The cf7-invisible-recaptcha plugin before 1.3.2 for WordPress has XSS.

*   Details
*   Reviews
*   Installation
*   Development

CF7 Invisible reCAPTCHA plugin is an effective solution that secures your Contact form 7 forms on WordPress websites from spam entries while letting human pass over easily.

Just a single click they’ll confirm they are not a robot.

Activated only in cases where Google suspects that the visitor is not a human.

This plugin utilizes the popular anti-spam library, Google invisible reCAPTCHA, to help your blog stay clear of spams.

All it takes is 2 easy step to make your website stand out from rest of your competitors.

1.  Install the plugin.
2.  Add site and secret key.

It’s easy to use.

Read **How to use?** section to find out more about the CF7 Invisible reCAPTCHA configurations

**Need Support?** wp.support@vsourz.com

**Features**

*   Protection against disabled JavaScript from the browser.
*   Easy and simple settings for quick setup without a change in code.
*   Option to **Enable/Disable Protection** for Contact Form 7.
*   Easy to **Exclude** Invisible reCAPTCHA for the particular form.
*   Option to **Show/Hide** Google reCaptcha Badge.
*   Easy to Manage **Badge Position**.
*   Easy to validate your **Site Key** and **Secret key** from CF7 Invisible reCAPTCHA menu.

**How to use?**

1.  Install Plugin via WordPress Admin – Go to Admin > Plugins > Add New.
2.  Add CF7 Invisible reCAPTCHA Go To CF7 Invisible reCAPTCHA.
3.  Enable Protection for Contact Form 7.
4.  Add Site Key and Secret Key.
5.  Validate Site Key and Secret Key.

**License**

GPLv2 – https://www.gnu.org/licenses/gpl-2.0.html

**Install via WordPress Admin**

1.  Ready the zip file of the plugin
2.  Go to Admin > Plugins > Add New
3.  On the upper portion click the Upload link
4.  Using the file upload field, upload the plugin zip file here and activate the plugin

**Install via FTP**

1.  First, unzip the plugin file
2.  Using FTP go to your server’s wp-content/plugins directory
3.  Upload the unzipped plugin here
4.  Once finished login into your WP Admin and go to Admin > Plugins
5.  Look for CF7 Invisible reCAPTCHA and activate it

**Usage**

1.  Add site and secret key

**Can I Add Invisible reCAPTCHA in more than one form on the same page?**

Yes.

**Can I remove Invisible reCAPTCHA in particular form?**

Yes, we have provided exclude functionality to remove invisible reCAPTCHA in particular form.

**Can I Enable/Disable Invisible reCAPTCHA Protection for Contact Form 7?**

Yes, we have provided functionality to Enable/Disable Invisible reCAPTCHA Protection for all Contact Form.

**What to do if CF7 Invisible reCAPTCHA plugin not work?**

If the plugin does not work on the website, contact our Support Team via following email address: wp.support@vsourz.com.  
If you think, that you found a bug in our CF7 Invisible reCAPTCHA plugin or have any question contact us at wp.support@vsourz.com. Our support team will solve within 24 hours.

Does not work with the latest version of Contact form 7!

Good plugin if need to install Recaptcha for a contact form with the custom position.

Great plugin but it has stopped working for me and is in conflict with Contact Form 7. It's stuck at the spinning wheel after pressing submit button of Contact Form 7. Nothing happens. Please fix asap. WP v4.9.8 This Plugin v1.3.3

Simple plugin, one click to protect all the forms at once. You can exclude certain forms if needed.

The plugin overwrites standard CF7 validation, so I can't use it. Why is that?

Semplicemente non funziona e rompe il form rendendolo inutilizzabile. È molto meglio "Invisible reCaptcha for WordPress" di Mihai Chelaru.

Read all 13 reviews

“CF7 Invisible reCAPTCHA” is open source software. The following people have contributed to this plugin.

Contributors

*    Vsourz Digital

**1.3.3**

*   Optimised the JS code in header.
*   Add class option given for submit button.

**1.3.2**

*   **Minor bug fix:** Security against cross-site scripting (XSS) vulnerability.

**1.3.1**

*   **Minor bug fix:** Resolved the caching issue.

**1.3.0**

*   **Protect form against disabled javascript:** Added script to protect form against disabled javascript from the browser.
*   **Restrict spam entries:** Added script to restrict spam entries to the contact form.

**1.2.1**

*   **Minor tweak related to JavaScript**: Fix issue related to not get any action on click on form submit.

**1.2.0**

*   **Repositioning**: We have set the ‘CF7 Invisible reCAPTCHA’ menu under Contact Form menu.
*   **Validate Credentials**: You can validate your Site Key and Secret Key into ‘CF7 Invisible reCAPTCHA’ menu.

**1.1.0**

*   Fix drop down issue.

**1.0.0**

*   Initial

CVE-2018-21012: CF7 Invisible reCAPTCHA

CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the "All Post> Ticketed > Attendees" Export Attendees feature.

