Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2023-1403: lib-content.php in weaver-xtreme/5.0.7/includes – WordPress Themes

The Weaver Xtreme Theme for WordPress is vulnerable to stored Cross-Site Scripting due to insufficient escaping of the profile display name in versions up to, and including, 5.0.7. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE
#xss#web#google#wordpress#php#auth

1<?php2/** @noinspection PhpUnused */3if ( ! defined( ‘ABSPATH’ ) ) {4 exit;5} // Exit if accessed directly6/*7 * lib-content.php8 * functions related to displaying posts and pages9 */101112if ( ! function_exists( ‘weaverx_comment’ ) ) {13 function weaverx_comment( $comment, $args, $depth ) {14 /**15 * Template for comments and pingbacks.16 *17 * To override this walker in a child theme without modifying the comments template18 * simply create your own weaverx_comment(), and that function will be used instead.19 *20 * Used as a callback by wp_list_comments() for displaying the comments.21 *22 * @since Weaver Xtreme 1.023 */24// not needed: $GLOBALS[‘comment’] = $comment;2526 switch ( $comment->comment_type ) {27 case ‘pingback’ :28 case ‘trackback’ :29 ?>30 <li class="pingback">31 <p><?php echo esc_html__( 'Pingback:’, ‘weaver-xtreme’ ); ?><?php comment_author_link(); ?><?php edit_comment_link( esc_html__( 'Edit’, ‘weaver-xtreme’ ), '<span class="edit-link">’, ‘</span>’ ); ?></p>32 <?php33 break;3435 default:36 ?>37 <li <?php comment_class(); ?> id="li-comment-<?php comment_ID(); ?>">38 <article id="comment-<?php comment_ID(); ?>" class="comment">39 <footer class="comment-meta">40 <div class="comment-author vcard">41 <?php42 $avatar_size = 40;43 if ( ‘0’ != $comment->comment_parent ) {44 $avatar_size = 32;45 }4647 echo get_avatar( $comment, $avatar_size );4849 /* translators: 1: comment author, 2: date and time */50 /** @noinspection HtmlUnknownTarget */printf( wp_kses_post( __( '%1$s on %2$s <span class="says">said:</span>’, ‘weaver-xtreme’ ) ),51 sprintf( '<span class="fn">%s</span>’, get_comment_author_link() ),52 sprintf( '<a href="%1$s"><time datetime="%2$s">%3$s</time></a>’,53 esc_url( get_comment_link( $comment->comment_ID ) ),54 get_comment_time( ‘c’ ),55 /* translators: 1: date, 2: time */56 sprintf( esc_html__( '%1$s at %2$s’, ‘weaver-xtreme’ ), get_comment_date(), get_comment_time() )57 )58 );5960 edit_comment_link( esc_html__( 'Edit’, ‘weaver-xtreme’ ), '<span class="edit-link">’, ‘</span>’ ); ?>61 </div><!-- .comment-author .vcard -->6263 <?php if ( $comment->comment_approved == ‘0’ ) : ?>64 <em class="comment-awaiting-moderation"><?php echo esc_html__( 'Your comment is awaiting moderation.’, ‘weaver-xtreme’ ); ?></em>65 <br/>66 <?php endif; ?>6768 </footer>6970 <div class="comment-content"><?php comment_text(); ?></div>71 <?php72 $rl = get_comment_reply_link( array_merge( $args, array( ‘reply_text’ => wp_kses_post( __( 'Reply <span>↓</span>’, ‘weaver-xtreme’ ) ), ‘depth’ => $depth, ‘max_depth’ => $args[‘max_depth’] ) ) );73 if ( $rl != ‘’ ) {74 ?>75 <div class="reply">76 <?php echo $rl; ?>77 </div><!-- .reply -->78 <?php79 }80 ?>81 </article><!-- #comment-## -->8283 <?php84 break;85 } /* end switch */86 }87} // ends check for weaverx_comment()88//–899091if ( ! function_exists( ‘weaverx_comments_popup_link’ ) ) {92 function weaverx_comments_popup_link() {93 /* generate comment bubble for posts */94 if ( ( weaverx_getopt_checked( ‘show_post_bubble’ ) || weaverx_is_checked_post_opt( ‘_show_post_bubble’ ) )95 && comments_open() && ! post_password_required() ) {96 echo '<span class="comments-link comments-bubble">’;97 comments_popup_link( ‘<span class="leave-reply">’ . ' ' .98 '</span>’, _x( '1’, 'comments number’, ‘weaver-xtreme’ ), _x( '%’, 'comments number’, ‘weaver-xtreme’ ) );99 echo '</span>’;100 }101 }102}103//–104105if ( ! function_exists( ‘weaverx_content_nav’ ) ) {106 /**107 * Display navigation to next/previous pages when applicable108 */109 function weaverx_content_nav( $nav_id ) {110 global $wp_query;111112 if ( $wp_query->max_num_pages > 1 ) {113 ?>114 <nav id="<?php echo $nav_id; ?>">115 <h3 class="assistive-text"><?php echo esc_html__( 'Post navigation’, ‘weaver-xtreme’ ); ?></h3>116 <?php117 if ( weaverx_getopt( ‘nav_style’ ) == ‘prev_next’ ) {118 $prev = apply_filters( 'weaverx_older_posts’, ‘<span class="meta-nav">← </span>’ . esc_html__( 'Previous Post’, ‘weaver-xtreme’ ) );119 $next = apply_filters( 'weaverx_newer_posts’, esc_html__( 'Next Post’, ‘weaver-xtreme’ ) . ‘<span class="meta-nav">→ </span>’ );120 ?>121 <div class="nav-previous"><?php next_posts_link( $prev ); ?></div>122 <div class="nav-next"><?php previous_posts_link( $next ); ?