WordPress.org
Get WordPress

Plugin Directory

Changeset 3212153


Ignore:
Timestamp:
12/23/2024 12:06:24 PM (16 months ago)
Author:
sasiddiqui
Message:

Bump to v2.0.2

Location:
prevent-xss-vulnerability
Files:
6 added
6 deleted
10 edited
9 copied

Legend:

Unmodified
Added
Removed

  • prevent-xss-vulnerability/tags/2.0.2/admin/class-prevent-xss-vulnerability-admin.php

    r2564460 r3212153  
    4040            'Prevent XSS Vulnerability',
    4141            'Prevent XSS Vulnerability',
    42             'administrator',
     42            'activate_plugins',
    4343            'prevent-xss-vulnerability-reflected-settings',
    4444            array( $this, 'reflected_settings' ),
    … …  
    4949            'Reflected Cross-site scripting Settings',
    5050            'Reflected XSS',
    51             'administrator',
     51            'activate_plugins',
    5252            'prevent-xss-vulnerability-reflected-settings',
    5353            array( $this, 'reflected_settings' )
    … …  
    5757            'Self Cross-site scripting Settings',
    5858            'Self-XSS',
    59             'administrator',
     59            'activate_plugins',
    6060            'prevent-xss-vulnerability-self-settings',
    6161            array( $this, 'self_xss_settings' )
    … …  
    6565            'About Cross-site scripting',
    6666            'About',
    67             'administrator',
     67            'activate_plugins',
    6868            'prevent-xss-vulnerability-about',
    6969            array( $this, 'about_xss' )

  • prevent-xss-vulnerability/tags/2.0.2/admin/class-prevent-xss-vulnerability-reflected-settings.php

    r2564460 r3212153  
    4646                    <?php
    4747                    esc_html_e(
    48                         'This Plugin Block/Remove the following Entities in the URL:',
     48                        'This plugin blocks or removes the following entities from website URLs:',
    4949                        'prevent-xss-vulnerability'
    5050                    );
    … …  
    149149                    <?php
    150150                        esc_html_e(
    151                             'This Plugin Encodes the following Entities in the URL: ',
     151                            'This plugin encodes the following entities within website URLs:',
    152152                            'prevent-xss-vulnerability'
    153153                        );
    … …  
    305305     *
    306306     * @param string $enabled Whether the escape is enabled or not.
    307      *
    308      * @return void
    309307     */
    310308    private function get_escape_output( $enabled ) {
    … …  
    320318                        <?php
    321319                            esc_html_e(
    322                                 'It strips the HTML in $_GET variable in PHP. So, where ever the $_GET is used in either theme or plugin will get the escaped HTML. It prevents the XSS Attack using HTML and JS Events. If any plugin directly fetching the parameters from the URL without using $_GET variable will get the values without HTML escaped.',
     320                                'This plugin strips HTML tags from the $_GET variable in PHP. Consequently, any part of your theme or plugin that utilizes $_GET to retrieve data from the URL will receive the HTML-escaped value. This effectively prevents XSS attacks that exploit HTML and JavaScript events.',
     321                                'prevent-xss-vulnerability'
     322                            );
     323                        ?>
     324                    </p>
     325
     326                    <p>
     327                        <?php
     328                            esc_html_e(
     329                                'Important Note: If any plugin or custom code directly fetches URL parameters without using the $_GET variable, the retrieved values will not be HTML-escaped by this plugin.',
    323330                                'prevent-xss-vulnerability'
    324331                            );
    … …  
    343350
    344351    /**
    345      * Generate Refleccted page note HTML
     352     * Generate Reflected page note HTML.
    346353     *
    347354     * @access private
    … …  
    354361                <?php
    355362                    esc_html_e(
    356                         'Reflected Cross-site Scripting (XSS) occur when an attacker injects browser executable code within a single HTTP response. You can read more about XSS from',
     363                        'Reflected XSS occurs when malicious code is injected into a website\'s URL. This code can then be executed by a user\'s browser, potentially stealing information or compromising their system. For more information on XSS, please visit',
    357364                        'prevent-xss-vulnerability'
    358365                    );
    … …  
    371378                    <?php
    372379                    esc_html_e(
    373                         'After configuring the settings please check some pages randomly to verify that your site is working as expected.',
     380                        'After configuring these settings, please thoroughly test your website by randomly navigating through different pages to ensure all functionalities are working as expected.',
    374381                        'prevent-xss-vulnerability'
    375382                    );
    … …  
    379386                    <?php
    380387                    esc_html_e(
    381                         'If you are using WooCommerce, then in that case it is highly recommended to go through with all the steps of the Product Purchase (Cart, Checkout etc) to make sure that your online store is working fine.',
     388                        'If you are using WooCommerce, it is crucial to test the entire product purchase process, including cart, checkout, and order completion, to verify that the plugin does not interfere with any core functionalities of your online store.',
    382389                        'prevent-xss-vulnerability'
    383390                    );
    … …  
    396403     * @access private
    397404     * @since 1.0.0
    398      *
    399      * @return void
    400405     */
    401406    private function save_reflected_settings() {
    … …  
    469474     * @access private
    470475     * @since 0.1
    471      *
    472      * @return void
    473476     */
    474477    private function xss_reflected_settings() {
    … …  
    523526            <h2>
    524527            <?php
    525             esc_html_e( 'Reflected Cross-site scripting(XSS) Settings', 'prevent-xss-vulnerability' );
     528            esc_html_e( 'Reflected Cross-site Scripting (XSS) Settings', 'prevent-xss-vulnerability' );
    526529            ?>
    527530            </h2>

