Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2022-3240: follow-me.php in follow-me/trunk – WordPress Plugin Repository

The “Follow Me Plugin” plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.1. This is due to missing nonce validation on the FollowMeIgniteSocialMedia_options_page() function. This makes it possible for unauthenticated attackers to modify the plugin’s settings and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVE
#sql#web#android#windows#google#js#java#wordpress#php#auth

1<?php2/*3Plugin Name: Follow Me4Plugin URI: http://www.ignitesocialmedia.com/tools/follow-me/5Version: 3.1.56Author: Brian Chappell @ Ignite Social Media7Description: The Follow Me plugin is designed to allow users the ability to add links to their social media profiles in their blog. To get started activate and visit the <a href="options-general.php?page=fmoptions">Settings Page</a>.8*/91011/* UPDATE/INSTALL FUNCTION */121314$FollowMe_version = “3.1.5";15global $FollowMe_version;16function FollowMe_install () {17 $pluginpath = WP_PLUGIN_URL.’/’.str_replace(basename( __FILE__),"",plugin_basename(__FILE__));18 global $wpdb;19 global $FollowMe_version;20 $FollowMe_version = “3.1.5";21 $installed_ver = get_option(“FollowMe_version”);2223 $table_name = $wpdb->prefix . “FollowMe_Links";24 25 /* UPDATE */26 if($installed_ver !== $FollowMe_version) {27 update_option(“FollowMe_version", $FollowMe_version);28 }29 30 31 if($wpdb->get_var(“show tables like '$table_name’”) != $table_name) { 32 $sql = “CREATE TABLE " . $table_name . " (33 `id` INT NOT NULL AUTO_INCREMENT ,34 `name` VARCHAR( 100 ) NOT NULL ,35 `icon` VARCHAR( 500 ) NOT NULL ,36 `address` VARCHAR( 500 ) NOT NULL ,37 PRIMARY KEY ( `id` )38 );";39 require_once(ABSPATH . ‘wp-admin/includes/upgrade.php’);40 dbDelta($sql);41 $installarr = array(“FollowMe_Quora","FollowMe_Tumblr","FollowMe_Pinterest","FollowMe_GooglePlus","FollowMe_Yelp","FollowMe_Technorati","FollowMe_SlideShare","FollowMe_Propeller","FollowMe_Picasa","FollowMe_Newsvine","FollowMe_Last","FollowMe_kirtsy","FollowMe_FriendFeed","FollowMe_brightkite","FollowMe_Mahalo","FollowMe_plurk","FollowMe_Ping","FollowMe_MyBlogLog","FollowMe_Twitter","FollowMe_LinkedIn","FollowMe_StumbleUpon","FollowMe_Myspace","FollowMe_Sphinn","FollowMe_Facebook","FollowMe_Digg","FollowMe_Delicious","FollowMe_Youtube","FollowMe_Reddit","FollowMe_Flickr","FollowMe_Mixx","FollowMe_Xing","FollowMe_Identica","FollowMe_Plaxo","FollowMe_Orkut”);42 foreach($installarr as $row) {43 $insert = “INSERT INTO " . $table_name . " (name, icon, address) VALUES ('".str_replace('FollowMe_’, '’, $row)."’,’” .$pluginpath ."images/".strtolower(str_replace('FollowMe_’,’’,$row)).".png’,’” . get_option($row) . “’)“;44 $results = $wpdb->query( $insert );45 if($results){46 $wpdb->query(“DELETE FROM " . $table_name . " WHERE address = '’”);47 delete_option($row);48 }49 } 50 $i=1;51 while($i<=15)52 {53 $text = “FollowMe_LinkText".$i; 54 $url = “FollowMe_LinkURL".$i; 55 56 $insertcustom = “INSERT INTO " . $table_name . " (name, icon, address) VALUES ('".get_option($text)."’,’” .$pluginpath ."images/avatar.jpg’,’” . get_option($url) . “’)“;57 $action = $wpdb->query( $insertcustom );58 if($action){59 $wpdb->query(“DELETE FROM " . $table_name . " WHERE address = '’”);60 delete_option($text);61 delete_option($url);62 }63 $i++;64 65 }66 add_option(“FollowMe_mobile",’off’); 67 add_option(“FollowMe_mewe",’me’); 68 add_option(“FollowMe_version", $FollowMe_version);69 add_option(“FollowMe_Buttons",’button.gif’);70 add_option(“FollowMe_Layout",’true’);71 add_option(“FollowMe_NewWin",’check’);72 add_option(“FollowMe_Columns",’2’);73 add_option(“FollowMe_Design",’old’);74 add_option(“FollowMe_New_Side",’left’);75 add_option(“FollowMe_New_Size",’small’);76 }77}7879register_activation_hook(__FILE__,’FollowMe_install’);8081//FUNCTION ADDS JS/CSS TO HTML8283function FollowMe_Scripts(){84if(get_option(‘FollowMe_Design’) == ‘old’){}else{85 86$pluginpath = WP_PLUGIN_URL.’/’.str_replace(basename( __FILE__),"",plugin_basename(__FILE__)); 8788$useragent=$_SERVER[‘HTTP_USER_AGENT’];89if(get_option(‘FollowMe_mobile’) == ‘on’){90 if(preg_match('/android|avantgo|blackberry|blazer|compal|elaine|fennec|hiptop|iemobile|ip(hone|od)|iris|kindle|lge |maemo|midp|mmp|opera m(ob|in)i|palm( os)?|phone|p(ixi|re)\/|plucker|pocket|psp|symbian|treo|up\.