></div>123 <?php124 } elseif ( weaverx_getopt( ‘nav_style’ ) == ‘paged_left’ ) {125 echo( “\t<div class=\"nav-previous\">” );126 if ( function_exists( ‘wp_pagenavi’ ) ) {127 wp_pagenavi();128 } elseif ( function_exists( ‘wp_paginate’ ) ) {129 wp_paginate( ‘title=’ );130 } else {131 echo weaverx_get_paginate_archive_page_links( ‘plain’, 2, 3 );132 }133 echo “\t</div>\n";134 } elseif ( weaverx_getopt( ‘nav_style’ ) == ‘paged_right’ ) {135 echo( “\t<div class=\"nav-next\">” );136 if ( function_exists( ‘wp_pagenavi’ ) ) {137 wp_pagenavi();138 } elseif ( function_exists( ‘wp_paginate’ ) ) {139 wp_paginate( ‘title=’ );140 } else {141 echo weaverx_get_paginate_archive_page_links( ‘plain’, 2, 3 );142 }143 echo “\t</div>\n";144 } else { // Older/Newer posts145 $prev = apply_filters( 'weaverx_older_posts’, wp_kses_post( __( '<span class="meta-nav">←</span> Older posts’, ‘weaver-xtreme’ ) ) );146 $next = apply_filters( 'weaverx_newer_posts’, wp_kses_post( __( 'Newer posts <span class="meta-nav">→</span>’, ‘weaver-xtreme’ ) ) );147 ?>148 <div class="nav-previous"><?php next_posts_link( $prev ); ?></div>149 <div class="nav-next"><?php previous_posts_link( $next ); ?></div>150 <?php } ?>151 </nav>152 <div class="clear-nav-id clear-both"></div><!-- #<?php echo $nav_id; ?> -->153 <?php154 }155 }156}157//–158159160if ( ! function_exists( ‘weaverx_continue_reading_link’ ) ) {161 function weaverx_continue_reading_link() {162 /**163 * Returns a “Continue Reading” link for excerpts164 */165166 $rep = weaverx_t_get( ‘more_msg’ );167 if ( ! $rep ) {168 $rep = weaverx_getopt( ‘excerpt_more_msg’ );169 }170171 $rep = apply_filters( 'weaverx_more_message’, $rep );172173 if ( ! empty( $rep ) ) {174 $msg = ‘<span class="more-msg">’ . $rep . '</span>’;175 } else {176 $msg = wp_kses_post( __( '<span class="more-msg">Continue reading →</span>’, ‘weaver-xtreme’ ) );177 }178179 return ' <a class="more-link” href="’ . esc_url( get_permalink() ) . ‘">’ . $msg . '</a>’;180 }181}182//–183184add_filter( 'weaverx_more_message’, ‘weaverx_more_message_filter’ );185function weaverx_more_message_filter( $msg ) {186 return do_shortcode( $msg );187}188189if ( ! function_exists( ‘weaverx_edit_link’ ) ) {190 function weaverx_edit_link( $echo = ‘echo’ ) {191192// if ( is_customize_preview() ) {193// $edit = ‘<strong><span class="edit-link-customizer">’ . esc_html__('Close Customizer to enable Edit.’, ‘weaver-xtreme’ ) . '</span></strong>’;194// } else {195 $before = '<span class="edit-link">’;196 $after = '</span>’;197 $link_label = esc_html__( 'Edit’, ‘weaver-xtreme’ );198 $id = 0;199200 if ( ! $post = get_post( $id ) ) {201 return '’;202 }203204 if ( ! $url = get_edit_post_link( $post->ID ) ) {205 return '’;206 }207 $post_type_obj = get_post_type_object( $post->post_type );208 $link = '<a class="post-edit-link” href="’ . $url . ‘" title="’ . esc_attr( $post_type_obj->labels->edit_item ) . ‘">’ . $link_label . '</a>’;209 $flink = apply_filters( 'edit_post_link’, $link, $post->ID );210 if ( ! $flink ) {211 $flink = $link;212 } // some https vs http bug in WP213 $edit = $before . $flink . $after;214215216 $is_elementor = ! ! get_post_meta( $post->ID, '_elementor_edit_mode’, true );217218 if ( $is_elementor ) {219 $link_label = esc_html__( 'Edit with Elementor’, ‘weaver-xtreme’ );220221 $eurl = str_replace( 'action=edit’, ‘action=elementor’, $url );222 $after = $after . “\n<!-- url: {$url} eurl: {$eurl} -->";223 $link = '<a class="post-edit-link post-edit-link-builder” href="’ . $eurl . ‘" title="’ . esc_attr( $post_type_obj->labels->edit_item ) . ‘">’ . $link_label . '</a>’;224 $flink = apply_filters( 'edit_post_link’, $link, $post->ID );225 if ( ! $flink ) {226 $flink = $link;227 } // some https vs http bug in WP228 $edit .= $before . $flink . $after;229 }230// }231232233 if ( ‘echo’ == $echo ) {234 echo $edit;235 } else {236 return $edit;237 }238 return '’;239 }240}241//–242243if ( ! function_exists( ‘weaverx_get_wp_custom_logo’ ) ) {244 /**245 * Displays the optional custom logo.246 *247 * Does nothing if the custom logo is not available.248 *249 */250 function weaverx_get_wp_custom_logo() {251 if ( function_exists( ‘the_custom_logo’ ) ) {252 return get_custom_logo();253 }254255 return '’;256 }257}258259if ( ! function_exists( ‘weaverx_get_wp_custom_logo_url’ ) ) {260 /**261 * Displays the optional custom logo.262 *263 * Does nothing if the custom logo is not available.264 *265 */266 function weaverx_get_wp_custom_logo_url( $size = ‘full’ ) {267268 $custom_logo_id = get_theme_mod( ‘custom_logo’ );269 $image = '’;270271 // We have a logo. Logo is go.272 if ( $custom_logo_id ) {273 $image = wp_get_attachment_image_url( $custom_logo_id, $size );274 }275276 return $image;277 }278}279280if ( ! function_exists( ‘weaverx_entry_header’ ) ) {281 function weaverx_entry_header( $format_title = '’, $do_excerpt = false ) {282 /* display entry header ( title ) for posts */283284 $arg = ( $do_excerpt ) ? ‘post_excerpt’ : 'post_full’;285286 weaverx_fi( $arg, ‘title-before’ );287288 $lead = '<h2 ' . weaverx_title_class( 'post_title’, false, ‘post-title entry-title’ ) . weaverx_schema( ‘headline’ ) . '>’;289 if ( $format_title != ‘’ && ! weaverx_getopt( ‘hide_post_format_icon’ ) && ! weaverx_is_checked_post_opt( ‘_pp_hide_post_format_label’ ) ) {290 $icon = “<span class=\"post-format-icon genericon genericon-{$format_title}\"></span>";291 $lead .