  • prevent-xss-vulnerability/tags/2.0.2/admin/class-prevent-xss-vulnerability-self-settings.php

    r2564460 r3212153  
    2222     * @access private
    2323     * @since 1.0.0
    24      *
    25      * @return void
    2624     */
    2725    private function save_self_xss_settings() {
    … …  
    5957     * @access private
    6058     * @since 0.3.0
    61      *
    62      * @return void
    6359     */
    6460    private function self_xss_settings_page() {
    65         if ( ! current_user_can( 'administrator' ) ) {
     61        if ( ! current_user_can( 'activate_plugins' ) ) {
    6662            wp_die(
    6763                esc_html_e(
    … …  
    9894        <div class="wrap">
    9995            <h2>
    100             <?php
    101             esc_html_e( 'Self-XSS Settings', 'prevent-xss-vulnerability' );
    102             ?>
     96                <?php esc_html_e( 'Self-XSS Settings', 'prevent-xss-vulnerability' ); ?>
    10397            </h2>
    10498            <div>
    105             <p>
    106             <?php
    107                 esc_html_e( 'Self-XSS is a social engineering attack used to gain control of victims\' web accounts. In a self-XSS attack, the victim of the attack unknowingly runs malicious code in their own web browser, thus exposing it to the attacker.', 'prevent-xss-vulnerability' );
    108             ?>
    109             </p>
     99                <p>
     100                    <?php
     101                    esc_html_e( 'Self-XSS is a type of security vulnerability where an attacker tricks a user into executing malicious code within their own web browser. This can occur through social engineering tactics, such as convincing the user to copy and paste malicious code into their browser\'s console.', 'prevent-xss-vulnerability' );
     102                    ?>
     103                </p>
     104                <p>
     105                    <?php
     106                        esc_html_e( 'Here\'s a breakdown of how it works:', 'prevent-xss-vulnerability' );
     107                    ?>
     108                </p>
     109                <ol>
     110                    <li>
     111                        <?php
     112                        esc_html_e( 'Social Engineering: The attacker employs social engineering techniques (e.g., phishing, promises of rewards) to convince the victim to perform a specific action.', 'prevent-xss-vulnerability' );
     113                        ?>
     114                    </li>
     115                    <li>
     116                        <?php
     117                        esc_html_e( 'Code Execution: The victim is tricked into executing the malicious code, often by pasting it into the browser\'s console or through other means.', 'prevent-xss-vulnerability' );
     118                        ?>
     119                    </li>
     120                    <li>
     121                        <?php
     122                        esc_html_e( 'Compromised Browser: Once executed, the malicious code can potentially steal sensitive information, hijack user sessions, or spread malware.', 'prevent-xss-vulnerability' );
     123                        ?>
     124                    </li>
     125                </ol>
     126
     127                <p>
     128                    <?php
     129                    esc_html_e( 'Self-XSS attacks exploit user trust and curiosity. It\'s crucial for users to be vigilant and avoid executing any code they don\'t fully understand or trust.', 'prevent-xss-vulnerability' );
     130                    ?>
     131                </p>
    110132            </div>
    111133            <form enctype="multipart/form-data" action="" method="POST" id="reflected-xss">
    … …  
    131153                    <?php
    132154                        esc_html_e(
    133                             'Add warning message when users open the web developer console. Leave empty to use default.',
     155                            'Customize the warning message that appears in the console. Leave empty to use the default message.',
    134156                            'prevent-xss-vulnerability'
    135157                        );