(browser|link)|vodafone|wap|windows (ce|phone)|xda|xiino/i’,$useragent)||preg_match('/1207|6310|6590|3gso|4thp|50[1-6]i|770s|802s|a wa|abac|ac(er|oo|s\-)|ai(ko|rn)|al(av|ca|co)|amoi|an(ex|ny|yw)|aptu|ar(ch|go)|as(te|us)|attw|au(di|\-m|r |s )|avan|be(ck|ll|nq)|bi(lb|rd)|bl(ac|az)|br(e|v)w|bumb|bw\-(n|u)|c55\/|capi|ccwa|cdm\-|cell|chtm|cldc|cmd\-|co(mp|nd)|craw|da(it|ll|ng)|dbte|dc\-s|devi|dica|dmob|do(c|p)o|ds(12|\-d)|el(49|ai)|em(l2|ul)|er(ic|k0)|esl8|ez([4-7]0|os|wa|ze)|fetc|fly(\-|_)|g1 u|g560|gene|gf\-5|g\-mo|go(\.w|od)|gr(ad|un)|haie|hcit|hd\-(m|p|t)|hei\-|hi(pt|ta)|hp( i|ip)|hs\-c|ht(c(\-| |_|a|g|p|s|t)|tp)|hu(aw|tc)|i\-(20|go|ma)|i230|iac( |\-|\/)|ibro|idea|ig01|ikom|im1k|inno|ipaq|iris|ja(t|v)a|jbro|jemu|jigs|kddi|keji|kgt( |\/)|klon|kpt |kwc\-|kyo(c|k)|le(no|xi)|lg( g|\/(k|l|u)|50|54|e\-|e\/|\-[a-w])|libw|lynx|m1\-w|m3ga|m50\/|ma(te|ui|xo)|mc(01|21|ca)|m\-cr|me(di|rc|ri)|mi(o8|oa|ts)|mmef|mo(01|02|bi|de|do|t(\-| |o|v)|zz)|mt(50|p1|v )|mwbp|mywa|n10[0-2]|n20[2-3]|n30(0|2)|n50(0|2|5)|n7(0(0|1)|10)|ne((c|m)\-|on|tf|wf|wg|wt)|nok(6|i)|nzph|o2im|op(ti|wv)|oran|owg1|p800|pan(a|d|t)|pdxg|pg(13|\-([1-8]|c))|phil|pire|pl(ay|uc)|pn\-2|po(ck|rt|se)|prox|psio|pt\-g|qa\-a|qc(07|12|21|32|60|\-[2-7]|i\-)|qtek|r380|r600|raks|rim9|ro(ve|zo)|s55\/|sa(ge|ma|mm|ms|ny|va)|sc(01|h\-|oo|p\-)|sdk\/|se(c(\-|0|1)|47|mc|nd|ri)|sgh\-|shar|sie(\-|m)|sk\-0|sl(45|id)|sm(al|ar|b3|it|t5)|so(ft|ny)|sp(01|h\-|v\-|v )|sy(01|mb)|t2(18|50)|t6(00|10|18)|ta(gt|lk)|tcl\-|tdg\-|tel(i|m)|tim\-|t\-mo|to(pl|sh)|ts(70|m\-|m3|m5)|tx\-9|up(\.b|g1|si)|utst|v400|v750|veri|vi(rg|te)|vk(40|5[0-3]|\-v)|vm40|voda|vulc|vx(52|53|60|61|70|80|81|83|85|98)|w3c(\-| )|webc|whit|wi(g |nc|nw)|wmlb|wonu|x700|xda(\-|2|g)|yas\-|your|zeto|zte\-/i’,substr($useragent,0,4)))91 {$mobile = “yes";}92 else93 {$mobile = “no";}94}95else{$mobile = “no";}96if($mobile == “yes”){}else{97?>98<script type="text/javascript” src="<?php echo $pluginpath; ?>js/bubble.js"></script>99<link rel="stylesheet” type="text/css” href="<?php echo $pluginpath; ?>css/style.css” />100<?php } } 101}102103//FUNCTION CREATES TAB ON PAGE104105function FollowMe_Bubble(){106$useragent=$_SERVER[‘HTTP_USER_AGENT’];107if(get_option(‘FollowMe_mobile’) == ‘on’){108 if(preg_match('/android|avantgo|blackberry|blazer|compal|elaine|fennec|hiptop|iemobile|ip(hone|od)|iris|kindle|lge |maemo|midp|mmp|opera m(ob|in)i|palm( os)?|phone|p(ixi|re)\/|plucker|pocket|psp|symbian|treo|up\.(browser|link)|vodafone|wap|windows (ce|phone)|xda|xiino/i’,$useragent)||preg_match('/1207|6310|6590|3gso|4thp|50[1-6]i|770s|802s|a wa|abac|ac(er|oo|s\-)|ai(ko|rn)|al(av|ca|co)|amoi|an(ex|ny|yw)|aptu|ar(ch|go)|as(te|us)|attw|au(di|\-m|r |s )|avan|be(ck|ll|nq)|bi(lb|rd)|bl(ac|az)|br(e|v)w|bumb|bw\-(n|u)|c55\/|capi|ccwa|cdm\-|cell|chtm|cldc|cmd\-|co(mp|nd)|craw|da(it|ll|ng)|dbte|dc\-s|devi|dica|dmob|do(c|p)o|ds(12|\-d)|el(49|ai)|em(l2|ul)|er(ic|k0)|esl8|ez([4-7]0|os|wa|ze)|fetc|fly(\-|_)|g1 u|g560|gene|gf\-5|g\-mo|go(\.w|od)|gr(ad|un)|haie|hcit|hd\-(m|p|t)|hei\-|hi(pt|ta)|hp( i|ip)|hs\-c|ht(c(\-| |_|a|g|p|s|t)|tp)|hu(aw|tc)|i\-(20|go|ma)|i230|iac( |\-|\/)|ibro|idea|ig01|ikom|im1k|inno|ipaq|iris|ja(t|v)a|jbro|jemu|jigs|kddi|keji|kgt( |\/)|klon|kpt |kwc\-|kyo(c|k)|le(no|xi)|lg( g|\/(k|l|u)|50|54|e\-|e\/|\-[a-w])|libw|lynx|m1\-w|m3ga|m50\/|ma(te|ui|xo)|mc(01|21|ca)|m\-cr|me(di|rc|ri)|mi(o8|oa|ts)|mmef|mo(01|02|bi|de|do|t(\-| |o|v)|zz)|mt(50|p1|v )|mwbp|mywa|n10[0-2]|n20[2-3]|n30(0|2)|n50(0|2|5)|n7(0(0|1)|10)|ne((c|m)\-|on|tf|wf|wg|wt)|nok(6|i)|nzph|o2im|op(ti|wv)|oran|owg1|p800|pan(a|d|t)|pdxg|pg(13|\-([1-8]|c))|phil|pire|pl(ay|uc)|pn\-2|po(ck|rt|se)|prox|psio|pt\-g|qa\-a|qc(07|12|21|32|60|\-[2-7]|i\-)|qtek|r380|r600|raks|rim9|ro(ve|zo)|s55\/|sa(ge|ma|mm|ms|ny|va)|sc(01|h\-|oo|p\-)|sdk\/|se(c(\-|0|1)|47|mc|nd|ri)|sgh\-|shar|sie(\-|m)|sk\-0|sl(45|id)|sm(al|ar|b3|it|t5)|so(ft|ny)|sp(01|h\-|v\-|v )|sy(01|mb)|t2(18|50)|t6(00|10|18)|ta(gt|lk)|tcl\-|tdg\-|tel(i|m)|tim\-|t\-mo|to(pl|sh)|ts(70|m\-|m3|m5)|tx\-9|up(\.b|g1|si)|utst|v400|v750|veri|vi(rg|te)|vk(40|5[0-3]|\-v)|vm40|voda|vulc|vx(52|53|60|61|70|80|81|83|85|98)|w3c(\-| )|webc|whit|wi(g |nc|nw)|wmlb|wonu|x700|xda(\-|2|g)|yas\-|your|zeto|zte\-/i’,substr($useragent,0,4)))109 {$mobile = “yes";}110 else111 {$mobile = “no";}112}113else{$mobile = “no";}114if($mobile == “yes”){}else{115 116global $wpdb;117$pluginpath = WP_PLUGIN_URL.’/’.str_replace(basename( __FILE__),"",plugin_basename(__FILE__)); 118if(get_option(‘FollowMe_Design’) == ‘old’){}else{119 if(get_option(‘FollowMe_mewe’) == ‘we’){120121 if(get_option(‘FollowMe_New_Side’) == ‘left’){122 if(get_option(‘FollowMe_New_Size’) == ‘small’){ ?>123 <a id="FollowMeTabLeftSm” onclick="showFollowMe()" href="#” style="border-bottom:none;"><img src="<?php echo $pluginpath; ?>images/us/leftsm.gif” border="0” /></a>124 <?php }else{ ?> 125 <a id="FollowMeTabLeftLg” onclick="showFollowMe()" href="#” style="border-bottom:none;"><img src="<?php echo $pluginpath; ?>images/us/leftlg.gif” border="0” /></a> 126<?php }} else{ 127 if(get_option(‘FollowMe_New_Size’) == ‘small’){ ?>128 <a id="FollowMeTabRightSm” onclick="showFollowMe()" href="#” style="border-bottom:none;"><img src="<?php echo $pluginpath; ?