= $icon;292 }293294 weaverx_post_title( $lead, ‘</h2>’ );295 }296}297//–298299300if ( ! function_exists( ‘weaverx_post_title’ ) ) {301// display the post title302 function weaverx_post_title( $before = '’, $after = ‘’ ) {303304 if ( weaverx_is_checked_post_opt( ‘_pp_hide_post_title’ ) || weaverx_t_get( ‘hide_title’ ) ) {305 return;306 }307308 echo( $before );309 $title = the_title( '’, '’, false );310 ?>311 <a href="<?php echo esc_url( get_permalink() ); ?>” title="<?php printf( esc_attr__( 'Permalink to %s’, ‘weaver-xtreme’ ),312 the_title_attribute( ‘echo=0’ ) ); ?>" rel="bookmark"><?php echo $title; ?></a>313 <?php314 echo( $after . “\n” );315316 }317} // if weaverx_post_title318//–319320321if ( ! function_exists( ‘weaverx_link_pages’ ) ) {322 function weaverx_link_pages() {323 wp_link_pages( array( ‘before’ => ‘<div class="page-link"><span>’ . esc_html__( 'Pages:’, ‘weaver-xtreme’ ) . '</span>’, ‘after’ => ‘</div>’ ) );324 }325}326//–327328329if ( ! function_exists( ‘weaverx_not_found_search’ ) ) {330 function weaverx_not_found_search() {331 ?>332 <article id="post-0" class="post no-results not-found">333 <header class="page-header">334 <h1 class="page-title entry-title title-search"><?php echo esc_html__( 'Nothing Found’, ‘weaver-xtreme’ ); ?></h1>335 </header><!-- .page-header -->336337 <div class="entry-content clearfix">338 <p>339 <?php340 if ( ! weaverx_getopt( ‘_hide_not_found_search’ ) ) {341 echo esc_html__( 'Apologies, but no results were found for the requested archive. Perhaps searching will help find a related post.’, ‘weaver-xtreme’ );342 ?>343 </p>344 <p>345 <?php346 get_search_form();347 }348 ?>349 </p>350 </div><!-- .entry-content -->351 </article><!-- #post-0 -->352 <?php353 }354}355//–356357function weaverx_url_grabber() {358 /**359 * Return the URL for the first link found in the post content.360 */361 if ( ! preg_match( '/<a\s[^>]*?href=[\’"](.+?)[\’"]/is’, get_the_content(), $matches ) ) {362 return false;363 }364365 return esc_url_raw( $matches[1] );366}367//–368369// ------------------------------------- POST META INFO -----------------------------------370371if ( ! function_exists( ‘weaverx_format_posted_on_footer’ ) ) {372 function weaverx_format_posted_on_footer( ) {373 if ( weaverx_is_checked_post_opt( ‘_pp_hide_bottom_post_meta’ ) || weaverx_is_checked_page_opt( ‘_pp_hide_infobottom’ ) ) {374 weaverx_edit_link();375376 return;377 }378 ?>379 <footer class="entry-utility">380 <?php weaverx_posted_on();381 if ( comments_open() ) {382 $msg = apply_filters( 'weaverx_leave_reply_blog’, esc_html__( 'Leave a reply’, ‘weaver-xtreme’ ) );383 $r1 = apply_filters( 'weaverx_reply_1’, wp_kses_post( __( '<b>1</b> Reply’, ‘weaver-xtreme’ ) ) );384 $rmany = apply_filters( 'weaverx_reply_many’, wp_kses_post( __( '<b>%</b> Replies’, ‘weaver-xtreme’ ) ) );385 echo '<span ' . weaverx_meta_info_class( ‘post_info_bottom’ ) . '><span class="comments-link">’;386 comments_popup_link( ‘<span class="leave-reply">’ . '  ' . $msg . '</span>’, $r1,387 $rmany ); ?></span></span>388389 <?php390 }391 weaverx_edit_link();392 ?>393 </footer><!-- #entry-utility -->394 <?php395 }396}397//–398399if ( ! function_exists( ‘weaverx_meta_info_class’ ) ) {400 function weaverx_meta_info_class( $who ) {401 // 'post_hide_date’, 'post_hide_author’, 'post_hide_categories’, 'hide_singleton_category’, 'post_hide_tags’402403 $class = 'meta-info-wrap’;404405 if ( weaverx_getopt( ‘post_hide_date’ ) ) { // check for hide various elements406 $class .= ' post-hide-date’;407 }408 if ( weaverx_getopt( ‘post_hide_author’ ) ) { // check for hide various elements409 $class .= ' post-hide-author’;410 }411 if ( weaverx_getopt( ‘post_hide_categories’ ) ) { // check for hide various elements412 $class .= ' post-hide-categories’;413 }414 if ( weaverx_getopt( ‘hide_singleton_category’ ) ) { // check for hide various elements415 $class .= ' post_hide_single_cat’;416 }417 if ( weaverx_getopt( ‘post_hide_tags’ ) ) { // check for hide various elements418 $class .= ' post-hide-tags’;419 }420 if ( weaverx_getopt( ‘hide_permalink’ ) ) { // check for hide various elements421 $class .