Security waring by Shield Security

Hi @gattringerot,
the XSS “risk” was only usable by a WordPress logged-in user with admin role: an admin could insert scripts in the cookie banner.
I’ll contact them but it’s actually fixed, so feel confident about it.

Hi, Ryan here from wpvulndb.com.

We have been tracking the issue here; https://wpvulndb.com/vulnerabilities/9918

Your fix in version 3.1 was not sufficient and could trivially be bypassed.

You would at least need to use WordPress’ esc_html() function.

If you could make that small change, we could mark it as fixed on our side.

Although, I agree, this issue is extremely low risk, as only an administrator user take advantage of it, and the form has CSRF tokens in place.

Thanks!

Hi @ethicalhack3r, version 3.1.3 release with your suggested bugfix.

Please le me know if the problem is solved.
Thank you and kind regards,
Marco

Great, thanks! We’ve updated our entry to reflect the new changes.

https://wpvulndb.com/vulnerabilities/9918