  • prevent-xss-vulnerability/tags/2.0.2/changelog.txt

    r2772468 r3212153  
    22
    33This file contains only old changelog. See readme.txt for newer versions.
     4
     5= 2.0.0 - Jul 14, 21 =
     6
     7  * Bug
     8    * [Unable to execute bulk actions of WooCommerce orders when this plugin is enabled](https://wordpress.org/support/topic/unable-to-execute-bulk-actions-of-woocommerce-orders-when-this-plugin-is-enabled/)
     9    * [Bulk actions dont work (ie bulk delete pages, images)](https://wordpress.org/support/topic/bulk-actions-dont-work-ie-bulk-delete-pages-images/)
     10    * [Facing conflict issue while perform bulk delete option on post](https://wordpress.org/support/topic/facing-conflict-issue-while-perform-bulk-delete-option-on-post/)
     11
     12  * Enhancements
     13        * [Include other/extra parameters](https://github.com/samiahmedsiddiqui/prevent-xss-vulnerability/issues/3)
     14        * Fixed WPCS issues
    415
    516= 1.0.0 - Aug 24, 20 =

  • prevent-xss-vulnerability/tags/2.0.2/includes/class-prevent-xss-vulnerability.php

    r2772468 r3212153  
    1919     * @var string
    2020     */
    21     public $version = '2.0.1';
     21    public $version = '2.0.2';
    2222
    2323    /**

  • prevent-xss-vulnerability/tags/2.0.2/prevent-xss-vulnerability.php

    r2772468 r3212153  
    33 * Plugin Name: Prevent XSS Vulnerability
    44 * Plugin URI: https://www.yasglobal.com/web-design-development/wordpress/prevent-xss-vulnerability/
    5  * Description: Secure your site from the XSS Attack.
    6  * Version: 2.0.1
     5 * Description: This WordPress plugin enhances website security by preventing Cross-Site Scripting (XSS) vulnerabilities. It blocks and encodes malicious characters in URLs, escapes HTML in `$_GET` variables, and provides customizable settings for website owners.
     6 * Version: 2.0.2
     7 * Requires at least: 3.5
     8 * Requires PHP: 5.6
    79 * Author: Sami Ahmed Siddiqui
    810 * Author URI: https://www.linkedin.com/in/sami-ahmed-siddiqui/
    911 * License: GPLv3
     12 * License URI: https://www.gnu.org/licenses/gpl-3.0.html
    1013 *
    1114 * Text Domain: prevent-xss-vulnerability
    … …  
    1619
    1720/**
    18  *  Prevent XSS Vulnerability - Secure your website from XSS Attacks
    19  *  Copyright (C) 2017-2021, Sami Ahmed Siddiqui <sami.siddiqui@yasglobal.com>
     21 *  Prevent XSS Vulnerability - Secure your website from XSS Attacks.
     22 *  Copyright (C) 2017-2024, Sami Ahmed Siddiqui <sami.siddiqui@yasglobal.com>
    2023 *
    2124 *  This program is free software: you can redistribute it and/or modify