>images/us/rightsm.gif” border="0” /></a>129 <?php }else{ ?>130 <a id="FollowMeTabRightLg” onclick="showFollowMe()" href="#” style="border-bottom:none;"><img src="<?php echo $pluginpath; ?>images/us/rightlg.gif” border="0” /></a> 131 132<?php } } 133 134 135} 136else{137 if(get_option(‘FollowMe_New_Side’) == ‘left’){138 if(get_option(‘FollowMe_New_Size’) == ‘small’){ ?>139 <a id="FollowMeTabLeftSm” onclick="showFollowMe()" href="#” style="border-bottom:none;"><img src="<?php echo $pluginpath; ?>images/leftsm.gif” border="0” /></a>140 <?php }else{ ?> 141 <a id="FollowMeTabLeftLg” onclick="showFollowMe()" href="#" style="border-bottom:none;"><img src="<?php echo $pluginpath; ?>images/leftlg.gif" border="0" /></a> 142<?php }} else{ 143 if(get_option(‘FollowMe_New_Size’) == ‘small’){ ?>144 <a id="FollowMeTabRightSm" onclick="showFollowMe()" href="#" style="border-bottom:none;"><img src="<?php echo $pluginpath; ?>images/rightsm.gif" border="0" /></a>145 <?php }else{ ?>146 <a id="FollowMeTabRightLg" onclick="showFollowMe()" href="#" style="border-bottom:none;"><img src="<?php echo $pluginpath; ?>images/rightlg.gif" border="0" /></a> 147 148<?php } } } ?>149150<div id="FollowMeBubbleBG" style="visibility:hidden;"></div>151<div id="FollowMeBubble" style="visibility:hidden;border-bottom:none;">152153154<?php if(get_option(‘FollowMe_mewe’) == ‘we’){ ?>155<div class="top" style="background-image:url(‘<?php echo $pluginpath; ?>images/us/followme_top.gif’);width:329px;height:60px;float:left;display:block;border-bottom:none;">156<?php }else{ ?>157<div class="top" style="background-image:url(‘<?php echo $pluginpath; ?>images/followme_top.gif’);width:329px;height:60px;float:left;display:block;border-bottom:none;">158<?php } ?>159<a id="close" onclick="hideFollowMe()" href="#" style="border-bottom:none"><img src="<?php echo $pluginpath; ?>images/close.png" border="0" /> </a>160<!-- <a id="grab" target="_blank" title="grab this" href="http://www.ignitesocialmedia.com/tools/follow-me/"><span>grab this</span></a>–></div>161<div class="mid" style="background-image:url(‘<?php echo $pluginpath; ?>images/followme_mid.gif’);width:329px;background-repeat:repeat-y;float:left;">162<div id="stretch">163<?php164$table_name = $wpdb->prefix . “FollowMe_Links";165$selectprofiles = “SELECT * FROM “.$table_name;166$action = $wpdb->get_results($selectprofiles);167168foreach ($action as $row) {169?>170<span><a title="<?php echo $row->name; ?>"<?php if(get_option(‘FollowMe_NewWin’) == ‘check’) { ?> target="_blank” <?php } ?>href="<?php echo $row->address; ?>” rel="me"><img width="32px” src="<?php echo $row->icon; ?>" border="0" alt="<?php echo $row->name; ?>" /> <?php echo $row->name; ?></a></span>171<?php } ?>172</div></div>173<div class="bottom" style="background-image:url(‘<?php echo $pluginpath; ?>images/followme_bottom.gif’);height:34px;width:329px;clear:both;float:left;">174<a id="grab" target="_blank" title="grab this" style="border-bottom:none;" href="http://www.ignitesocialmedia.com/tools/follow-me/"><span>grab this</span></a>175</div>176<div class="grab" style="width:329px;clear:both;float:left;"><a style="border-bottom:none;" href="http://www.ignitesocialmedia.com/tools/follow-me/"><img src="<?php echo $pluginpath; ?>images/followme_grab.gif" /></a></div>177</div>178179180181182183184<?php } } }185186//FUNCTION CREATES BUTTON AND “HOVER” BUBBLE FOR OLD VERSION187188function FollowMeSocialMedia() {189190$useragent=$_SERVER[‘HTTP_USER_AGENT’];191if(get_option(‘FollowMe_mobile’) == ‘on’){192 if(preg_match('/android|avantgo|blackberry|blazer|compal|elaine|fennec|hiptop|iemobile|ip(hone|od)|iris|kindle|lge |maemo|midp|mmp|opera m(ob|in)i|palm( os)?|phone|p(ixi|re)\/|plucker|pocket|psp|symbian|treo|up\.(browser|link)|vodafone|wap|windows (ce|phone)|xda|xiino/i’,$useragent)||preg_match('/1207|6310|6590|3gso|4thp|50[1-6]i|770s|802s|a wa|abac|ac(er|oo|s\-)|ai(ko|rn)|al(av|ca|co)|amoi|an(ex|ny|yw)|aptu|ar(ch|go)|as(te|us)|attw|au(di|\-m|r |s )|avan|be(ck|ll|nq)|bi(lb|rd)|bl(ac|az)|br(e|v)w|bumb|bw\-(n|u)|c55\/|capi|ccwa|cdm\-|cell|chtm|cldc|cmd\-|co(mp|nd)|craw|da(it|ll|ng)|dbte|dc\-s|devi|dica|dmob|do(c|p)o|ds(12|\-d)|el(49|ai)|em(l2|ul)|er(ic|k0)|esl8|ez([4-7]0|os|wa|ze)|fetc|fly(\-|_)|g1 u|g560|gene|gf\-5|g\-mo|go(\.w|od)|gr(ad|un)|haie|hcit|hd\-(m|p|t)|hei\-|hi(pt|ta)|hp( i|ip)|hs\-c|ht(c(\-| |_|a|g|p|s|t)|tp)|hu(aw|tc)|i\-(20|go|ma)|i230|iac( |\-|\/)|ibro|idea|ig01|ikom|im1k|inno|ipaq|iris|ja(t|v)a|jbro|jemu|jigs|kddi|keji|kgt( |\/)|klon|kpt |kwc\-|kyo(c|k)|le(no|xi)|lg( g|\/(k|l|u)|50|54|e\-|e\/|\-[a-w])|libw|lynx|m1\-w|m3ga|m50\/|ma(te|ui|xo)|mc(01|21|ca)|m\-cr|me(di|rc|ri)|mi(o8|oa|ts)|mmef|mo(01|02|bi|de|do|t(\-| |o|v)|zz)|mt(50|p1|v )|mwbp|mywa|n10[0-2]|n20[2-3]|n30(0|2)|n50(0|2|5)|n7(0(0|1)|10)|ne((c|m)\-|on|tf|wf|wg|wt)|nok(6|i)|nzph|o2im|op(ti|wv)|oran|owg1|p800|pan(a|d|t)|pdxg|pg(13|\-([1-8]|c))|phil|pire|pl(ay|uc)|pn\-2|po(ck|rt|se)|prox|psio|pt\-g|qa\-a|qc(07|12|21|32|60|\-[2-7]|i\-)|qtek|r380|r600|raks|rim9|ro(ve|zo)|s55\/|sa(ge|ma|mm|ms|ny|va)|sc(01|h\-|oo|p\-)|sdk\/|se(c(\-|0|1)|47|mc|nd|ri)|sgh\-|shar|sie(\-|m)|sk\-0|sl(45|id)|sm(al|ar|b3|it|t5)|so(ft|ny)|sp(01|h\-|v\-|v )|sy(01|mb)|t2(18|50)|t6(00|10|18)|ta(gt|lk)|tcl\-|tdg\-|tel(i|m)|tim\-|t\-mo|to(pl|sh)|ts(70|m\-|m3|m5)|tx\-9|up(\.b|g1|si)|utst|v400|v750|veri|vi(rg|te)|vk(40|5[0-3]|\-v)|vm40|voda|vulc|vx(52|53|60|61|70|80|81|83|85|98)|w3c(\-| )|webc|whit|wi(g |nc|nw)|wmlb|wonu|x700|xda(\-|2|g)|yas\-|your|zeto|zte\-/i’,substr($useragent,0,4)))193 {$mobile = “yes";}194 else195 {$mobile = “no";}196}197else{$mobile = “no";}198if($mobile == “yes”){}else{199 200if(get_option(‘FollowMe_Design’) == ‘new’){}else{ 201 202$pluginpath = WP_PLUGIN_URL.’/’.str_replace(basename( __FILE__),"",plugin_basename(__FILE__)); 203if(get_option(‘FollowMe_Buttons’) !== ‘none’)204{ ?>205<script type="text/javascript” src="206<?php echo $pluginpath; ?>js/followme.js"></script>207208209<li>210211<a href="#” onmouseover="TagToTip('FollowMe’, LEFT, 212<?php if(get_option(‘FollowMe_Layout’) == ‘’){echo “true";}else{echo get_option(‘FollowMe_Layout’);}?>, BORDERWIDTH, 0, BGCOLOR, '#E0E0E0’, FADEIN, 200, FADEOUT, 200, STICKY, true, PADDING, 0, CLICKCLOSE, true)" onmouseout="UnTip()“>213<img id="FollowMeClick” style="border: none;” src="<?php echo $pluginpath; ?>images/<?php echo get_option(‘FollowMe_Buttons’); ?>” border="0" alt="" /></a> 214215<?php }216else217{ }218?>219<li>220<div style="border: thin solid #E0E0E0; width:260px;221<?php if(get_option(‘FollowMe_Buttons’) !== ‘none’){echo “display:none;";}else{echo “";} ?>” id="FollowMe">222<table style="border-style:hidden;border-collapse: collapse;border-spacing:0px;” width="260px"><tbody>223<tr style="background-color: rgb(224, 224, 224);border-style:hidden;">224<td <?php if(get_option(‘FollowMe_Columns’) != 1){ ?>colspan="2"<?php } ?> style="background-color: rgb(224, 224, 224);border-style:hidden;" align="left">225<span style="display:inline;font: 10pt 'Lucida Grande’, Verdana, Arial, Sans-Serif;color: #000000;text-decoration: none;display: inline; text-transform: capitalize; text-align:left;font-weight:900;">Follow Me:</span><br/>226</td>227</tr>228<tr <?php if(get_option(‘FollowMe_Columns’) != 1){echo 'width="260px"’;} ?><?php if(get_option(‘FollowMe_Columns’) == 1){echo ‘width="130px"’;} ?> style="background-color: rgb(255, 255, 255);border-style:hidden;">229<td width="130px" valign="top" style="padding-left: 4px; padding-top: 4px;border-style:hidden;" >230<?php231global $wpdb;232$table_name = $wpdb->prefix . “FollowMe_Links";233$selectprofiles = “SELECT * FROM “.$table_name;234$action = $wpdb->get_results($selectprofiles);235236foreach ($action as $row) { ?>237238<span style="display:inline;padding-top: 2px;text-transform:capitalize;">239<img style="border: none; vertical-align:middle; padding-right: 2px;” width="32px” src="<?php echo $row->icon; ?>” alt="" /><a style="font:10pt’Lucida Grande’,Verdana,Arial,Sans-Serif;color:#000000;text-decoration:none;display:inline;" rel="me" href="<?php echo $row->address; ?>" title="<?php echo $row->name; ?>"><?php echo $row->name; ?></a>240</span>241<br/>242243<?php } ?>244245</td>246</tr>247<tr style="background-color: rgb(224, 224, 224);">248<td style="background-color: rgb(224, 224, 224);" <?php if(get_option(‘FollowMe_Columns’) != 1){ ?>colspan="2"<?php } ?> align="right">249<a style="font: 10pt ‘Lucida Grande’, Verdana, Arial, Sans-Serif;color: #000000;text-decoration: none;display: inline; text-transform: capitalize; text-align:right;" title="Grab This" target="_blank" href="http://www.ignitesocialmedia.com/tools/follow-me/">Grab This</a>250</td>251</tr>252</tbody>253</table>254</div>255</li>256<?php 257}} }258259/* OPTIONS PAGE */260261function FollowMeIgniteSocialMedia_options_page()262{263global $wpdb; 264$table_name = $wpdb->prefix . "FollowMe_Links";265$pluginpath = WP_PLUGIN_URL.’