= ' post-hide-permalink’;422 }423424 if ( $class != ‘meta-info-wrap’ || weaverx_getopt( ‘post_icons’ ) == ‘fonticons’ || weaverx_getopt( ‘post_icons’ ) == ‘graphics’ ) {425 if ( weaverx_getopt( ‘post_icons’ ) != ‘graphics’ ) {426 $class .= ' entry-meta-gicons ';427 } else {428 $class .= ' entry-meta-icons’;429 }430 }431432 $class .= weaverx_text_class( $who, true );433434435 return ‘class="’ . trim( $class ) . ‘"’;436 }437}438//–439440441if ( ! function_exists( ‘weaverx_post_bottom_info’ ) ) {442 function weaverx_post_bottom_info( $type = ‘’ ) {443 /**444 * Prints HTML with meta information for the bottom meta line.445 */446 weaverx_posted_in( $type );447 }448}449//–450451452if ( ! function_exists( ‘weaverx_posted_in’ ) ) {453 function weaverx_posted_in( $type = ‘’ ) {454 /**455 * Prints HTML with meta information for the current post-date/time and author.456 * Create your own weaverx_posted_in to override in a child theme457 */458459 if ( weaverx_getopt_checked( ‘post_info_hide_bottom’ )460 || weaverx_is_checked_post_opt( ‘_pp_hide_bottom_post_meta’ )461 || weaverx_is_checked_page_opt( ‘_pp_hide_infobottom’ )462 || weaverx_t_get( ‘hide_bottom_info’ ) ) { // hide bottom?463 weaverx_edit_link();464465 return;466 }467468 if ( weaverx_is_checked_page_opt( ‘_pp_hide_infobottom’ )469 && ! weaverx_t_get( ‘showposts’ ) ) {470 return;471 }472473 $pi = “\n<div " . weaverx_meta_info_class( ‘post_info_bottom’ ) . “>\n";474475 if ( $type == ‘single’ ) {476 /* translators: used between list items, there is a space after the comma */477 $categories_list = get_the_category_list( esc_html__( ', ', ‘weaver-xtreme’ ) );478479 /* translators: used between list items, there is a space after the comma */480 $tags_list = get_the_tag_list( '’, esc_html__( ', ', ‘weaver-xtreme’ ) );481482 if ( $categories_list ) {483 $cat_count = count( get_the_category() );484 if ( $cat_count < 2 && weaverx_getopt_checked( ‘hide_singleton_category’ ) ) {485 $pi .= “\t\t\t<span class=\"cat-links post_hide-singleton-category\">\n";486 } else {487 $pi .= “\t\t\t<span class=\"cat-links\">\n";488 }489 $pi .= sprintf( wp_kses_post( __( '<span class="%1$s">Posted in</span> %2$s’, ‘weaver-xtreme’ ) ), ‘entry-utility-prep entry-utility-prep-cat-links’, $categories_list );490491 $pi .= "\t\t\t</span>\n";492493 } // End if categories494 /* translators: used between list items, there is a space after the comma */495496 if ( $tags_list ) {497 $pi .= “\t\t\t<span class=\"tag-links\">\n";498 $pi .= sprintf( wp_kses_post( __( '<span class="%1$s">Tagged</span> %2$s’, ‘weaver-xtreme’ ) ), 'entry-utility-prep entry-utility-prep-tag-links’, $tags_list );499 $pi .= “\t\t\t</span>\n";500 } // End if $tags_list501502 $pi .= ‘<span class="permalink-icon"><a href="’ . esc_url( get_permalink() ) . '” title="Permalink to ' . the_title_attribute( array( ‘echo’ => false ) ) .503 '” rel="bookmark">’ . esc_html__( 'permalink’, ‘weaver-xtreme’ ) . '</a></span>’;504505506 $pi .= weaverx_edit_link( ‘noecho’ );507508 } elseif ( $type == ‘reply’ ) {509 $dummy = true;510 } else { // else not single511 $show_sep = false;512 if ( ‘page’ != get_post_type() ) { // Hide category and tag text for pages on Search513514 /* translators: used between list items, there is a space after the comma */515 $categories_list = get_the_category_list( esc_html__( ', ', ‘weaver-xtreme’ ) );516 $cat_count = count( get_the_category() );517 $skip = ( $cat_count < 2 && weaverx_getopt_checked( ‘hide_singleton_category’ ) );518 if ( $categories_list && ! $skip ) {519 $pi .= '<span class="cat-links">’;520 $pi .= sprintf( wp_kses_post( __( '<span class="%1$s">Posted in</span> %2$s’, ‘weaver-xtreme’ ) ), 'entry-utility-prep entry-utility-prep-cat-links’, $categories_list );521 $show_sep = true;522 $pi .= '</span>’;523 } // End if categories524 /* translators: used between list items, there is a space after the comma */525 $tags_list = get_the_tag_list( '’, esc_html__( ', ', ‘weaver-xtreme’ ) );526 if ( $tags_list ) {527 if ( $show_sep ) {528 $pi .= '<span class="sep"> | </span>’;529 } // End if $show_sep530 $pi .= '<span class="tag-links">’;531 $pi .= sprintf( wp_kses_post( __( '<span class="%1$s">Tagged</span> %2$s’, ‘weaver-xtreme’ ) ), 'entry-utility-prep entry-utility-prep-tag-links’, $tags_list );532 $show_sep = true;533 $pi .= '</span>’;534 } // End if $tags_list535 } // End if ‘page’ != get_post_type()536537 if ( comments_open() ) {538 if ( $show_sep ) {539 $pi .= '<span class="sep"> | </span>’;540 } // End if $show_sep541 $pi .= '<span class="comments-link">’;542 ob_start(); // yuck - why doesn’t WP make all the utilities have an echo option??543 comments_popup_link( ‘<span class="leave-reply">’ . esc_html__( 'Leave a reply’, ‘weaver-xtreme’ ) . '</span>’, wp_kses_post( __( '<b>1</b> Reply’, ‘weaver-xtreme’ ) ),544 wp_kses_post( __( '<b>%</b> Replies’, ‘weaver-xtreme’ ) ) );545 $pi .