Analysis Report · Folder Analysis cache/restrict-content_3.2.15 → cache/restrict-content_3.2.16 — CVE-2025-14000

Vulnerability Existed: yes
TRUE POSITIVE
Cross-Site Scripting (XSS) - CWE-79 - core/includes/member-forms.php line 126
[Old Code]
echo $rcp_register_form_atts['registered_message'];

[Fixed Code]
echo wp_kses_post( $rcp_register_form_atts['registered_message'] );

Explanation:
The old code directly echoed user-controlled data (`$rcp_register_form_atts['registered_message']`) without sanitization, creating a Stored XSS vulnerability. An attacker could inject malicious JavaScript code into the registered message that would execute in the browsers of users viewing the form. The fix applies `wp_kses_post()`, a WordPress sanitization function that strips dangerous HTML and JavaScript while allowing safe post content (like `<p>`, `<strong>`, etc.), preventing the XSS attack.

# Security Analysis of Code Diff

## Vulnerability 1: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

**Vulnerability Existed:** yes

**Stored XSS - CWE-79** - core/includes/shortcodes.php - Lines 40-42

**Old Code:**
```php
// No sanitization of $atts['userlevel'], $atts['subscription'], or $atts['message']
```

**Fixed Code:**
```php
$atts['userlevel']    = sanitize_text_field( $atts['userlevel'] );
$atts['subscription'] = sanitize_text_field( $atts['subscription'] );
$atts['message']      = wp_kses_post( $atts['message'] );
```

**Explanation:**
The shortcode attributes were not being sanitized before use. The `userlevel` and `subscription` attributes are sanitized with `sanitize_text_field()`, and `message` is sanitized with `wp_kses_post()`. This prevents malicious JavaScript from being injected through shortcode attributes in post content.

---

## Vulnerability 2: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

**Vulnerability Existed:** yes

**Stored XSS - CWE-79** - core/includes/shortcodes.php - Lines 362-365

**Old Code:**
```php
// No sanitization or validation of id, ids, logged_out_header, logged_in_header
```

**Fixed Code:**
```php
$atts['id']                 = isset( $atts['id'] ) ? absint( $atts['id'] ) : null;
$atts['ids']                = isset( $atts['ids'] ) ? implode( ',', array_filter( array_map( 'absint', array_map( 'trim', explode( ',', $atts['ids'] ) ) ) ) ) : null;
$atts['logged_out_header']  = wp_kses_post( $atts['logged_out_header'] );
$atts['logged_in_header']   = wp_kses_post( $atts['logged_in_header'] );
```

**Explanation:**
Shortcode attributes were not being validated. The `id` attribute is now converted to an integer with `absint()`, `ids` is sanitized by converting comma-separated values to integers, and header attributes are sanitized with `wp_kses_post()`. This prevents XSS attacks through these attributes.

---

## Vulnerability 3: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

**Vulnerability Existed:** yes

**Stored XSS - CWE-79** - core/includes/shortcodes.php - Line 388

**Old Code:**
```php
$output = $atts['registered_message'];
```

**Fixed Code:**
```php
$output = wp_kses_post( $atts['registered_message'] );
```

**Explanation:**
The `registered_message` attribute was being output without sanitization. Adding `wp_kses_post()` prevents XSS by allowing only safe HTML tags while removing potentially dangerous content.

---

## Note on Line 504

**Vulnerability Existed:** no

**Formatting Fix** - core/includes/shortcodes.php - Line 504

**Old Code:**
```php
<div class="rcp-stripe-register" 
```

**Fixed Code:**
```php
<div class="rcp-stripe-register"
```

**Explanation:**
This change removes trailing whitespace and is a formatting/style fix with no security implications.