  • prevent-xss-vulnerability/tags/2.0.2/readme.txt

    r3109212 r3212153  
    11=== Prevent XSS Vulnerability ===
    22Contributors: sasiddiqui
    3 Tags: attack, cross-site scripting, security, vulnerability, xss, self-xss
     3Tags: attack, cross-site scripting, security, vulnerability, xss
    44Requires at least: 3.5
    5 Tested up to: 6.5
    6 Stable tag: 2.0.1
     5Tested up to: 6.7
     6Stable tag: 2.0.2
    77License: GPLv3
    88License URI: https://www.gnu.org/licenses/gpl-3.0.html
    99
     10This WordPress plugin enhances website security by preventing Cross-Site Scripting (XSS) vulnerabilities. It blocks and encodes malicious characters in URLs, escapes HTML in `$_GET` variables, and provides customizable settings for website owners.
     11
    1012== Description ==
    1113
    12 This plugin provides the functionality for `Reflected XSS` and `Self-XSS`.
     14This plugin helps safeguard your website against two common types of Cross-Site Scripting (XSS) vulnerabilities:
    1315
    14 For Reflected XSS, it checks the URL and redirects it if you enabled the `Enable Blocking` option and URL contains any Vulnerable code in it. It only block some parameters which are not allowed in URL and shown Block Parameters section. You can skip some of the parameters from it if you still like them to be used.
     16* **Reflected XSS:** In Reflected XSS, malicious scripts are injected into the URL of a website. When a user clicks on a link containing this malicious script, it can be executed on their browser, potentially stealing their information or compromising their system.
     17* **Self-XSS:** This occurs when a user's own input on the website is reflected back to them in an insecure manner, allowing malicious scripts to be executed in their browser.
    1518
    16 To provide more security, this plugin also escape the HTML in the `$_GET` parameter which is commonly used to get parameters in PHP from the URL and print them in the HTML. This way, HTML properties will not work if anyone provided it in the URL.
     19This plugin provides several layers of protection:
    1720
    18 There are many ways by which the plugin can be tested but it may varies for different sites according to their structure and development functionality.
    19 
    20 === Block Parameters ===
    21 
    22 This plugin block the following parameters in the URL if enabled from the Plugin Settings page.
     21**Blocking:** When enabled, the plugin scans URLs for specific parameters. If any of the listed parameters are found in the URL, the plugin redirects the user to prevent potential XSS attacks. You can customize the list by excluding specific parameters you still want to allow.
    2322
    2423* Opening Round Bracket `(`
    … …  
    3231* Closing Curly Bracket `}`
    3332
    34 You can exclude any of the pre-defined parameter(s) or include any other parameter(s) from the Plugin Settings page.
    35 
    36 === Encode Parameters ===
    37 
    38 This plugin encode the following parameters in the URL if enabled from the Plugin Settings page.
     33**Encoding:** For additional security, the plugin encodes certain characters within the URL parameters. This prevents malicious code from being executed even if it's included in the URL. You can also exclude specific parameters from being encoded.
    3934
    4035* Exclamation Mark `!`
    … …  
    5449* Closing Curly Bracket `}`
    5550
    56 You can exclude any of the pre-defined parameter(s) to being encoded from the Plugin Settings page.
     51**Escaping HTML in `$_GET`:** This plugin automatically escapes HTML characters within the `$_GET` variable. This is crucial if your website retrieves data from URLs and displays it in the HTML content. This helps prevent malicious scripts from being injected through user-controlled input.
    5752
    58 === Escape HTML in `$_GET` Variable ===
     53=== Important Notes: ===
    5954
    60 This plugin escape HTML  in `$_GET` variable. `$_GET` variable is mostly used to put the values in HTML from the URL. This Check is quite useful if your site using/getting anything from the URL and printing it in HTML. It secures your Search and other sections as per your site functionality.
     55* After activating the plugin, thoroughly test your website forms, especially if you use WooCommerce. Ensure the plugin doesn't disrupt your cart and checkout processes.
     56* Bug reports for this plugin are welcome on GitHub: [https://github.com/samiahmedsiddiqui/prevent-xss-vulnerability/issues](). Please note that GitHub is not a support forum, and only genuine bug reports will be addressed.
    6157
    62 > NOTE: Make sure to check your forms after activating the plugin and if you have woocommerce site then please also check the cart and checkout process.
    63 
    64 === Bug reports ===
    65 
    66 Bug reports for `Prevent XSS Vulnerability` are [welcomed on GitHub](https://github.com/yasglobal/prevent-xss-vulnerability). Please note GitHub is not a support forum, and issues that aren't properly qualified as bugs will be closed.
     58By implementing this plugin and following the recommendations, you can significantly enhance your website's security against XSS attacks.
    6759
    6860== Installation ==
    … …  
    10496
    10597= Q. Why should I install this plugin? =
    106 A. Installing this plugin is the easiest way to prevent your site from XSS Vulnerability.
     98
     99A. Installing this plugin is the easiest way to protect your site from XSS Vulnerabilities.
    107100
    108101= Q. Does this plugin escape HTML in printing search? =
    109 A. Yes, this plugin escape HTML in `$_GET` variable which is mostly use to print the data from the URL to HTML. If your site is using `$_GET` then it is safe and the HTML will be escaped otherwise you need to check.
    110102
    111 = Q. Does this plugin has any conflict with any other plugin? =
    112 A. No, this plugin doesn't have any conflict with any plugin.
     103A. Yes, this plugin escapes HTML in `$_GET` variable, which is commonly used to print data from the URL to HTML. However, if your site relies heavily on `$_GET` for other purposes, you may need to conduct thorough testing to ensure compatibility.
     104
     105= Q. Does this plugin have any conflict with any other plugin? =
     106
     107A. While no major conflicts have been reported, it's always a good practice to test your website thoroughly after installing any new plugin.
    113108
    114109== Changelog ==
     110
     111= 2.0.2 - Dec 23, 24 =
     112
     113Fix minor WPCS issues and change text for better understanding.
    115114
    116115= 2.0.1 - Aug 19, 22 =
    … …  
    119118    * [Please fix Notices for use in WP_DEBUG mode](https://wordpress.org/support/topic/please-fix-notices-for-use-in-wp_debug-mode/)
    120119
    121 = 2.0.0 - Jul 14, 21 =
    122 
    123   * Bug
    124     * [Unable to execute bulk actions of WooCommerce orders when this plugin is enabled](https://wordpress.org/support/topic/unable-to-execute-bulk-actions-of-woocommerce-orders-when-this-plugin-is-enabled/)
    125     * [Bulk actions dont work (ie bulk delete pages, images)](https://wordpress.org/support/topic/bulk-actions-dont-work-ie-bulk-delete-pages-images/)
    126     * [Facing conflict issue while perform bulk delete option on post](https://wordpress.org/support/topic/facing-conflict-issue-while-perform-bulk-delete-option-on-post/)
    127 
    128   * Enhancements
    129         * [Include other/extra parameters](https://github.com/samiahmedsiddiqui/prevent-xss-vulnerability/issues/3)
    130         * Fixed WPCS issues
    131 
    132120= Earlier versions =
    133121