= ob_get_clean();546 $pi .= '</span>’;547548 } // End if comments_open()549 $pi .= weaverx_edit_link( ‘noecho’ );550 } // end non-single551 $pi .= “\n</div><!-- .entry-meta-icons -->\n";552 echo apply_filters( 'weaverx_posted_in’, $pi, $type );553 }554}555//–556557558if ( ! function_exists( ‘weaverx_posted_on’ ) ) {559 function weaverx_posted_on( $type = ‘’ ) {560 /**561 * Prints HTML with meta information for the current post-date/time and author.562 * Create your own weaverx_posted_on to override in a child theme563 */564565 if ( weaverx_getopt_checked( ‘post_info_hide_top’ )566 || weaverx_is_checked_post_opt( ‘_pp_hide_top_post_meta’ )567 || weaverx_is_checked_page_opt( ‘_pp_hide_infotop’ )568 || weaverx_t_get( ‘hide_top_info’ ) ) { // hide top?569 return;570 }571572 if ( weaverx_is_checked_page_opt( ‘_pp_hide_infotop’ )573 && ! weaverx_t_get( ‘showposts’ ) ) {574 return;575 }576577 $po = “<span " . weaverx_meta_info_class( ‘post_info_top’ ) . “>\n";578 if ( ( weaverx_getopt_default( 'show_post_avatar’, ‘hide’ ) == ‘start’ )579 || weaverx_is_checked_post_opt( ‘_pp_show_post_avatar’ )580 || weaverx_t_get( ‘show_avatar’ ) ) {581 $po .= '<span class="post-avatar post-avatar-start">’;582 $po .= get_avatar( get_the_author_meta( ‘user_email’ ), weaverx_getopt_default( 'post_avatar_int’, 28 ), null, ‘avatar’ );583 $po .= '</span>’;584 }585586 // wp_kses strips <time>587 /** @noinspection HtmlUnknownTarget */588 $po .= sprintf( weaverx_filter_styled_translation( __( '<span class="sep posted-on">Posted on </span><a href="%1$s” title="%2$s” rel="bookmark"><time class="entry-date” datetime="%3$s">%4$s</time></a><span class="by-author"> <span class="sep"> by </span> <span class="author vcard"><a class="url fn n” href="%5$s” title="%6$s” rel="author">%7$s</a></span></span>’, ‘weaver-xtreme’ ) ),589 esc_url( get_permalink() ),590 esc_attr( get_the_time() ),591 esc_attr( get_the_date( ‘c’ ) ),592 esc_html( get_the_date() ),593 esc_url( get_author_posts_url( get_the_author_meta( ‘ID’ ) ) ),594 sprintf( esc_attr( __( 'View all posts by %s’, ‘weaver-xtreme’ ) ), get_the_author() ),595 weaverx_get_the_author()596 );597598599 // updated time changed 3.1.11 to handle published as well. Can’t mess with messages because of translations.600601 if ( get_the_time( ‘Y/m/d’ ) !== get_the_modified_time( ‘Y/m/d’ ) ) { // get original and modified dates - ignore revisions on same day602 $time_string = '<time class="updated” datetime="’ . esc_attr( get_the_modified_date( ‘c’ ) ) . ‘">’ . get_the_modified_date() . '</time>’;603 } else {604 $time_string = ‘<time class="published updated" datetime="’ . esc_attr( get_the_date( ‘c’ ) ) . ‘">’ . get_the_date() . '</time>’;605 }606607 $po .= $time_string; // required for Google Structured Data608609 if ( weaverx_getopt_default( 'show_post_avatar’, ‘hide’ ) == ‘end’ ) {610 $po .= '<span class="post-avatar post-avatar-end">’;611 $po .= get_avatar( get_the_author_meta( ‘user_email’ ), weaverx_getopt_default( 'post_avatar_int’, 28 ), null, ‘avatar’ );612 $po .= '</span>’;613 }614 $po .= "\n</span><!-- .entry-meta-icons -->";615 echo apply_filters( 'weaverx_posted_on’, $po, $type );616 }617}618//–619620621if ( ! function_exists( ‘weaverx_post_top_meta’ ) ) {622 function weaverx_post_top_meta( $type = ‘’ ) {623 /**624 * Prints HTML with meta information for the top meta line.625 */626 // $type for single627 echo "<div class=\"entry-meta \">\n";628 echo weaverx_schema( ‘published’ );629 weaverx_posted_on( $type );630 weaverx_comments_popup_link();631 echo "</div><!-- /entry-meta -->\n";632 }633}634//–635636function weaverx_per_post_style() {637 // Emit a <style> for this post638 do_action( 'weaverx_per_post’, get_the_ID() );639}640641// ------------------------------------- TITLES -----------------------------------642643644if ( ! function_exists( ‘weaverx_archive_title’ ) ) {645 function weaverx_archive_title( $title, $type, $extra = ‘’ ) {646 // The page title for archive-like pages647 // $type is for type of the archive - could be used to show icon648649 if ( ! $title ) {650 $title = the_title( '’, '’, false );651 }652 ?>653 <h1 class="page-title archive-title entry-title title-<?php echo $type . $extra; ?>"><span<?php echo weaverx_title_class( ‘archive_title’ ) . ‘>’ . $title; ?></span></h1>654 <?php655 }656}657//–658659660if ( ! function_exists( ‘weaverx_page_title’ ) ) {661 function weaverx_page_title( $title = ‘’ ) {662 // The page title663664 if ( ! $title ) {665 $title = the_title( '’, '’, false );666 }667 if ( ! weaverx_is_checked_page_opt( ‘_pp_hide_page_title’ ) ) {668 ?>669 <header class="page-header">670 <?php weaverx_fi( 'page’, ‘title-before’ ); ?>671 <h1<?php echo weaverx_title_class( 'page_title’, false, ‘page-title entry-title’ ) . weaverx_schema( ‘headline’ ) . ‘>’ . $title; ?