WordPress.org
Get WordPress

Plugin Directory

Changeset 3321809


Ignore:
Timestamp:
07/03/2025 01:25:26 PM (9 months ago)
Author:
sasiddiqui
Message:

Bump to v2.1.0

Location:
prevent-xss-vulnerability
Files:
6 added
6 deleted
4 edited
12 copied

Legend:

Unmodified
Added
Removed

  • prevent-xss-vulnerability/tags/2.1.0/changelog.txt

    r3212153 r3321809  
    22
    33This file contains only old changelog. See readme.txt for newer versions.
     4
     5= 2.0.2 - Dec 23, 24 =
     6
     7Fix minor WPCS issues and change text for better understanding.
     8
     9= 2.0.1 - Aug 19, 22 =
     10
     11  * Bug
     12    * [Please fix Notices for use in WP_DEBUG mode](https://wordpress.org/support/topic/please-fix-notices-for-use-in-wp_debug-mode/)
    413
    514= 2.0.0 - Jul 14, 21 =

  • prevent-xss-vulnerability/tags/2.1.0/includes/class-prevent-xss-vulnerability.php

    r3212153 r3321809  
    1919     * @var string
    2020     */
    21     public $version = '2.0.2';
     21    public $version = '2.1.0';
    2222
    2323    /**

  • prevent-xss-vulnerability/tags/2.1.0/prevent-xss-vulnerability.php

    r3212153 r3321809  
    44 * Plugin URI: https://www.yasglobal.com/web-design-development/wordpress/prevent-xss-vulnerability/
    55 * Description: This WordPress plugin enhances website security by preventing Cross-Site Scripting (XSS) vulnerabilities. It blocks and encodes malicious characters in URLs, escapes HTML in `$_GET` variables, and provides customizable settings for website owners.
    6  * Version: 2.0.2
     6 * Version: 2.1.0
    77 * Requires at least: 3.5
    88 * Requires PHP: 5.6
    … …  
    2020/**
    2121 *  Prevent XSS Vulnerability - Secure your website from XSS Attacks.
    22  *  Copyright (C) 2017-2024, Sami Ahmed Siddiqui <sami.siddiqui@yasglobal.com>
     22 *  Copyright (C) 2017-2025, Sami Ahmed Siddiqui <sami.siddiqui@yasglobal.com>
    2323 *
    2424 *  This program is free software: you can redistribute it and/or modify