  • prevent-xss-vulnerability/trunk/admin/class-prevent-xss-vulnerability-admin.php

    r2564460 r3212153  
    4040            'Prevent XSS Vulnerability',
    4141            'Prevent XSS Vulnerability',
    42             'administrator',
     42            'activate_plugins',
    4343            'prevent-xss-vulnerability-reflected-settings',
    4444            array( $this, 'reflected_settings' ),
    … …  
    4949            'Reflected Cross-site scripting Settings',
    5050            'Reflected XSS',
    51             'administrator',
     51            'activate_plugins',
    5252            'prevent-xss-vulnerability-reflected-settings',
    5353            array( $this, 'reflected_settings' )
    … …  
    5757            'Self Cross-site scripting Settings',
    5858            'Self-XSS',
    59             'administrator',
     59            'activate_plugins',
    6060            'prevent-xss-vulnerability-self-settings',
    6161            array( $this, 'self_xss_settings' )
    … …  
    6565            'About Cross-site scripting',
    6666            'About',
    67             'administrator',
     67            'activate_plugins',
    6868            'prevent-xss-vulnerability-about',
    6969            array( $this, 'about_xss' )

  • prevent-xss-vulnerability/trunk/admin/class-prevent-xss-vulnerability-reflected-settings.php

    r2564460 r3212153  
    4646                    <?php
    4747                    esc_html_e(
    48                         'This Plugin Block/Remove the following Entities in the URL:',
     48                        'This plugin blocks or removes the following entities from website URLs:',
    4949                        'prevent-xss-vulnerability'
    5050                    );
    … …  
    149149                    <?php
    150150                        esc_html_e(
    151                             'This Plugin Encodes the following Entities in the URL: ',
     151                            'This plugin encodes the following entities within website URLs:',
    152152                            'prevent-xss-vulnerability'
    153153                        );
    … …  
    305305     *
    306306     * @param string $enabled Whether the escape is enabled or not.
    307      *
    308      * @return void
    309307     */
    310308    private function get_escape_output( $enabled ) {
    … …  
    320318                        <?php
    321319                            esc_html_e(
    322                                 'It strips the HTML in $_GET variable in PHP. So, where ever the $_GET is used in either theme or plugin will get the escaped HTML. It prevents the XSS Attack using HTML and JS Events. If any plugin directly fetching the parameters from the URL without using $_GET variable will get the values without HTML escaped.',
     320                                'This plugin strips HTML tags from the $_GET variable in PHP. Consequently, any part of your theme or plugin that utilizes $_GET to retrieve data from the URL will receive the HTML-escaped value. This effectively prevents XSS attacks that exploit HTML and JavaScript events.',
     321                                'prevent-xss-vulnerability'
     322                            );
     323                        ?>
     324                    </p>
     325
     326                    <p>
     327                        <?php
     328                            esc_html_e(
     329                                'Important Note: If any plugin or custom code directly fetches URL parameters without using the $_GET variable, the retrieved values will not be HTML-escaped by this plugin.',
    323330                                'prevent-xss-vulnerability'
    324331                            );
    … …  
    343350
    344351    /**
    345      * Generate Refleccted page note HTML
     352     * Generate Reflected page note HTML.
    346353     *
    347354     * @access private
    … …  
    354361                <?php
    355362                    esc_html_e(
    356                         'Reflected Cross-site Scripting (XSS) occur when an attacker injects browser executable code within a single HTTP response. You can read more about XSS from',
     363                        'Reflected XSS occurs when malicious code is injected into a website\'s URL. This code can then be executed by a user\'s browser, potentially stealing information or compromising their system. For more information on XSS, please visit',
    357364                        'prevent-xss-vulnerability'
    358365                    );
    … …  
    371378                    <?php
    372379                    esc_html_e(
    373                         'After configuring the settings please check some pages randomly to verify that your site is working as expected.',
     380                        'After configuring these settings, please thoroughly test your website by randomly navigating through different pages to ensure all functionalities are working as expected.',
    374381                        'prevent-xss-vulnerability'
    375382                    );
    … …  
    379386                    <?php
    380387                    esc_html_e(
    381                         'If you are using WooCommerce, then in that case it is highly recommended to go through with all the steps of the Product Purchase (Cart, Checkout etc) to make sure that your online store is working fine.',
     388                        'If you are using WooCommerce, it is crucial to test the entire product purchase process, including cart, checkout, and order completion, to verify that the plugin does not interfere with any core functionalities of your online store.',
    382389                        'prevent-xss-vulnerability'
    383390                    );
    … …  
    396403     * @access private
    397404     * @since 1.0.0
    398      *
    399      * @return void
    400405     */
    401406    private function save_reflected_settings() {
    … …  
    469474     * @access private
    470475     * @since 0.1
    471      *
    472      * @return void
    473476     */
    474477    private function xss_reflected_settings() {
    … …  
    523526            <h2>
    524527            <?php
    525             esc_html_e( 'Reflected Cross-site scripting(XSS) Settings', 'prevent-xss-vulnerability' );
     528            esc_html_e( 'Reflected Cross-site Scripting (XSS) Settings', 'prevent-xss-vulnerability' );
    526529            ?>
    527530            </h2>