/’.str_replace(basename( __FILE__),"",plugin_basename(__FILE__)); 266if(isset($_POST[‘profilelinks’])){267 $name = $_POST[‘name’];268 $url = $_POST[‘url’];269 $insertprofilelinks = “INSERT INTO " . $table_name . " (name, icon, address) VALUES ('” . $name . “’,’” . $pluginpath . “images/".strtolower($name).".png’,’” . $url . "’)";270 $action = $wpdb->query($insertprofilelinks);271}272if(isset($_POST[‘customlinks’])){273 $name = $_POST[‘name’];274 $url = $_POST[‘url’];275 $imgurl = $_POST[‘imgurl’];276 if(strlen($imgurl)>7)277 {$customicon = $imgurl;}else{$customicon = $pluginpath . "images/avatar.jpg";}278 $insertcustom = “INSERT INTO " . $table_name . " (name, icon, address) VALUES ('” . $name . “’,’” . $customicon . “’,’” . $url . "’)“;279 $action = $wpdb->query($insertcustom);280}281282if(isset($_POST[‘designoptions’])){283 update_option('FollowMe_mobile’, $_POST[‘mobile’]); 284 update_option('FollowMe_mewe’, $_POST[‘mewe’]); 285 update_option('FollowMe_Buttons’, $_POST[‘buttons’]);286 update_option('FollowMe_Layout’, $_POST[‘layout’]);287 update_option('FollowMe_NewWin’, $_POST[‘newwin’]);288 update_option('FollowMe_Columns’, $_POST[‘columns’]);289 update_option('FollowMe_Design’, $_POST[‘design’]);290 update_option('FollowMe_New_Side’, $_POST[‘side’]);291 update_option(‘FollowMe_New_Size’, $_POST[‘size’]);292}293294if(isset($_GET[‘del’])){295 $wpdb->query(“DELETE FROM " . $table_name . " WHERE id = '".$_GET[‘del’]."’”);296 }297 298 299echo "<script type=’text/javascript’ src=’".$pluginpath."js/wz_tooltip.js’></script>"; 300 ?>301<div class="wrap">302<h1>Follow Me Plugin Settings</h1>303<div id="poststuff” class="metabox-holder has-right-sidebar">304<?php include(‘admin-sidebar.php’); ?>305<div class="has-sidebar sm-padded" >306<div id="post-body-content" class="has-sidebar-content">307<div class="meta-box-sortabless">308<div id="sm_rebuild" class="postbox">309<h3 style="cursor:default;" ><span>Manage Your Profile Links:</span></h3>310<div class="inside">311<div style="margin:10px;">312<strong>Add Your Profiles:</strong>313<p>Fill in your details below. In each field add the complete URL to your different profiles.<br>314<span style="color:#FF0000">Please note that you must include HTTP:// in order for your link to work. (ie. http://www.example.com) </span></p>315<?php wp_nonce_field(‘update-options’); ?>316<table border="0" style="border-collapse: collapse" width="800px">317<form method="post" action="options-general.php?page=fmoptions&updated=true">318<input type="hidden" name="profilelinks" value="1" />319<tr><td width="33%" align="right">320<?php 321$optionarr = array(“Quora","Pinterest","Tumblr","GooglePlus","Google","Tagged","FourSquare","Blipfm","Email","Skype","MSN","AIM","GoodReads","Hyvesnl","Yelp","Technorati","SlideShare","Propeller","Picasa","Newsvine","Last","Kirtsy","FriendFeed","Brightkite","Mahalo","Plurk","Ping","MyBlogLog","Twitter","LinkedIn","StumbleUpon","Myspace","Sphinn","Facebook","Digg","Delicious","Youtube","Reddit","Flickr","Mixx","Xing","Identica","Plaxo","Orkut","RSS","Buzz”);322sort($optionarr);323?>324<select style="width:200px;" name="name">325<?php326foreach($optionarr as $row) {327?>328<option id="<?php echo $row; ?>" value="<?php echo $row; ?>">329<?php echo $row; ?>330</option>331<?php } ?>332</select>333</td>334<td width="33%"><input size="75" type="text" id="url" name="url" value="http://" /></td>335<td width="33%">336<p style="margin:0px;padding:0;" class="submit">337<input type="submit" class="button-primary" name="Submit" value="<?php _e(‘Add Profile Link’) ?>" />338</p>339</td>340</tr>341</form>342<form method="post" action="options-general.php?page=fmoptions&updated=true">343<input type="hidden" name="customlinks" value="1" />344<tr><td colspan="3">345<br/><strong>OR:</strong>346<span class="custom" style="text-decoration:underline;cursor:pointer;">Add A Custom Link.</span>347<div style="margin:5px;background-color:#DAE2ff;" class="custom_body">348<div style="margin:5px;">349Custom Link Name:<br>350<input name="name" type="text" /><br/>351URL:<br/>352<input type="text" name="url" value="http://" />353<br/>354Custom Link Icon URL:<a onmouseover="Tip('Enter the URL of an icon image you would like to assiociate with this link. If left blank a default image will be provided. For best results image should be no larger than 50px x 50px.’, WIDTH, 250, ABOVE, true, OFFSETX, 1, FADEIN, 400, FADEOUT, 300)" onmouseout="UnTip()“><img src="<?php echo $pluginpath; ?>images/help.png” /></a><br/>355<input type="text" name="imgurl" value="http://" /><br/>356<p style="margin:5px 0 0 0;padding:0;" class="submit">357<input type="submit" class="button-primary" name="Submit" value="<?php _e(‘Add Custom Link’) ?>" />358</p>359</div>360</div>361<br/><br/>362</td>363</tr>364</form>365</table>366<strong>Your Profiles:</strong>367<table width="700px">368369<?php370$selectprofiles = “SELECT * FROM “.$table_name;371$action = $wpdb->get_results($selectprofiles);372373foreach ($action as $row) {374?>375<tr style="border-bottom:solid;border-width:1px;border-color:#aeaeae;">376<td style="border-bottom:solid;border-width:1px;border-color:#aeaeae;” width="20px” align="right">377<img width="32px" src="378<?php echo $row->icon; ?>" />379</td>380<td style="border-bottom:solid;border-width:1px;border-color:#aeaeae;" width="655px">381<?php echo $row->address; ?