  • prevent-xss-vulnerability/tags/2.1.0/readme.txt

    r3212153 r3321809  
    33Tags: attack, cross-site scripting, security, vulnerability, xss
    44Requires at least: 3.5
    5 Tested up to: 6.7
    6 Stable tag: 2.0.2
     5Tested up to: 6.8
     6Stable tag: 2.1.0
    77License: GPLv3
    88License URI: https://www.gnu.org/licenses/gpl-3.0.html
    99
    10 This WordPress plugin enhances website security by preventing Cross-Site Scripting (XSS) vulnerabilities. It blocks and encodes malicious characters in URLs, escapes HTML in `$_GET` variables, and provides customizable settings for website owners.
     10This WordPress plugin boosts your website's security by stopping Cross-Site Scripting (XSS) attacks. It blocks and encodes harmful characters in URLs, safely handles HTML in `$_GET` variables, and offers settings you can customize.
     11
    1112
    1213== Description ==
    1314
    14 This plugin helps safeguard your website against two common types of Cross-Site Scripting (XSS) vulnerabilities:
     15This plugin helps protect your website from two common types of Cross-Site Scripting (XSS) vulnerabilities:
    1516
    16 * **Reflected XSS:** In Reflected XSS, malicious scripts are injected into the URL of a website. When a user clicks on a link containing this malicious script, it can be executed on their browser, potentially stealing their information or compromising their system.
    17 * **Self-XSS:** This occurs when a user's own input on the website is reflected back to them in an insecure manner, allowing malicious scripts to be executed in their browser.
     17* **Reflected XSS:** This happens when harmful scripts are hidden in a website's URL. If a user clicks a link with such a script, it can run in their browser, potentially stealing their data or taking control of their system.
     18* **Self-XSS:** This occurs when a user's own input on your website is displayed back to them in an unsafe way, allowing malicious scripts to run in their browser.
    1819
    1920This plugin provides several layers of protection:
    2021
    21 **Blocking:** When enabled, the plugin scans URLs for specific parameters. If any of the listed parameters are found in the URL, the plugin redirects the user to prevent potential XSS attacks. You can customize the list by excluding specific parameters you still want to allow.
     22**Blocking:** When active, the plugin checks URLs for specific characters. If it finds any of these characters in the URL, it redirects the user to prevent a potential XSS attack. You can customize which characters to block or allow.
    2223
    2324* Opening Round Bracket `(`
    … …  
    3132* Closing Curly Bracket `}`
    3233
    33 **Encoding:** For additional security, the plugin encodes certain characters within the URL parameters. This prevents malicious code from being executed even if it's included in the URL. You can also exclude specific parameters from being encoded.
     34**Encoding:** For an extra layer of security, the plugin encodes certain characters found in URL parameters. This stops harmful code from running, even if it's present in the URL. You can also choose to exclude specific parameters from being encoded.
    3435
    3536* Exclamation Mark `!`
    … …  
    4243* Greater than Sign `>`
    4344* Grave Accent <code>`</code>
    44 * Cap Sign `^`
     45* Caret `^`
    4546* Opening Square Bracket `[`
    4647* Closing Square Bracket `]`
    … …  
    4950* Closing Curly Bracket `}`
    5051
    51 **Escaping HTML in `$_GET`:** This plugin automatically escapes HTML characters within the `$_GET` variable. This is crucial if your website retrieves data from URLs and displays it in the HTML content. This helps prevent malicious scripts from being injected through user-controlled input.
     52**Escaping HTML in `$_GET`:** This plugin automatically makes HTML characters safe within the `$_GET` variable. This is vital if your website pulls data from URLs and displays it as part of your web page. It helps prevent malicious scripts from being injected through user-provided input.
    5253
    5354=== Important Notes: ===
    5455
    55 * After activating the plugin, thoroughly test your website forms, especially if you use WooCommerce. Ensure the plugin doesn't disrupt your cart and checkout processes.
    56 * Bug reports for this plugin are welcome on GitHub: [https://github.com/samiahmedsiddiqui/prevent-xss-vulnerability/issues](). Please note that GitHub is not a support forum, and only genuine bug reports will be addressed.
     56* After activating the plugin, **thoroughly test your website forms**, especially if you use WooCommerce. Make sure the plugin doesn't interfere with your shopping cart and checkout processes.
     57* We welcome bug reports for this plugin on GitHub: [https://github.com/samiahmedsiddiqui/prevent-xss-vulnerability/issues](). Please remember that GitHub is for bug reports only, not general support.
    5758
    58 By implementing this plugin and following the recommendations, you can significantly enhance your website's security against XSS attacks.
     59By using this plugin and following these recommendations, you can significantly improve your website's defense against XSS attacks.
    5960
    6061== Installation ==
    6162
    62 This process defines you the steps to follow either you are installing through WordPress or Manually from FTP.
     63You can install this plugin either through your WordPress dashboard or manually via FTP.