  • prevent-xss-vulnerability/trunk/admin/class-prevent-xss-vulnerability-self-settings.php

    r2564460 r3212153  
    2222     * @access private
    2323     * @since 1.0.0
    24      *
    25      * @return void
    2624     */
    2725    private function save_self_xss_settings() {
    … …  
    5957     * @access private
    6058     * @since 0.3.0
    61      *
    62      * @return void
    6359     */
    6460    private function self_xss_settings_page() {
    65         if ( ! current_user_can( 'administrator' ) ) {
     61        if ( ! current_user_can( 'activate_plugins' ) ) {
    6662            wp_die(
    6763                esc_html_e(
    … …  
    9894        <div class="wrap">
    9995            <h2>
    100             <?php
    101             esc_html_e( 'Self-XSS Settings', 'prevent-xss-vulnerability' );
    102             ?>
     96                <?php esc_html_e( 'Self-XSS Settings', 'prevent-xss-vulnerability' ); ?>
    10397            </h2>
    10498            <div>
    105             <p>
    106             <?php
    107                 esc_html_e( 'Self-XSS is a social engineering attack used to gain control of victims\' web accounts. In a self-XSS attack, the victim of the attack unknowingly runs malicious code in their own web browser, thus exposing it to the attacker.', 'prevent-xss-vulnerability' );
    108             ?>
    109             </p>
     99                <p>
     100                    <?php
     101                    esc_html_e( 'Self-XSS is a type of security vulnerability where an attacker tricks a user into executing malicious code within their own web browser. This can occur through social engineering tactics, such as convincing the user to copy and paste malicious code into their browser\'s console.', 'prevent-xss-vulnerability' );
     102                    ?>
     103                </p>
     104                <p>
     105                    <?php
     106                        esc_html_e( 'Here\'s a breakdown of how it works:', 'prevent-xss-vulnerability' );
     107                    ?>
     108                </p>
     109                <ol>
     110                    <li>
     111                        <?php
     112                        esc_html_e( 'Social Engineering: The attacker employs social engineering techniques (e.g., phishing, promises of rewards) to convince the victim to perform a specific action.', 'prevent-xss-vulnerability' );
     113                        ?>
     114                    </li>
     115                    <li>
     116                        <?php
     117                        esc_html_e( 'Code Execution: The victim is tricked into executing the malicious code, often by pasting it into the browser\'s console or through other means.', 'prevent-xss-vulnerability' );
     118                        ?>
     119                    </li>
     120                    <li>
     121                        <?php
     122                        esc_html_e( 'Compromised Browser: Once executed, the malicious code can potentially steal sensitive information, hijack user sessions, or spread malware.', 'prevent-xss-vulnerability' );
     123                        ?>
     124                    </li>
     125                </ol>
     126
     127                <p>
     128                    <?php
     129                    esc_html_e( 'Self-XSS attacks exploit user trust and curiosity. It\'s crucial for users to be vigilant and avoid executing any code they don\'t fully understand or trust.', 'prevent-xss-vulnerability' );
     130                    ?>
     131                </p>
    110132            </div>
    111133            <form enctype="multipart/form-data" action="" method="POST" id="reflected-xss">
    … …  
    131153                    <?php
    132154                        esc_html_e(
    133                             'Add warning message when users open the web developer console. Leave empty to use default.',
     155                            'Customize the warning message that appears in the console. Leave empty to use the default message.',
    134156                            'prevent-xss-vulnerability'
    135157                        );

  • prevent-xss-vulnerability/trunk/changelog.txt

    r2772468 r3212153  
    22
    33This file contains only old changelog. See readme.txt for newer versions.
     4
     5= 2.0.0 - Jul 14, 21 =
     6
     7  * Bug
     8    * [Unable to execute bulk actions of WooCommerce orders when this plugin is enabled](https://wordpress.org/support/topic/unable-to-execute-bulk-actions-of-woocommerce-orders-when-this-plugin-is-enabled/)
     9    * [Bulk actions dont work (ie bulk delete pages, images)](https://wordpress.org/support/topic/bulk-actions-dont-work-ie-bulk-delete-pages-images/)
     10    * [Facing conflict issue while perform bulk delete option on post](https://wordpress.org/support/topic/facing-conflict-issue-while-perform-bulk-delete-option-on-post/)
     11
     12  * Enhancements
     13        * [Include other/extra parameters](https://github.com/samiahmedsiddiqui/prevent-xss-vulnerability/issues/3)
     14        * Fixed WPCS issues
    415
    516= 1.0.0 - Aug 24, 20 =

