Headline
CVE-2023-2082: class-buy-me-a-coffee.php in buymeacoffee/trunk/includes – WordPress Plugin Repository
The “Buy Me a Coffee – Button and Widget Plugin” plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 3.6 due to insufficient sanitization and escaping on the 'text value set via the bmc_post_reception action. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to inject arbitrary web scripts into pages that execute whenever a victim accesses a page with the injected scripts.
1<?php23/**4 * The file that defines the core plugin class5 *6 * A class definition that includes attributes and functions used across both the7 * public-facing side of the site and the admin area.8 *9 * @link https://www.buymeacoffee.com10 * @since 1.0.011 *12 * @package Buy_Me_A_Coffee13 * @subpackage Buy_Me_A_Coffee/includes14 */1516/**17 * The core plugin class.18 *19 * This is used to define internationalization, admin-specific hooks, and20 * public-facing site hooks.21 *22 * Also maintains the unique identifier of this plugin as well as the current23 * version of the plugin.24 *25 * @since 1.0.026 * @package Buy_Me_A_Coffee27 * @subpackage Buy_Me_A_Coffee/includes28 * @author Buymeacoffee [email protected]29 */30class Buy_Me_A_Coffee31{3233 /**34 * The loader that’s responsible for maintaining and registering all hooks that power35 * the plugin.36 *37 * @since 1.0.038 * @access protected39 * @var Buy_Me_A_Coffee_Loader $loader Maintains and registers all hooks for the plugin.40 */41 protected $loader;4243 /**44 * The unique identifier of this plugin.45 *46 * @since 1.0.047 * @access protected48 * @var string $plugin_name The string used to uniquely identify this plugin.49 */50 protected $plugin_name;5152 /**53 * The current version of the plugin.54 *55 * @since 1.0.056 * @access protected57 * @var string $version The current version of the plugin.58 */59 protected $version;6061 /**62 * Define the core functionality of the plugin.63 *64 * Set the plugin name and the plugin version that can be used throughout the plugin.65 * Load the dependencies, define the locale, and set the hooks for the admin area and66 * the public-facing side of the site.67 *68 * @since 1.0.069 */70 public function __construct()71 {72 if (defined(‘PLUGIN_NAME_VERSION’)) {73 $this->version = PLUGIN_NAME_VERSION;74 } else {75 $this->version = '1.0.0’;76 }77 $this->plugin_name = 'buy-me-a-coffee’;7879 $this->load_dependencies();80 $this->set_locale();81 $this->define_admin_hooks();82 $this->define_public_hooks();83 }8485 /**86 * Load the required dependencies for this plugin.87 *88 * Include the following files that make up the plugin:89 *90 * - Buy_Me_A_Coffee_Loader. Orchestrates the hooks of the plugin.91 * - Buy_Me_A_Coffee_i18n. Defines internationalization functionality.92 * - Buy_Me_A_Coffee_Admin. Defines all hooks for the admin area.93 * - Buy_Me_A_Coffee_Public. Defines all hooks for the public side of the site.94 *95 * Create an instance of the loader which will be used to register the hooks96 * with WordPress.97 *98 * @since 1.0.099 * @access private100 */101 private function load_dependencies()102 {103104 /**105 * The class responsible for orchestrating the actions and filters of the106 * core plugin.107 */108 require_once plugin_dir_path(dirname(__FILE__)) . 'includes/class-buy-me-a-coffee-loader.php’;109110 /**111 * The class responsible for defining internationalization functionality112 * of the plugin.113 */114 require_once plugin_dir_path(dirname(__FILE__)) . 'includes/class-buy-me-a-coffee-i18n.php’;115116 /**117 * The class responsible for defining all actions that occur in the admin area.118 */119 require_once plugin_dir_path(dirname(__FILE__)) . 'admin/class-buy-me-a-coffee-admin.php’;120121 require_once plugin_dir_path(dirname(__FILE__)) . 'admin/partials/buy-me-a-cofee-widget.php’;122123 require_once plugin_dir_path(dirname(__FILE__)) . 'admin/partials/buy-me-a-coffee-admin-display.php’;124125126127 /**128 * The class responsible for defining all actions that occur in the public-facing129 * side of the site.130 */131 require_once plugin_dir_path(dirname(__FILE__)) . 'public/class-buy-me-a-coffee-public.php’;132133134135 $this->loader = new Buy_Me_A_Coffee_Loader();136 }137138 /**139 * Define the locale for this plugin for internationalization.140 *141 * Uses the Buy_Me_A_Coffee_i18n class in order to set the domain and to register the hook142 * with WordPress.143 *144 * @since 1.0.0145 * @access private146 */147 private function set_locale()148 {149150 $plugin_i18n = new Buy_Me_A_Coffee_i18n();151152 $this->loader->add_action('plugins_loaded’, $plugin_i18n, ‘load_plugin_textdomain’);153 }154155 /**156 * Register all of the hooks related to the admin area functionality157 * of the plugin.158 *159 * @since 1.0.0160 * @access private161 */162 private function define_admin_hooks()163 {164165 $plugin_admin = new Buy_Me_A_Coffee_Admin($this->get_plugin_name(), $this->get_version());166167 $this->loader->add_action('admin_enqueue_scripts’, $plugin_admin, ‘enqueue_styles’);168 $this->loader->add_action('admin_enqueue_scripts’, $plugin_admin, ‘enqueue_scripts’);169170 $this->loader->add_action('admin_post_bmc_post_reception’, $plugin_admin, ‘recieve_post’);171172 $this->loader->add_action('admin_post_bmc_disconnect’, $plugin_admin, ‘bmc_disconnect’);173174 $this->loader->add_action('admin_post_bmc_name_post’, $plugin_admin, ‘name_post’);175176 $this->loader->add_action('admin_post_bmc_widget_post’, $plugin_admin, ‘widget_post’);177178 // Menu on admin dashboards179 $this->loader->add_action('admin_menu’, $plugin_admin, ‘bmc_menu’);180181 $this->loader->add_action('widgets_init’, $plugin_admin, ‘bmc_register_plugin’);182183 $this->loader->add_action('activated_plugin’, $plugin_admin, ‘bmc_activation_redirect’);184 }185186 /**187 * Register all of the hooks related to the public-facing functionality188 * of the plugin.189 *190 * @since 1.0.0191 * @access private192 */193 private function define_public_hooks()194 {195196 $plugin_public = new Buy_Me_A_Coffee_Public($this->get_plugin_name(), $this->get_version());197198 $this->loader->add_action('wp_enqueue_scripts’, $plugin_public, ‘enqueue_styles’);199 $this->loader->add_action('wp_enqueue_scripts’, $plugin_public, ‘enqueue_scripts’);200 }201202 /**203 * Run the loader to execute all of the hooks with WordPress.204 *205 * @since 1.0.0206 */207 public function run()208 {209 $this->loader->run();210 }211212 /**213 * The name of the plugin used to uniquely identify it within the context of214 * WordPress and to define internationalization functionality.215 *216 * @since 1.0.0217 * @return string The name of the plugin.218 */219 public function get_plugin_name()220 {221 return $this->plugin_name;222 }223224 /**225 * The reference to the class that orchestrates the hooks with the plugin.226 *227 * @since 1.0.0228 * @return Buy_Me_A_Coffee_Loader Orchestrates the hooks of the plugin.229 */230 public function get_loader()231 {232 return $this->loader;233 }234235 /**236 * Retrieve the version number of the plugin.237 *238 * @since 1.0.0239 * @return string The version number of the plugin.240 */241 public function get_version()242 {243 return $this->version;244 }245}