    6364
    6465**From within WordPress**
    6566
    66 1. Visit 'Plugins > Add New'
    67 2. Search for Prevent XSS Vulnerability
    68 3. Activate Prevent XSS Vulnerability from your Plugins page.
    69 4. Go to "after activation" below.
     671.  Go to 'Plugins > Add New'.
     682.  Search for "Prevent XSS Vulnerability".
     693.  Click "Activate" for "Prevent XSS Vulnerability" on your Plugins page.
     704.  Then, follow the "After activation" steps below.
    7071
    71 **Manually**
     72**Manually (via FTP)**
    7273
    73 1. Upload the `prevent-xss-vulnerability` folder to the `/wp-content/plugins/` directory
    74 2. Activate Prevent XSS Vulnerability through the 'Plugins' menu in WordPress
    75 3. Go to "after activation" below.
     741.  Upload the `prevent-xss-vulnerability` folder to the `/wp-content/plugins/` directory.
     752.  Activate "Prevent XSS Vulnerability" from the 'Plugins' menu in WordPress.
     763.  Then, follow the "After activation" steps below.
    7677
    7778**After activation**
    7879
    79 1. Navigate to the `Prevent XSS Vulnerability` page from the Admin Dashboard
    80 2. Make the changes as per your site functionality
    81 3. You're done!
     801.  Go to the `Prevent XSS Vulnerability` page in your WordPress Admin Dashboard.
     812.  Adjust the settings to fit your website's needs.
     823.  That's it! You're done.
    8283
    8384== Screenshots ==
    8485
    85 * It removes the parameters from the URL which are used in XSS Attack and redirects the user (Recommended).
     86* This screen shows how the plugin removes XSS-related parameters from the URL and redirects the user (Recommended).
    8687
    87 * It encodes the parameters from the URL which are used in XSS Attack.
     88* This screen demonstrates how the plugin encodes parameters in the URL that could be used in an XSS attack.
    8889
    89 * It escapes the HTML from the `$_GET` PHP variable which is mostly used to read the data from the URL (Recommended).
     90* This screen illustrates how the plugin escapes HTML from the `$_GET` PHP variable, which is commonly used to read data from the URL (Recommended).
    9091
    91 * Add the message in developer console for the user to alert about the XSS attack.
     92* This image shows the message added to the developer console to alert the user about an XSS attack.
    9293
    93 * Show message in developer console to alert user about the Self-XSS attack. This message can be customized from the settings page.
     94* This screenshot displays the customizable message shown in the developer console to warn users about Self-XSS attacks.
    9495
    9596== Frequently Asked Questions ==
    … …  
    9798= Q. Why should I install this plugin? =
    9899
    99 A. Installing this plugin is the easiest way to protect your site from XSS Vulnerabilities.
     100A. Installing this plugin is the easiest way to protect your site from XSS vulnerabilities.
    100101
    101 = Q. Does this plugin escape HTML in printing search? =
     102= Q. Does this plugin escape HTML when printing search results? =
    102103
    103 A. Yes, this plugin escapes HTML in `$_GET` variable, which is commonly used to print data from the URL to HTML. However, if your site relies heavily on `$_GET` for other purposes, you may need to conduct thorough testing to ensure compatibility.
     104A. Yes, this plugin escapes HTML in the `$_GET` variable, which is often used to display data from the URL in HTML. However, if your site heavily relies on `$_GET` for other functions, you might need to do thorough testing to ensure everything works correctly.
    104105
    105 = Q. Does this plugin have any conflict with any other plugin? =
     106= Q. Does this plugin conflict with any other plugins? =
    106107
    107 A. While no major conflicts have been reported, it's always a good practice to test your website thoroughly after installing any new plugin.
     108A. While we haven't received reports of major conflicts, it's always a good idea to thoroughly test your website after installing any new plugin.
    108109
    109110== Changelog ==
    110111
    111 = 2.0.2 - Dec 23, 24 =
     112=== 2.1.0 - July 03, 2025 ===
    112113
    113 Fix minor WPCS issues and change text for better understanding.
     114  * Key Changes & Improvements:**
     115    * **Enhanced Console Visibility:** The prominent "Stop!" message now appears in a much larger (48px), bold, red font with a black text shadow to grab immediate attention. The main warning message also uses a larger, more readable font (20px).
     116    * **Improved Console Grouping:** The entire Self-XSS warning is now grouped within a `console.group('Self-XSS Warning')` block. This keeps all related messages together in the developer console, making the warning stand out and preventing it from getting lost among other console output.
    114117
    115 = 2.0.1 - Aug 19, 22 =
     118=== Earlier versions ===
    116119
    117   * Bug
    118     * [Please fix Notices for use in WP_DEBUG mode](https://wordpress.org/support/topic/please-fix-notices-for-use-in-wp_debug-mode/)
    119 
    120 = Earlier versions =
    121 
    122   * For the changelog of earlier versions, please refer to the separate changelog.txt file.
     120  * For a detailed changelog of earlier versions, please refer to the separate `changelog.txt` file.
     121```