></h1>672 </header><!-- .page-header -->673 <?php674 }675 }676}677//–678679680if ( ! function_exists( ‘weaverx_single_title’ ) ) {681 function weaverx_single_title( $title = ‘’ ) {682 // The page title for single view page683 if ( weaverx_is_checked_post_opt( ‘_pp_hide_post_title’ ) || weaverx_t_get( ‘hide_title’ ) ) {684 echo '<header class="page-header">’;685 weaverx_post_top_meta( ‘single’ );686 echo '</header>’;687 return;688 }689 if ( ! $title ) {690 $title = the_title( '’, '’, false );691 }692 ?>693 <header class="page-header">694695 <?php weaverx_fi( 'post’, ‘title-before’ ); ?>696 <h1 class="page-title entry-title title-single <?php echo weaverx_title_class( 'post_title’, true ) . ‘"’ . weaverx_schema( ‘headline’ ) . ‘>’ . $title; ?></h1>697 <?php weaverx_post_top_meta( ‘single’ ); ?>698 </header><!-- .page-header -->699<?php700 }701}702//–703704705if ( ! function_exists( ‘weaverx_fi’ ) ) {706 function weaverx_fi( $who, $where ) {707 // Emit Featured Image depending on settings and who and where called from708 // $who includes: post, page, post_excerpt, post_full709710 $hide = weaverx_getopt( $who . ‘_fi_hide’ );711712 if ( $hide == ‘hide’ || weaverx_t_get( ‘hide_featured_image’ ) || ! has_post_thumbnail() ) // hide all or no FI713 {714 return false;715 }716717 $show = '’;718719 if ( $where != ‘title_featured’ &&720 ( weaverx_get_per_page_value( ‘_pp_wvrx_pwp_type’ ) == 'title’721 || weaverx_get_per_page_value( ‘_pp_wvrx_pwp_type’ ) == 'title_featured’722 || weaverx_t_get( ‘show’ ) == 'title’723 || weaverx_t_get( ‘show’ ) == 'title_featured’724 )725 ) {726 return false;727 } elseif ( $where == ‘title_featured’ ) {728 $show = $where;729 }730731732 if ( ! $show ) {733 if ( $who == ‘page’ ) // || $who == ‘post_full’ )734 {735 $show = weaverx_get_per_page_value( ‘_pp_fi_location’ );736 } elseif ( isset( $GLOBALS[‘weaverx_page_who’] ) && $GLOBALS[‘weaverx_page_who’] == ‘single’ ) {737 $show = weaverx_get_per_post_value( ‘_pp_fi_location’ );738 } else {739 $show = weaverx_get_per_post_value( ‘_pp_post_fi_location’ );740 }741 }742743744 if ( ! $show ) {745 $show = weaverx_getopt_default( $who . '_fi_location’, ‘content-top’ );746 } // ‘page’ or 'post’747 elseif ( $show == ‘hide’ ) {748 return false;749 }750751752 if ( $where == ‘post-pre’ && strpos( $show, ‘post-bg’ ) !== false ) { // showing a BG image753 $before = '<style>’;754 $after = '</style>’;755 $image = wp_get_attachment_image_src( get_post_thumbnail_id(), ‘full’ ); // ( url, width, height )756 $hdr = $image[0];757 $hdr_height = $image[2];758 $hdr_width = $image[1];759760 // wp customizer preview hack for WP 4.4 beta, might go away for 4.4 release761 $url = get_theme_file_uri();762 $url = str_replace( array( 'http://’, ‘https://’ ), '’, $url );763 $hdr = str_replace( '%s’, $url, $hdr ); // 4.4 preview breaks this764 $hdr = str_replace( array( 'http://’, ‘https://’ ), '//’, $hdr );765 if ( $who == ‘page’ ) {766 $selector = '#container’;767 } elseif ( $who == ‘post’ && $where == ‘post-pre’ ) {768 $selector = '#post-' . get_the_ID() . ‘{background-color:transparent;}’ . '#container’;769 } else {770 $selector = '#post-' . get_the_ID();771 }772773 $style = '’;774 switch ( $show ) {775 case 'post-bg-parallax’:776777 case 'post-bg-parallax-full’: // previous: background-repeat: no-repeat; background-position: center center; background-attachment: fixed;778 $style = "background-image:url( {$hdr} );"; // parallax full - use in conjunction with .wvrx-parallax779 break;780781 case 'post-bg’:782 $style = "background:url( {$hdr} ) repeat;background-color:transparent;"; // tile vertically783 break;784785 case 'post-bg-cover’: // cover - responsive786 $style = "background:url( {$hdr} );background-repeat:no-repeat;background-position:center center;787background-size:cover;background-color:transparent;box-sizing:border-box;"; // cover788 break;789790 default: // no others791 break;792 }793794 // echo "{$before}{$selector}{ {$style} }{$after}\n";795 if ( $style ) {796 weaverx_inline_style( "{$before}{$selector}{ {$style} }{$after}\n", ‘weaverx-fi:lib-content.php’ );797 }798799800 return true;801 } // end as bg image802803 $align = weaverx_getopt_default( $who . '_fi_align’, ‘fi-alignleft’ );804805 $before = '’;806 if ( $where == ‘post-pre’ ) {807 $align .