video ID could be manipulated. The fix uses `esc_url()` to escape the URL before output, preventing malicious JavaScript from being injected into the iframe src attribute.

---

**Vulnerability 2:**

Vulnerability Existed: yes
TRUE POSITIVE

Cross-Site Scripting (XSS) - CWE-79 - includes/core/um-filters-fields.php lines 130-131

**Old Code:**
```php
$value = '<div class="um-vimeo">
                <iframe src="https://player.vimeo.com/video/' . $value . '" width="600" height="450" frameborder="0" webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe>
                </div>';
```

**Fixed Code:**
```php
$value = 'https://player.vimeo.com/video/' . $value;
$value = '<div class="um-vimeo">
                <iframe src="' . esc_url( $value ) . '" width="600" height="450" frameborder="0" webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe>
                </div>';
```

**Explanation:**
Similar to the YouTube vulnerability, the Vimeo iframe src attribute was not properly escaped. Although the value should be numeric (from `parse_url`), the direct concatenation without escaping violates secure output practices. The fix applies `esc_url()` to properly escape the URL, preventing XSS attacks through the iframe src attribute.

---

**Vulnerability 3:**

Vulnerability Existed: yes
TRUE POSITIVE

Cross-Site Scripting (XSS) - CWE-79 - includes/core/um-filters-fields.php lines 203-204

**Old Code:**
```php
$value = '<div class="um-googlemap">
                <iframe width="600" height="450" frameborder="0" style="border:0" src="https://maps.google.it/maps?q=' . urlencode( $value ) . '&output=embed"></iframe>
            </div>';
```

**Fixed Code:**
```php
$value = 'https://maps.google.it/maps?q=' . urlencode( $value ) . '&output=embed';
$value = '<div class="um-googlemap">
                <iframe width="600" height="450" frameborder="0" style="border:0" src="' . esc_url( $value ) . '"></iframe>
            </div>';
```

**Explanation:**
While `urlencode()` is used to encode the value, it does not escape HTML entities. The URL was directly concatenated into the src attribute without proper output escaping. The fix constructs the complete URL first, then applies `esc_url()` for proper escaping before output, preventing XSS through the iframe src attribute.