  • prevent-xss-vulnerability/trunk/changelog.txt

    r3212153 r3321809  
    22
    33This file contains only old changelog. See readme.txt for newer versions.
     4
     5= 2.0.2 - Dec 23, 24 =
     6
     7Fix minor WPCS issues and change text for better understanding.
     8
     9= 2.0.1 - Aug 19, 22 =
     10
     11  * Bug
     12    * [Please fix Notices for use in WP_DEBUG mode](https://wordpress.org/support/topic/please-fix-notices-for-use-in-wp_debug-mode/)
    413
    514= 2.0.0 - Jul 14, 21 =

  • prevent-xss-vulnerability/trunk/includes/class-prevent-xss-vulnerability.php

    r3212153 r3321809  
    1919     * @var string
    2020     */
    21     public $version = '2.0.2';
     21    public $version = '2.1.0';
    2222
    2323    /**

  • prevent-xss-vulnerability/trunk/prevent-xss-vulnerability.php

    r3212153 r3321809  
    44 * Plugin URI: https://www.yasglobal.com/web-design-development/wordpress/prevent-xss-vulnerability/
    55 * Description: This WordPress plugin enhances website security by preventing Cross-Site Scripting (XSS) vulnerabilities. It blocks and encodes malicious characters in URLs, escapes HTML in `$_GET` variables, and provides customizable settings for website owners.
    6  * Version: 2.0.2
     6 * Version: 2.1.0
    77 * Requires at least: 3.5
    88 * Requires PHP: 5.6
    … …  
    2020/**
    2121 *  Prevent XSS Vulnerability - Secure your website from XSS Attacks.
    22  *  Copyright (C) 2017-2024, Sami Ahmed Siddiqui <sami.siddiqui@yasglobal.com>
     22 *  Copyright (C) 2017-2025, Sami Ahmed Siddiqui <sami.siddiqui@yasglobal.com>
    2323 *
    2424 *  This program is free software: you can redistribute it and/or modify