= '-pb’; // need to be able to fixup alignment for small devices808 $before = '<div class="clear-post-before clear-both"></div>’;809 }810811 $fi_class = 'featured-image fi-' . $who . '-' . $where . ' fi-' . $show . ' ' . $hide . ' ' . $align; // construct fi class812813 $attr = array( ‘class’ => $fi_class );814815 // add width if defined816817 $w = weaverx_getopt( $who . ‘_fi_width’ );818 if ( $w ) {819 $attr[‘style’] = ‘width:’ . $w . '%’;820 }821822 //weaverx_alert( 'in fi - who: ' . $who . ' where: ' . $where . ' show: ' . $show );823824 if ( $show == $where || ( $show == ‘post-before’ && $where == ‘post-pre’ ) || ( $show == ‘title-banner’ && $where == ‘title-before’ ) ) {825826 if ( $show == ‘header-image’ ) { // special case : header replacement area827 $image = wp_get_attachment_image_src( get_post_thumbnail_id(), ‘full’ ); // ( url, width, height )828 if ( ! $image ) {829 return false;830 }831832 return $image[0]; // let the header code handle the details…833 }834835 $size = weaverx_getopt_default( $who . ‘_fi_size’, ‘thumbnail’ );836 // weaverx_debug_comment( ‘FI who:’ . $who . ' FI size:’ . $size );837838 if ( get_post_thumbnail_id() ) {839 if ( ( $href = weaverx_get_per_post_value( ‘_pp_fi_link’ ) ) == ‘’ ) { // per page link override?840 if ( $who == ‘post_excerpt’ ) {841 $href = esc_url( get_permalink() );842 } else {843 $image = wp_get_attachment_image_src( get_post_thumbnail_id(), ‘full’ ); // ( url, width, height )844 $href = esc_url( $image[0] );845 }846 }847848 $fi_img = weaverx_schema( 'image’, get_the_post_thumbnail( null, $size, $attr ) );849850 $fi_after = apply_filters( 'weaverx_fi_after’, ‘’ ); // added 3.1.10851852 if ( $who == ‘page’ && weaverx_getopt( ‘page_fi_nolink’ ) ) {853 $the_fi = "\n{$before}{$fi_img}{$fi_after}\n";854 } elseif ( $who != ‘page’ && weaverx_getopt( ‘post_fi_nolink’ ) ) {855 $the_fi = "\n{$before}{$fi_img}{$fi_after}\n";856 } else {857 $the_fi = “\n{$before}<a class=\"wvrx-fi-link\” href=\"{$href}\">{$fi_img}</a>{$fi_after}\n";858 }859860861 echo apply_filters( 'weaverx_fi_link’, $the_fi, $before, $href, $fi_img, $who, $fi_after ); // Added 3.1.5; Changed 3.1.11 to add the $fi_after862863 if ( $show == ‘title-banner’ ) {864 echo '<div class="clear-both"></div>’;865 }866867 return false;868 }869 }870871 return false;872 }873}874//–875876877function weaverx_the_page_content( $who = ‘’ ) {878879 weaverx_fi( $who, ‘content-top’ );880 weaverx_the_contnt();881 weaverx_fi( $who, ‘content-bottom’ );882}883884//–885886887function weaverx_the_contnt() {888 if ( ( weaverx_is_checked_page_opt( ‘_pp_raw_html’ ) && ! weaverx_t_get( ‘showposts’ ) ) || weaverx_is_checked_post_opt( ‘_pp_raw_html’ ) ) {889 remove_filter( 'the_content’, ‘wpautop’ );890 remove_filter( 'the_content’, ‘wptexturize’ );891 }892 the_content( weaverx_continue_reading_link() );893}894895//–896897898// ========================= special content =========================899900function weaverx_post_div( $type = ‘content’ ) {901 // echo the start <div> for posts902 // include columns class if set903 $class = ‘’;904 $cols = weaverx_getopt( ‘post_cols’ );905 if ( $cols != ‘’ && $cols != ‘1’ ) {906 $class = ' cols-' . $cols;907 }908 echo ' <div class="entry-' . $type . ' clearfix’ . $class . ‘"’ . weaverx_schema( 'entry-' . $type ) . ‘>’ . "\n";909}910911function weaverx_the_post_full() {912913 if ( weaverx_is_checked_post_opt( ‘_pp_force_post_excerpt’ ) && ! weaverx_is_checked_post_opt( ‘_pp_force_post_full’ ) ) {914 // check both values - force_excerpt and force_full - here to avoid recursion915 weaverx_the_post_excerpt();916917 return;918 }919920 weaverx_fi( 'post_full’, ‘content-top’ );921922 weaverx_the_contnt();923924 weaverx_fi( 'post_full’, ‘content-bottom’ );925}926927//–928929930function weaverx_the_post_excerpt() {931932 if ( weaverx_is_checked_post_opt( ‘_pp_force_post_full’ ) ) {933 weaverx_the_post_full();934935 return;936 }937 weaverx_fi( 'post_excerpt’, ‘content-top’ );938939 the_excerpt( );940941 weaverx_fi( 'post_excerpt’, ‘content-bottom’ );942}943944//–945946947function weaverx_the_post_full_single() {948 global $page;949950 if ( $page <= 1 ) {951 weaverx_fi( 'post’, ‘content-top’ );952 }953954 weaverx_the_contnt();955956 if ( $page <= 1 ) {957 weaverx_fi( 'post’, ‘content-bottom’ );958 }959}960961//–962963964function weaverx_show_only_title() {965966 //echo "\n <!-- ********* end of a post ********** -->\n";967968 if ( ! weaverx_t_get( ‘showposts’ )969 && ( weaverx_get_per_page_value( ‘_pp_wvrx_pwp_type’ ) == 'title’970 || weaverx_t_get( ‘show’ ) == 'title’971 )972 ) {973 echo weaverx_schema( ‘mainEntityOfPage’ );974 echo "\t</article><!-- /#post -->\n";975976 return true;977 } elseif ( ! weaverx_t_get( ‘showposts’ )978 && ( weaverx_get_per_page_value( ‘_pp_wvrx_pwp_type’ ) == 'title_featured’979 || weaverx_t_get( ‘show’ ) == 'title_featured’980 )981 ) {982 weaverx_fi( 'post_excerpt’, ‘title_featured’ ); // show FI983 //echo "\t</article><!-- /#post; --><div style=’clear:both’></div>\n";984 echo weaverx_schema( ‘mainEntityOfPage’ );985 echo "\t</article><!