>382</td>383<td style="border-bottom:solid;border-width:1px;border-color:#aeaeae;" width="25px">384<a style="color:red;" href="options-general.php?page=fmoptions&&updated=true&del=385<?php echo $row->id; ?>" >delete</a>386</td>387</tr>388<?php } ?>389390</table>391</div>392393394395396</div>397</div>398<div id="sm_rebuild" class="postbox">399 <h3 style="cursor:default;"><span>Design:</span></h3>400 <div class="inside">401 402 403 <div style="margin:10px;">404<p>405<form method="post" action="options-general.php?page=fmoptions&updated=true">406<input type="hidden" name="designoptions" value="1" />407<strong>New Windows?</strong>408<p><label><input type="checkbox" <?php if(get_option(‘FollowMe_NewWin’) == ‘check’)409{410 echo “checked=’checked’";411}412?> name="newwin” value="check"> Open links in new window or tab.</label></p>413414<strong>New Design</strong>415<p style="margin:0px">With the release of 2.0 we are offering a new design option that utilizes a tab that is placed on either the right or left margins of the page. When the tab is clicked a helpful dialog box is display in the center of the screen displaying your profile links.</p>416<br/><br/>417<strong>Old Design</strong>418<p style="margin:0px">Prior to version 2.0 this plugin used a “floating” box to display links when hovered over this <a href="<?php echo $pluginpath; ?>/images/button.gif" />button</a>. Enabling this option will allow you to contiue using that feature versus the new feature explained above.</p>419<br/><br/>420<div style="margin:5px;border:solid;border-width:2px;border-color:#a9c8d6;">421<div style="margin:5px;">422<span style="font-weight:900;"><input name="design" value="new" <?php if(get_option(‘FollowMe_Design’) == ‘new’)423{424 echo “checked=’checked’";425}426?> type="radio">New Design</span>427<div>428<br/><br/>429Is there more than one of you?430<br/>431<label><input name="mewe” value="me" <?php432if(get_option(‘FollowMe_mewe’) == ‘me’)433{434 echo “checked=’checked’";435}436?> class="tog” type="radio"> “Follow Me"</label>437<br/>438<label><input name="mewe” value="we" <?php439if(get_option(‘FollowMe_mewe’) == ‘we’)440{441 echo “checked=’checked’";442}443?> class="tog” type="radio"> “Follow Us"</label>444<br/><br/>445On which margin should the tab appear?446<br/>447<label><input name="side” value="left" <?php448if(get_option(‘FollowMe_New_Side’) == ‘left’)449{450 echo “checked=’checked’";451}452?> class="tog” type="radio"> Left</label>453<br/>454<label><input name="side" value="right" <?php455if(get_option(‘FollowMe_New_Side’) == ‘right’)456{457 echo “checked=’checked’";458}459?> class="tog” type="radio"> Right</label>460<br/><br/>461What size tab would you like?462<br/>463<label><input name="size" value="small" <?php464if(get_option(‘FollowMe_New_Size’) == ‘small’)465{466 echo “checked=’checked’";467}468?> class="tog” type="radio"> Small</label>469<br/>470<label><input name="size" value="large" <?php471if(get_option(‘FollowMe_New_Size’) == ‘large’)472{473 echo “checked=’checked’";474}475?> class="tog” type="radio"> Large</label>476<br/><br/>477Deactivate on mobile browsers?478<br/>479<label><input name="mobile" value="on" <?php480if(get_option(‘FollowMe_mobile’) == ‘on’)481{482 echo “checked=’checked’";483}484?> class="tog” type="radio"> Yes</label>485<br/>486<label><input name="mobile" value="off" <?php487if(get_option(‘FollowMe_mobile’) == ‘off’)488{489 echo “checked=’checked’";490}491?> class="tog” type="radio"> No</label>492</div>493</div>494</div>495496<div style="margin:5px;border:solid;border-width:2px;border-color:#a9c8d6;">497<div style="margin:5px;"> 498<span style="font-weight:900;" class="oldd"><input name="design" value="old" <?php if(get_option(‘FollowMe_Design’) == ‘old’)499{500 echo “checked=’checked’";501}502?> type="radio">Old Design</span> 503<div class="oldd_body">504<strong>Widgets!</strong>505<p> To enable the Follow Me Plugin in your blogs sidebar visit the <a href="<?php bloginfo(url); ?>/wp-admin/widgets.php">Widgets Page</a>. Transfer the “Follow Me” selection from the left to the right and click “Save Changes".</p>506<strong>No Widgets? No Problem!</strong>507<p>If your version of Wordpress, or your blog’s template, doesn’t support Widgets, feel free to use the following template tag to add the Follow Me plugin to your blog. <strong><?php FollowMeSocialMedia() ?></strong> All you have to do is copy the tag and paste it anywhere in your template that you would like the Follow Me badge to appear.