  • prevent-xss-vulnerability/trunk/readme.txt

    r3212153 r3321809  
    33Tags: attack, cross-site scripting, security, vulnerability, xss
    44Requires at least: 3.5
    5 Tested up to: 6.7
    6 Stable tag: 2.0.2
     5Tested up to: 6.8
     6Stable tag: 2.1.0
    77License: GPLv3
    88License URI: https://www.gnu.org/licenses/gpl-3.0.html
    99
    10 This WordPress plugin enhances website security by preventing Cross-Site Scripting (XSS) vulnerabilities. It blocks and encodes malicious characters in URLs, escapes HTML in `$_GET` variables, and provides customizable settings for website owners.
     10This WordPress plugin boosts your website's security by stopping Cross-Site Scripting (XSS) attacks. It blocks and encodes harmful characters in URLs, safely handles HTML in `$_GET` variables, and offers settings you can customize.
     11
    1112
    1213== Description ==
    1314
    14 This plugin helps safeguard your website against two common types of Cross-Site Scripting (XSS) vulnerabilities:
     15This plugin helps protect your website from two common types of Cross-Site Scripting (XSS) vulnerabilities:
    1516
    16 * **Reflected XSS:** In Reflected XSS, malicious scripts are injected into the URL of a website. When a user clicks on a link containing this malicious script, it can be executed on their browser, potentially stealing their information or compromising their system.
    17 * **Self-XSS:** This occurs when a user's own input on the website is reflected back to them in an insecure manner, allowing malicious scripts to be executed in their browser.
     17* **Reflected XSS:** This happens when harmful scripts are hidden in a website's URL. If a user clicks a link with such a script, it can run in their browser, potentially stealing their data or taking control of their system.
     18* **Self-XSS:** This occurs when a user's own input on your website is displayed back to them in an unsafe way, allowing malicious scripts to run in their browser.
    1819
    1920This plugin provides several layers of protection:
    2021
    21 **Blocking:** When enabled, the plugin scans URLs for specific parameters. If any of the listed parameters are found in the URL, the plugin redirects the user to prevent potential XSS attacks. You can customize the list by excluding specific parameters you still want to allow.
     22**Blocking:** When active, the plugin checks URLs for specific characters. If it finds any of these characters in the URL, it redirects the user to prevent a potential XSS attack. You can customize which characters to block or allow.
    2223
    2324* Opening Round Bracket `(`
    … …  
    3132* Closing Curly Bracket `}`
    3233
    33 **Encoding:** For additional security, the plugin encodes certain characters within the URL parameters. This prevents malicious code from being executed even if it's included in the URL. You can also exclude specific parameters from being encoded.
     34**Encoding:** For an extra layer of security, the plugin encodes certain characters found in URL parameters. This stops harmful code from running, even if it's present in the URL. You can also choose to exclude specific parameters from being encoded.
    3435
    3536* Exclamation Mark `!`
    … …  
    4243* Greater than Sign `>`
    4344* Grave Accent <code>`</code>
    44 * Cap Sign `^`
     45* Caret `^`
    4546* Opening Square Bracket `[`
    4647* Closing Square Bracket `]`
    … …  
    4950* Closing Curly Bracket `}`
    5051
    51 **Escaping HTML in `$_GET`:** This plugin automatically escapes HTML characters within the `$_GET` variable. This is crucial if your website retrieves data from URLs and displays it in the HTML content. This helps prevent malicious scripts from being injected through user-controlled input.
     52**Escaping HTML in `$_GET`:** This plugin automatically makes HTML characters safe within the `$_GET` variable. This is vital if your website pulls data from URLs and displays it as part of your web page. It helps prevent malicious scripts from being injected through user-provided input.
    5253
    5354=== Important Notes: ===
    5455
    55 * After activating the plugin, thoroughly test your website forms, especially if you use WooCommerce. Ensure the plugin doesn't disrupt your cart and checkout processes.
    56 * Bug reports for this plugin are welcome on GitHub: [https://github.com/samiahmedsiddiqui/prevent-xss-vulnerability/issues](). Please note that GitHub is not a support forum, and only genuine bug reports will be addressed.
     56* After activating the plugin, **thoroughly test your website forms**, especially if you use WooCommerce. Make sure the plugin doesn't interfere with your shopping cart and checkout processes.
     57* We welcome bug reports for this plugin on GitHub: [https://github.com/samiahmedsiddiqui/prevent-xss-vulnerability/issues](). Please remember that GitHub is for bug reports only, not general support.
    5758
    58 By implementing this plugin and following the recommendations, you can significantly enhance your website's security against XSS attacks.
     59By using this plugin and following these recommendations, you can significantly improve your website's defense against XSS attacks.
    5960
    6061== Installation ==
    6162
    62 This process defines you the steps to follow either you are installing through WordPress or Manually from FTP.
     63You can install this plugin either through your WordPress dashboard or manually via FTP.
