Analysis Report · Folder Analysis cache/mediapress_1.6.1 → cache/mediapress_1.6.2 — CVE-2025-14552

Vulnerability Existed: yes
TRUE POSITIVE
Stored Cross-Site Scripting (XSS) - CWE-79 - templates/mediapress/default/shortcodes/create-gallery.php [85]
Old Code:
```
<input type='hidden' name="mpp-gallery-component" value="<?php echo $current_component; ?>"/>
```
Fixed Code:
```
<input type='hidden' name="mpp-gallery-component" value="<?php echo esc_attr( $current_component ); ?>"/>
```
Explanation:
The variable `$current_component` is output directly into an HTML attribute without escaping. If this variable contains user-controlled data or untrusted content, an attacker could inject malicious JavaScript through the attribute value. The fix applies `esc_attr()`, the WordPress function for properly escaping attribute values, preventing XSS attacks.

---

Vulnerability Existed: yes
TRUE POSITIVE
Improper Input Validation - CWE-20 - templates/mediapress/default/shortcodes/create-gallery.php [20, 24, 28, 32, 36]
Old Code:
```
$title = $_POST['mpp-gallery-title'];
$description = $_POST['mpp-gallery-description'];
$status = $_POST['mpp-gallery-status'];
$type = $_POST['mpp-gallery-type'];
$component = $_POST['mpp-gallery-component'];
```
Fixed Code:
```
$title = wp_unslash( $_POST['mpp-gallery-title'] );
$description = wp_unslash( $_POST['mpp-gallery-description'] );
$status = wp_unslash( $_POST['mpp-gallery-status'] );
$type = wp_unslash( $_POST['mpp-gallery-type'] );
$component = wp_unslash( $_POST['mpp-gallery-component'] );
```
Explanation:
By default, WordPress applies `wp_magic_quotes()` to $_POST data, adding slashes to handle quotes. The code was directly using these escaped values without removing the slashes. The fix applies `wp_unslash()` to properly handle the data before storage or processing, preventing double-escaping issues and ensuring data integrity. This is important when the data will be stored in the database or used in other contexts.

Vulnerability Existed: yes
TRUE POSITIVE
[CWE Name] CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - CWE-79 - templates/mediapress/default/shortcodes/uploader.php - Lines 48, 56
[Old Code]
Line 48: `<input type='hidden' name='mpp-uploading-media-type' class='mpp-uploading-media-type' value="<?php echo $type; ?>"/>`
Line 56: `<input type='hidden' name='mpp-shortcode-upload-gallery-id' id='mpp-shortcode-upload-gallery-id' value="<?php echo $gallery_id; ?>"/>`
[Fixed Code]
Line 48: `<input type='hidden' name='mpp-uploading-media-type' class='mpp-uploading-media-type' value="<?php echo esc_attr( $type ); ?>"/>`
Line 56: `<input type='hidden' name='mpp-shortcode-upload-gallery-id' id='mpp-shortcode-upload-gallery-id' value="<?php echo esc_attr( $gallery_id ); ?>"/>`
Explanation:
The original code directly echoed the `$type` and `$gallery_id` variables into HTML attribute values without proper escaping. This creates a Stored/Reflected Cross-Site Scripting (XSS) vulnerability. An attacker could inject malicious JavaScript by providing specially crafted input containing quotes and script tags (e.g., `" onload="alert('XSS')"`), which would be executed in the browser. The fix applies `esc_attr()`, a WordPress escaping function specifically designed to safely escape data for use in HTML attributes, preventing the injection of malicious code. This is a standard XSS prevention technique in WordPress development.