-- /#post; -->\n";986987 return true;988 } elseif ( weaverx_t_get( ‘showposts’ ) && weaverx_t_get( ‘show’ ) == ‘title_featured’ ) {989 weaverx_fi( 'post_excerpt’, ‘title_featured’ ); // show FI990 echo weaverx_schema( ‘mainEntityOfPage’ );991 echo "\t</article><!-- /#post. --><div class=’clear-both’></div>\n";992993 return true;994 } elseif ( weaverx_t_get( ‘showposts’ ) && ( weaverx_t_get( ‘show’ ) == ‘title’ || weaverx_t_get( ‘show’ ) == ‘titlelist’ ) ) {995 echo weaverx_schema( ‘mainEntityOfPage’ );996 echo “\t</article><!-- /#post -->\n";997998 return true;999 }10001001 return false;1002}10031004//–100510061007function weaverx_use_excerpt() {1008 // return true if this kind of page should be excerpted1009 // weaverx_get_per_page_value( ‘_pp_wvrx_pwp_type’ ) == full or excerpt or '’10101011 if ( weaverx_t_get( ‘show’ ) == ‘excerpt’ ) // for Weaver Xtreme Plus1012 {1013 return true;1014 }10151016 if ( weaverx_t_get( ‘show’ ) == ‘full’ ) // for Weaver Xtreme Plus1017 {1018 return false;1019 }10201021 if ( weaverx_is_checked_post_opt( ‘_pp_force_post_excerpt’ ) ) {1022 return true;1023 }10241025 if ( weaverx_is_checked_post_opt( ‘_pp_force_post_full’ ) ) {1026 return false;1027 }10281029 $n1 = weaverx_get_per_page_value( ‘_pp_fullposts’ );1030 if ( ! $n1 ) {1031 $n1 = weaverx_getopt( ‘fullpost_first’ );1032 }10331034 if ( $n1 ) {1035 global $page, $paged;1036 if ( ! ( $paged >= 2 || $page >= 2 )1037 && weaverx_post_count() <= $n1 ) {1038 return false;1039 }1040 }10411042 $pwp = weaverx_get_per_page_value( ‘_pp_wvrx_pwp_type’ );10431044 if ( $pwp == ‘full’ ) // need to check before archive/search1045 {1046 return false;1047 } // override global setting1048 if ( $pwp == ‘excerpt’ ) {1049 return true;1050 } // override global setting10511052 if ( is_search() ) {1053 return ! weaverx_getopt_checked( ‘fullpost_search’ );1054 }1055 if ( weaverx_is_archive() ) {1056 return ! weaverx_getopt_checked( ‘fullpost_archive’ );1057 }10581059 return ! weaverx_getopt_checked( ‘fullpost_blog’ );1060}10611062//–10631064function weaverx_inline_style( $style, $who ) {1065 echo $style;1066}10671068function weaverx_author_info() {1069 if ( get_the_author_meta( ‘description’ ) && ! weaverx_getopt( ‘hide_author_bio’ ) ) { // If a user has filled out their description, show a bio on their entries ?>1070 <div class=’clear-both’></div>1071 <div id="author-info">1072 <div id="author-description">1073 <div id="author-avatar">1074 <?php echo get_avatar( get_the_author_meta( ‘user_email’ ), apply_filters( 'weaverx_author_bio_avatar_size’, 75 ) ); ?>1075 </div><!-- #author-avatar -->1076 <p class="author-title"><?php printf( esc_html__( 'About %s’, ‘weaver-xtreme’ ), get_the_author() ); ?></p>1077 <p><?php the_author_meta( ‘description’ ); ?></p>1078 <div id="author-link">1079 <span class="vcard author post-author"><span class="fn">1080 <a href="<?php echo esc_url( get_author_posts_url( get_the_author_meta( ‘ID’ ) ) ); ?>” rel="author">1081 <?php printf( esc_html__( ‘View all posts by %s’, ‘weaver-xtreme’ ), weaverx_get_the_author() ); ?>1082 </a></span></span>1083 </div><!-- #author-link -->1084 </div><!-- #author-description -->1085 </header><!-- #author-info -->10861087 <?php }1088}108910901091// ------------------------------------- FILTERS -----------------------------------109210931094function weaverx_auto_excerpt_more( $more ) {1095 /**1096 * Replaces "[…]" ( appended to automatically generated excerpts ) with an ellipsis and weaverx_continue_reading_link().1097 *1098 * To override this in a child theme, remove the filter and add your own1099 * function tied to the excerpt_more filter hook.1100 */1101 return ' <span class="excerpt-dots">…</span>’ . weaverx_continue_reading_link();1102}11031104add_filter( 'excerpt_more’, ‘weaverx_auto_excerpt_more’ );110511061107function weaverx_custom_excerpt_more( $output ) {1108 /**1109 * Adds a pretty “Continue Reading” link to custom post excerpts.1110 *1111 * To override this link in a child theme, remove the filter and add your own1112 * function tied to the get_weaverx_the_post_excerpt filter hook.1113 */11141115 if ( ( has_excerpt() && ! is_attachment() ) ||1116 strpos($output, ‘class="more-link"’) === FALSE ) {1117 $output .= weaverx_continue_reading_link();1118 }11191120 return $output;1121}11221123add_filter( 'the_excerpt’, ‘weaverx_custom_excerpt_more’ );11241125112611271128function weaverx_the_excerpt_filter( $excerpt ) { // filter definition1129 return do_shortcode( $excerpt );1130}11311132add_filter( 'the_excerpt’, 'weaverx_the_excerpt_filter’, 9, 1 );1133

Related news

WordPress Weaver Xtreme 5.0.7 / Weaver Show Posts 1.6 Cross Site Scripting

WordPress Weaver Xtreme theme versions 5.0.7 and below and Weaver Show Posts plugin versions 1.6 and below suffer from a persistent cross site scripting vulnerability.

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907