Context Navigation

Changeset 3460985

Timestamp:

02/13/2026 06:31:55 PM (3 weeks ago)

Author:

collectchat

Message:

Release 2.4.9

Location:

collectchat

Files:

-                      r3404657
+                      r3460985
 /**
  * Plugin Name: Collect.chat - Chatbot
  * Version: 2.4.8
+ * Version: 2.4.9
  * Plugin URI: https://collect.chat
  * Description: Chatbots are the simplest, easiest way to collect leads & data from visitors. Create free chatbot without coding using Collect.chat. Never miss an opportunity by engaging every site visitor.
 …
+        }
+        // only users with unfiltered_html capability can save scripts
+        if (!current_user_can('unfiltered_html')) return $post_id;
         $current_data = get_post_meta($post_id, '_inpost_head_script', true);
 …
                     } else {
                         if (current_user_can('unfiltered_html')) {
                             $arr[$i] = wp_kses($v, $allowed_html); // Script sanitization for users with the unfiltered_html capability
+                            $arr[$i] = wp_kses($v, $allowed_html);
                         } else {
                             return wp_kses_post($v); // Sanitize all content for other users
+                            $arr[$i] = wp_kses_post($v);
+                        }
+                    }

-                      r3404657
+                      r3460985
 Requires at least: 4.5.0
 Tested up to: 6.9
 Stable tag: 2.4.8
+Stable tag: 2.4.9
 License: GPLv3
 License URI: https://www.gnu.org/licenses/gpl-3.0.html
 …
 * Bug fixes
+= 2.4.9 =
+* Security fix: Stored XSS vulnerability remediation
+* Enforce server-side capability checks for script meta fields
 = 2.4.8 =
 * Support for WordPress 6.9

Note: See TracChangeset for help on using the changeset viewer.