</p>508509<table width="800px” border="0” style="border-collapse: collapse">510 <tbody>511 <tr>512 <th width="222" align="left"><label>513 <strong>Layout:</strong></label></th>514 <td aligh="left" width="568"><p>With the Follow Me Plugin you have the option of displaying your links using the default button or with a button free “link box” option. </p>515 <p> </p></td>516 </tr>517 </tbody>518</table>519<table border="0" style="border-collapse: collapse" width="800px">520 <tbody>521 <tr>522 <th width="222" align="left"><label><input name="buttons" value="button.gif" <?php523if(get_option(‘FollowMe_Buttons’) == ‘button.gif’)524{525 echo “checked=’checked’";526}527?> class="tog” type="radio">Default Button </label></th>528 <td width="568"><p><img src=" 529<?php echo $pluginpath; ?>/images/button.gif"/></p>530 <p> </p></td>531 </tr>532 <tr>533 <th align="left"><label>534 <input name="buttons" value="buttonmid.gif" class="tog" <?php535if(get_option(‘FollowMe_Buttons’) == ‘buttonmid.gif’)536{537 echo “checked=’checked’";538}539?> type="radio">Medium Button </label></th>540 <td><p><img src=” 541<?php echo $pluginpath; ?>/images/buttonmid.gif"/></p>542 <p> </p></td>543 </tr>544 <tr>545 <th align="left"><label>546 <input name="buttons" value="buttonlrg.gif" class="tog" <?php547if(get_option(‘FollowMe_Buttons’) == ‘buttonlrg.gif’)548{549 echo “checked=’checked’";550}551?> type="radio">Large Button</label></th>552 <td><p><img src=” 553<?php echo $pluginpath; ?>/images/buttonlrg.gif"/></p>554 <p> </p></td>555 </tr>556 </tbody>557</table>558<table width="800px" border="0" class="form-table" style="border-collapse: collapse">559 <tbody>560 <tr>561 <th align="left"><input name="buttons" value="none" <?php562if(get_option(‘FollowMe_Buttons’) == ‘none’)563{564 echo “checked=’checked’";565}566?> class="tog” type="radio">Display as Box:</th>567 <td><img src=" 568<?php echo $pluginpath; ?>/images/box-layout.png"/></td>569 </tr>570 <tr>571 <th width="220" align="left"><label>572 </label></th>573 <td width="570"> 574 </td>575 </tr>576 </tbody>577</table>578<strong>Number of Columns:</strong>579<label>1<input name="columns" value="1" <?php580if(get_option(‘FollowMe_Columns’) == 1)581{582 echo “checked=’checked’";583}584?> class="tog” type="radio"></label>585<br/>586<label>2<input name="columns" value="2" <?php587if(get_option(‘FollowMe_Columns’) != ‘1’)588{589 echo “checked=’checked’";590}591?> class="tog” type="radio"></label>592<strong>Window Alignment:</strong>593<table border="0" style="border-collapse: collapse" class="form-table" width="800px">594 <tbody>595 <tr>596 <th width="224" align="left"><label>597 <input name="layout" value="true" <?php598if(get_option(‘FollowMe_Layout’) == ‘true’)599{600 echo “checked=’checked’";601}602?> class="tog” type="radio">603 Open to the left:</label></th>604 <td width="566"><img src=" 605<?php echo $pluginpath; ?>/images/left-right.png"/></td>606 </tr>607 <tr>608 <th align="left"><label>609 <input name="layout" value="false" class="tog" <?php610if(get_option(‘FollowMe_Layout’) == ‘false’)611{612 echo “checked=’checked’";613}614?> type="radio">615 Open to the right:</label></th>616 <td><img src=” 617<?php echo $pluginpath; ?>/images/right-left.png"/></td>618 </tr>619 </tbody>620</table>621<p> </p>622</div>623</div>624</div>625<p class="submit">626<input type="submit" class="button-primary" name="Submit" value="<?php _e(‘Save Changes’) ?>" />627</p>628</form>629</div> 630</div>631</div>632</div>633</div>634</div>635</div>636</div>637638639640</div>641<?php 642}643644function widget_FollowMeIgniteSocialMedia_control()645{646?>647<div style="text-align:left">648To edit the options for this widget, please visit the <a href="options-general.php?page=fmoptions">Follow Me Settings Page</a>.649</div>650<?php651}652653/* CALL OPTIONS PAGE */654655function FollowMeIgniteSocialMedia_add_pages()656{657$mypage = add_options_page('Follow Me Options’, 'Follow Me Options’, 8, 'fmoptions’, ‘FollowMeIgniteSocialMedia_options_page’);658add_action( "admin_print_scripts-$mypage", ‘FollowMe_admin_head’ );659}660function FollowMe_admin_head() {661 $pluginpath = WP_PLUGIN_URL.’/’.str_replace(basename( __FILE__),"",plugin_basename(__FILE__)); 662 wp_enqueue_script(‘loadjs’, $pluginpath . ‘js/expand.js’);663 echo "<script type=’text/javascript’ src=’".$pluginpath."js/jquery.js’></script>";664}665666667/* CALL SIDE BAR WIDGET */668function widget_FollowMeIgniteSocialMedia()669{670 FollowMeSocialMedia();671}672function FollowMeIgniteSocialMedia_init()673{674 register_sidebar_widget(__(‘Follow Me’), ‘widget_FollowMeIgniteSocialMedia’);675 register_widget_control('Follow Me’, ‘widget_FollowMeIgniteSocialMedia_control’);676}677678/* HOOK IT IN */679680681add_action('wp_head’, ‘FollowMe_Scripts’);682add_action('wp_footer’, ‘FollowMe_Bubble’);683add_action('plugins_loaded’, ‘FollowMeIgniteSocialMedia_init’);684add_action('admin_menu’, ‘FollowMeIgniteSocialMedia_add_pages’);685?>

