Analysis Report Folder Analysis cache/final-tiles-grid-gallery-lite_3.6.8 → cache/final-tiles-grid-gallery-lite_3.6.9 - CVE-2025-13693

Vulnerability Existed: yes
TRUE POSITIVE
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - CWE-79 - FinalTilesGalleryLite.php Lines 1134-1137

Old Code:
```php
if ( current_user_can( 'unfiltered_html' ) ) {
    $script = ( isset( $_POST['ftg_script'] ) ? wp_kses_post( wp_unslash( $_POST['ftg_script'] ) ) : '' );
} else {
    $script = ( isset( $_POST['ftg_script'] ) ? wp_strip_all_tags( wp_unslash( $_POST['ftg_script'] ) ) : '' );
}
```

Fixed Code:
```php
if ( current_user_can( 'unfiltered_html' ) ) {
    $script = ( isset( $_POST['ftg_script'] ) ? wp_kses_post( wp_unslash( $_POST['ftg_script'] ) ) : '' );
} else {
    $script = '';
}
```

Explanation:
The old code attempted to sanitize user input from `$_POST['ftg_script']` for non-privileged users using `wp_strip_all_tags()`. However, this function only removes HTML tags and is insufficient for preventing XSS attacks when the input is used in a context where it could be interpreted as executable code (such as inline JavaScript). The fix removes the user input entirely for non-privileged users (`$script = ''`), which prevents the vulnerability by ensuring untrusted input cannot reach the output. This is the correct approach: privileged users (with 'unfiltered_html' capability) can use `wp_kses_post()` for proper sanitization, while unprivileged users should not have access to script content at all.

Vulnerability Existed: yes
TRUE POSITIVE
Improper Access Control / Missing Authorization Check - CWE-276 - admin/include/fields.php lines 936-944
[Old Code]
```php
$this->addField( "Customizations", "script", array(
    "name"        => esc_html__( "Custom scripts", "final-tiles-grid-gallery-lite" ),
    "type"        => "textarea",
    "description" => wp_kses( __( "This script will be called after the gallery initialization. Useful for custom lightboxes.\r\n            <br />\r\n            <br />\r\n            <strong>Write just the code without using the &lt;script&gt;&lt;/script&gt; tags</strong>", "final-tiles-grid-gallery-lite" ), array() ),
    "proCall"     => false,
    "excludeFrom" => array("shortcode"),
) );
```

[Fixed Code]
```php
if ( current_user_can( 'unfiltered_html' ) ) {
    $this->addField( "Customizations", "script", array(
        "name"        => esc_html__( "Custom scripts", "final-tiles-grid-gallery-lite" ),
        "type"        => "textarea",
        "description" => wp_kses( __( "This script will be called after the gallery initialization. Useful for custom lightboxes.\r\n                <br />\r\n                <br />\r\n                <strong>Write just the code without using the &lt;script&gt;&lt;/script&gt; tags</strong>", "final-tiles-grid-gallery-lite" ), array() ),
        "proCall"     => false,
        "excludeFrom" => array("shortcode"),
    ) );
}
```

Explanation:
The original code exposed a custom script input field to all authenticated users without verifying their capabilities. This allows lower-privileged users (e.g., contributors, editors) to inject arbitrary JavaScript code that executes after gallery initialization, potentially leading to stored XSS attacks or privilege escalation. The fix restricts this field to only users with the `unfiltered_html` capability (typically administrators), preventing unauthorized code injection. This is a critical security fix that properly implements capability-based access control in WordPress.