  • prevent-xss-vulnerability/trunk/includes/class-prevent-xss-vulnerability.php

    r2772468 r3212153  
    1919     * @var string
    2020     */
    21     public $version = '2.0.1';
     21    public $version = '2.0.2';
    2222
    2323    /**

  • prevent-xss-vulnerability/trunk/prevent-xss-vulnerability.php

    r2772468 r3212153  
    33 * Plugin Name: Prevent XSS Vulnerability
    44 * Plugin URI: https://www.yasglobal.com/web-design-development/wordpress/prevent-xss-vulnerability/
    5  * Description: Secure your site from the XSS Attack.
    6  * Version: 2.0.1
     5 * Description: This WordPress plugin enhances website security by preventing Cross-Site Scripting (XSS) vulnerabilities. It blocks and encodes malicious characters in URLs, escapes HTML in `$_GET` variables, and provides customizable settings for website owners.
     6 * Version: 2.0.2
     7 * Requires at least: 3.5
     8 * Requires PHP: 5.6
    79 * Author: Sami Ahmed Siddiqui
    810 * Author URI: https://www.linkedin.com/in/sami-ahmed-siddiqui/
    911 * License: GPLv3
     12 * License URI: https://www.gnu.org/licenses/gpl-3.0.html
    1013 *
    1114 * Text Domain: prevent-xss-vulnerability
    … …  
    1619
    1720/**
    18  *  Prevent XSS Vulnerability - Secure your website from XSS Attacks
    19  *  Copyright (C) 2017-2021, Sami Ahmed Siddiqui <sami.siddiqui@yasglobal.com>
     21 *  Prevent XSS Vulnerability - Secure your website from XSS Attacks.
     22 *  Copyright (C) 2017-2024, Sami Ahmed Siddiqui <sami.siddiqui@yasglobal.com>
    2023 *
    2124 *  This program is free software: you can redistribute it and/or modify