Related news

CVE-2022-4213: Vulnerability Advisories Continued - Wordfence

The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dn' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVE-2022-4029: Vulnerability Advisories Continued - Wordfence

The Simple:Press plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sforum_[md5 hash of the WordPress URL]' cookie value in versions up to, and including, 6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This would be highly complex to exploit as it would require the attacker to set the cookie a cookie for the targeted user.

CVE-2022-3896: Vulnerability Advisories Continued - Wordfence

The WP Affiliate Platform plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_SERVER["REQUEST_URI"] in versions up to, and including, 6.3.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is unlikely to work in modern browsers.

CVE-2022-3897: Vulnerability Advisories Continued - Wordfence

The WP Affiliate Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 6.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2022-4027: Vulnerability Advisories Continued - Wordfence

The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipulated during a forum response in versions up to, and including, 6.8 due to insufficient input sanitization and output escaping that makes injecting object and embed tags possible. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages when responding to forum threads that will execute whenever a user accesses an injected page.

CVE-2022-4028: Vulnerability Advisories Continued - Wordfence

The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipulated during the profile-save action when modifying a profile signature in versions up to, and including, 6.8 due to insufficient input sanitization and output escaping that makes injecting object and embed tags possible. This makes it possible for authenticated attackers, with minimal permissions, such as a subscriber to inject arbitrary web scripts in pages when modifying a profile signature that will execute whenever a user accesses an injected page.

CVE-2022-4034: Vulnerability Advisories Continued - Wordfence

The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it possible for unauthenticated attackers to embed untrusted input into content during booking creation that may be exported as a CSV file when a site's administrator exports booking details. This can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

CVE-2022-4036: Vulnerability Advisories Continued - Wordfence

The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.72. This is due to the use of insufficiently strong hashing algorithm on the CAPTCHA secret that is also displayed to the user via a cookie.

CVE-2022-4032: Vulnerability Advisories Continued - Wordfence

The Quiz and Survey Master plugin for WordPress is vulnerable to iFrame Injection via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input sanitization and output escaping that allowed iframe tags to be injected. This makes it possible for unauthenticated attackers to inject iFrames in pages that will execute whenever a user accesses an injected page.

CVE-2022-4033: Vulnerability Advisories Continued - Wordfence

The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input validation that allows attackers to inject content other than the specified value (i.e. a number, file path, etc..). This makes it possible attackers to submit values other than the intended input type.

CVE-2022-4035: Vulnerability Advisories Continued - Wordfence

The Appointment Hour Booking plugin for WordPress is vulnerable to iFrame Injection via the ‘email’ or general field parameters in versions up to, and including, 1.3.72 due to insufficient input sanitization and output escaping that makes injecting iFrame tags possible. This makes it possible for unauthenticated attackers to inject iFrames when submitting a booking that will execute whenever a user accesses the injected booking details page.

CVE-2022-4169: Vulnerability Advisories Continued - Wordfence

The Theme and plugin translation for Polylang is vulnerable to authorization bypass in versions up to, and including, 3.2.16 due to missing capability checks in the process_polylang_theme_translation_wp_loaded() function. This makes it possible for unauthenticated attackers to update plugin and theme translation settings and to import translation strings.

CVE-2022-3861: Vulnerability Advisories Continued - Wordfence

The Betheme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 26.5.1.4 via deserialization of untrusted input supplied via the import, mfn-items-import-page, and mfn-items-import parameters passed through the mfn_builder_import, mfn_builder_import_page, importdata, importsinglepage, and importfromclipboard functions. This makes it possible for authenticated attackers, with contributor level permissions and above to inject a PHP Object. The additional presence of a POP chain would make it possible for attackers to execute code, retrieve sensitive data, delete files, etc..

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907