    6364
    6465**From within WordPress**
    6566
    66 1. Visit 'Plugins > Add New'
    67 2. Search for Prevent XSS Vulnerability
    68 3. Activate Prevent XSS Vulnerability from your Plugins page.
    69 4. Go to "after activation" below.
     671.  Go to 'Plugins > Add New'.
     682.  Search for "Prevent XSS Vulnerability".
     693.  Click "Activate" for "Prevent XSS Vulnerability" on your Plugins page.
     704.  Then, follow the "After activation" steps below.
    7071
    71 **Manually**
     72**Manually (via FTP)**
    7273
    73 1. Upload the `prevent-xss-vulnerability` folder to the `/wp-content/plugins/` directory
    74 2. Activate Prevent XSS Vulnerability through the 'Plugins' menu in WordPress
    75 3. Go to "after activation" below.
     741.  Upload the `prevent-xss-vulnerability` folder to the `/wp-content/plugins/` directory.
     752.  Activate "Prevent XSS Vulnerability" from the 'Plugins' menu in WordPress.
     763.  Then, follow the "After activation" steps below.
    7677
    7778**After activation**
    7879
    79 1. Navigate to the `Prevent XSS Vulnerability` page from the Admin Dashboard
    80 2. Make the changes as per your site functionality
    81 3. You're done!
     801.  Go to the `Prevent XSS Vulnerability` page in your WordPress Admin Dashboard.
     812.  Adjust the settings to fit your website's needs.
     823.  That's it! You're done.
    8283
    8384== Screenshots ==
    8485
    85 * It removes the parameters from the URL which are used in XSS Attack and redirects the user (Recommended).
     86* This screen shows how the plugin removes XSS-related parameters from the URL and redirects the user (Recommended).
    8687
    87 * It encodes the parameters from the URL which are used in XSS Attack.
     88* This screen demonstrates how the plugin encodes parameters in the URL that could be used in an XSS attack.
    8889
    89 * It escapes the HTML from the `$_GET` PHP variable which is mostly used to read the data from the URL (Recommended).
     90* This screen illustrates how the plugin escapes HTML from the `$_GET` PHP variable, which is commonly used to read data from the URL (Recommended).
    9091
    91 * Add the message in developer console for the user to alert about the XSS attack.
     92* This image shows the message added to the developer console to alert the user about an XSS attack.
    9293
    93 * Show message in developer console to alert user about the Self-XSS attack. This message can be customized from the settings page.
     94* This screenshot displays the customizable message shown in the developer console to warn users about Self-XSS attacks.
    9495
    9596== Frequently Asked Questions ==
    … …  
    9798= Q. Why should I install this plugin? =
    9899
    99 A. Installing this plugin is the easiest way to protect your site from XSS Vulnerabilities.
     100A. Installing this plugin is the easiest way to protect your site from XSS vulnerabilities.
    100101
    101 = Q. Does this plugin escape HTML in printing search? =
     102= Q. Does this plugin escape HTML when printing search results? =
    102103
    103 A. Yes, this plugin escapes HTML in `$_GET` variable, which is commonly used to print data from the URL to HTML. However, if your site relies heavily on `$_GET` for other purposes, you may need to conduct thorough testing to ensure compatibility.
     104A. Yes, this plugin escapes HTML in the `$_GET` variable, which is often used to display data from the URL in HTML. However, if your site heavily relies on `$_GET` for other functions, you might need to do thorough testing to ensure everything works correctly.
    104105
    105 = Q. Does this plugin have any conflict with any other plugin? =
     106= Q. Does this plugin conflict with any other plugins? =
    106107
    107 A. While no major conflicts have been reported, it's always a good practice to test your website thoroughly after installing any new plugin.
     108A. While we haven't received reports of major conflicts, it's always a good idea to thoroughly test your website after installing any new plugin.
    108109
    109110== Changelog ==
    110111
    111 = 2.0.2 - Dec 23, 24 =
     112=== 2.1.0 - July 03, 2025 ===
    112113
    113 Fix minor WPCS issues and change text for better understanding.
     114  * Key Changes & Improvements:**
     115    * **Enhanced Console Visibility:** The prominent "Stop!" message now appears in a much larger (48px), bold, red font with a black text shadow to grab immediate attention. The main warning message also uses a larger, more readable font (20px).
     116    * **Improved Console Grouping:** The entire Self-XSS warning is now grouped within a `console.group('Self-XSS Warning')` block. This keeps all related messages together in the developer console, making the warning stand out and preventing it from getting lost among other console output.
    114117
    115 = 2.0.1 - Aug 19, 22 =
     118=== Earlier versions ===
    116119
    117   * Bug
    118     * [Please fix Notices for use in WP_DEBUG mode](https://wordpress.org/support/topic/please-fix-notices-for-use-in-wp_debug-mode/)
    119 
    120 = Earlier versions =
    121 
    122   * For the changelog of earlier versions, please refer to the separate changelog.txt file.
     120  * For a detailed changelog of earlier versions, please refer to the separate `changelog.txt` file.
     121```
Note: See TracChangeset for help on using the changeset viewer.