  • prevent-xss-vulnerability/trunk/readme.txt

    r3109212 r3212153  
    11=== Prevent XSS Vulnerability ===
    22Contributors: sasiddiqui
    3 Tags: attack, cross-site scripting, security, vulnerability, xss, self-xss
     3Tags: attack, cross-site scripting, security, vulnerability, xss
    44Requires at least: 3.5
    5 Tested up to: 6.5
    6 Stable tag: 2.0.1
     5Tested up to: 6.7
     6Stable tag: 2.0.2
    77License: GPLv3
    88License URI: https://www.gnu.org/licenses/gpl-3.0.html
    99
     10This WordPress plugin enhances website security by preventing Cross-Site Scripting (XSS) vulnerabilities. It blocks and encodes malicious characters in URLs, escapes HTML in `$_GET` variables, and provides customizable settings for website owners.
     11
    1012== Description ==
    1113
    12 This plugin provides the functionality for `Reflected XSS` and `Self-XSS`.
     14This plugin helps safeguard your website against two common types of Cross-Site Scripting (XSS) vulnerabilities:
    1315
    14 For Reflected XSS, it checks the URL and redirects it if you enabled the `Enable Blocking` option and URL contains any Vulnerable code in it. It only block some parameters which are not allowed in URL and shown Block Parameters section. You can skip some of the parameters from it if you still like them to be used.
     16* **Reflected XSS:** In Reflected XSS, malicious scripts are injected into the URL of a website. When a user clicks on a link containing this malicious script, it can be executed on their browser, potentially stealing their information or compromising their system.
     17* **Self-XSS:** This occurs when a user's own input on the website is reflected back to them in an insecure manner, allowing malicious scripts to be executed in their browser.
    1518
    16 To provide more security, this plugin also escape the HTML in the `$_GET` parameter which is commonly used to get parameters in PHP from the URL and print them in the HTML. This way, HTML properties will not work if anyone provided it in the URL.
     19This plugin provides several layers of protection:
    1720
    18 There are many ways by which the plugin can be tested but it may varies for different sites according to their structure and development functionality.
    19 
    20 === Block Parameters ===
    21 
    22 This plugin block the following parameters in the URL if enabled from the Plugin Settings page.
     21**Blocking:** When enabled, the plugin scans URLs for specific parameters. If any of the listed parameters are found in the URL, the plugin redirects the user to prevent potential XSS attacks. You can customize the list by excluding specific parameters you still want to allow.
    2322
    2423* Opening Round Bracket `(`
    … …  
    3231* Closing Curly Bracket `}`
    3332
    34 You can exclude any of the pre-defined parameter(s) or include any other parameter(s) from the Plugin Settings page.
    35 
    36 === Encode Parameters ===
    37 
    38 This plugin encode the following parameters in the URL if enabled from the Plugin Settings page.
     33**Encoding:** For additional security, the plugin encodes certain characters within the URL parameters. This prevents malicious code from being executed even if it's included in the URL. You can also exclude specific parameters from being encoded.
    3934
    4035* Exclamation Mark `!`
    … …  
    5449* Closing Curly Bracket `}`
    5550
    56 You can exclude any of the pre-defined parameter(s) to being encoded from the Plugin Settings page.
     51**Escaping HTML in `$_GET`:** This plugin automatically escapes HTML characters within the `$_GET` variable. This is crucial if your website retrieves data from URLs and displays it in the HTML content. This helps prevent malicious scripts from being injected through user-controlled input.
    5752
    58 === Escape HTML in `$_GET` Variable ===
     53=== Important Notes: ===
    5954
    60 This plugin escape HTML  in `$_GET` variable. `$_GET` variable is mostly used to put the values in HTML from the URL. This Check is quite useful if your site using/getting anything from the URL and printing it in HTML. It secures your Search and other sections as per your site functionality.
     55* After activating the plugin, thoroughly test your website forms, especially if you use WooCommerce. Ensure the plugin doesn't disrupt your cart and checkout processes.
     56* Bug reports for this plugin are welcome on GitHub: [https://github.com/samiahmedsiddiqui/prevent-xss-vulnerability/issues](). Please note that GitHub is not a support forum, and only genuine bug reports will be addressed.
    6157
    62 > NOTE: Make sure to check your forms after activating the plugin and if you have woocommerce site then please also check the cart and checkout process.
    63 
    64 === Bug reports ===
    65 
    66 Bug reports for `Prevent XSS Vulnerability` are [welcomed on GitHub](https://github.com/yasglobal/prevent-xss-vulnerability). Please note GitHub is not a support forum, and issues that aren't properly qualified as bugs will be closed.
     58By implementing this plugin and following the recommendations, you can significantly enhance your website's security against XSS attacks.
    6759
    6860== Installation ==
    … …  
    10496
    10597= Q. Why should I install this plugin? =
    106 A. Installing this plugin is the easiest way to prevent your site from XSS Vulnerability.
     98
     99A. Installing this plugin is the easiest way to protect your site from XSS Vulnerabilities.
    107100
    108101= Q. Does this plugin escape HTML in printing search? =
    109 A. Yes, this plugin escape HTML in `$_GET` variable which is mostly use to print the data from the URL to HTML. If your site is using `$_GET` then it is safe and the HTML will be escaped otherwise you need to check.
    110102
    111 = Q. Does this plugin has any conflict with any other plugin? =
    112 A. No, this plugin doesn't have any conflict with any plugin.
     103A. Yes, this plugin escapes HTML in `$_GET` variable, which is commonly used to print data from the URL to HTML. However, if your site relies heavily on `$_GET` for other purposes, you may need to conduct thorough testing to ensure compatibility.
     104
     105= Q. Does this plugin have any conflict with any other plugin? =
     106
     107A. While no major conflicts have been reported, it's always a good practice to test your website thoroughly after installing any new plugin.
    113108
    114109== Changelog ==
     110
     111= 2.0.2 - Dec 23, 24 =
     112
     113Fix minor WPCS issues and change text for better understanding.
    115114
    116115= 2.0.1 - Aug 19, 22 =
    … …  
    119118    * [Please fix Notices for use in WP_DEBUG mode](https://wordpress.org/support/topic/please-fix-notices-for-use-in-wp_debug-mode/)
    120119
    121 = 2.0.0 - Jul 14, 21 =
    122 
    123   * Bug
    124     * [Unable to execute bulk actions of WooCommerce orders when this plugin is enabled](https://wordpress.org/support/topic/unable-to-execute-bulk-actions-of-woocommerce-orders-when-this-plugin-is-enabled/)
    125     * [Bulk actions dont work (ie bulk delete pages, images)](https://wordpress.org/support/topic/bulk-actions-dont-work-ie-bulk-delete-pages-images/)
    126     * [Facing conflict issue while perform bulk delete option on post](https://wordpress.org/support/topic/facing-conflict-issue-while-perform-bulk-delete-option-on-post/)
    127 
    128   * Enhancements
    129         * [Include other/extra parameters](https://github.com/samiahmedsiddiqui/prevent-xss-vulnerability/issues/3)
    130         * Fixed WPCS issues
    131 
    132120= Earlier versions =
    133121
Note: See TracChangeset for help on using the changeset viewer.