*   Details
*   Reviews
*   Installation
*   Development

Sell tickets and collect RSVPs with the free Event Tickets plugin, from the team behind the number one calendar in WordPress.

This plugin makes it easy to sell tickets, collect registrations, and manage attendees for your in-person or virtual events. Plus, it comes with features backed by our world-class team of developers and designers. Easily integrate Event Tickets with your Stripe account or PayPal business account.

Connect to Stripe and take advantage of one of the world’s most popular payment gateways. Our Stripe integration lets you accept credit card payments on your website, along with additional payment methods including AfterPay, ClearPay, AliPay, Giropay, and Klarna.

See more videos on our YouTube channel

Easily connect to PayPal without any complicated API keys or code through our quick connection wizard in your WordPress backend. With just a few clicks, you can begin selling tickets and enable payment through PayPal, Venmo, and credit cards.

Even more, you can upgrade to Event Tickets Plus and unlock additional payment methods including digital wallets like ApplePay and Google Pay through Stripe, or use WooCommerce to take advantage of popular payment solutions including Braintree, Square, AmazonPay, and more.

**🎟️ Ticketing and Registration for WordPress**

See Event Tickets in action on our demo site. Just getting started? Check out the Getting Started Guide for an introduction to features, settings, and functionality.

Looking for additional features like custom registration fields, QR check-in, Zoom integration, and more? **Check out Event Tickets Plus and our other add-ons**.

**🔌🎨 Plug and Play or Customize**

Event Tickets is built to work out of the box. Just install the plugin, configure your settings, and start collecting RSVPs and selling tickets in minutes.

Add your own touch by using Event Tickets as the foundation for customization. Personalize to your heart’s content with the help of a skeleton stylesheet, partial template overrides, template tags, hooks and filters, careful documentation, and a library of free extensions.

Whether your vision is big or small, you’re in good company. Thousands of small businesses, musicians, venues, restaurants, and non-profits are increasing revenue from their in-person and virtual events with Event Tickets. Our plugins have also been scaled to work on large networks for Fortune 100 companies, universities, and government institutions.

**✨ Features**

✔️ Attendees can purchase tickets to events  
✔️ Attendees can RSVP to events  
✔️ Sell tickets with PayPal and/or Stripe using our free commerce solution, Tickets Commerce.  
✔️ Add RSVPs and tickets to posts, pages, or custom post types  
✔️ Collect ticket fees by connecting your PayPal business or Stripe account  
✔️ Generate sales and attendee reports  
✔️ Ticket stock countdown  
✔️ Automatic ticket confirmation emails  
✔️ Works out of the box with The Events Calendar  
✔️ Responsive design works on all devices  
✔️ Tested on the major theme frameworks such as Avada, Genesis, Kadence, Thesis and many more.  
✔️ Internationalized & translated  
✔️ Extensive template tags for customization  
✔️ Hooks & filters galore  
✔️ Library of extensions

Upgrade to Event Tickets Plus for full WooCommerce integration to use additional payment gateways.

**📃 Documentation**

All of our documentation can be found in our knowledgebase.

Additional helpful links:

*   Guide: Getting Started with Event Tickets
*   Installing Event Tickets Video
*   Using Tickets Commerce Video
*   Do I need Event Tickets or Event Tickets Plus?
*   How to Make Money with Virtual Events
*   Implementing Stripe on Event Tickets and Event Tickets Plus

If you have any questions about this plugin, you can post a thread in the WordPress.org forum. Please search existing threads before starting a new on

**➕ Add-Ons**

Take your calendar to the next level by pairing it with our plugins for ticketing, crowdsourcing, email marketing, and more. Learn more about all our products on our website.  
Our Free Plugins:  
📅 The Events Calendar  
📐 Advanced Post Manager

Our Premium Plugins and Services:

⚡ Events Calendar Pro  
↪️ Event Aggregator (service)  
🎟️ Event Tickets Plus  
✉️ Promoter  
👥 Community Events  
🎟️ Community Tickets  
✏️ Filter Bar  
🗓️ Eventbrite Tickets  
📡 Virtual Events

**Help**

If you aren’t familiar with Event Tickets, check out our Getting Started Guide. It will have you creating tickets in no time.

Ready to dig deeper? Check out these resources:

*   Tutorials
*   Known Issues
*   Help Videos
*   Release Notes

We check in on the Event Tickets forum here on WordPress.org about once a week to help users with basic troubleshooting and identifying bugs. If you’re looking for premium, personalized support, consider upgrading to Event Tickets Plus.

Still have a question? Shoot us an email at support@theeventscalendar.com.

**Translate**

Event Tickets is translated into multiple languages, including German, Danish, and Dutch. Help localize Event Tickets even further by adding your locale – visit translate.wordpress.org.

1.  From the dashboard of your site, navigate to Plugins –> Add New.
2.  Select the Upload option and hit “Choose File.”
3.  When the popup appears select the event-tickets.x.x.zip file from your desktop. (The ‘x.x’ will change depending on the current version number).
4.  Follow the on-screen instructions and wait as the upload completes.
5.  When it’s finished, activate the plugin via the prompt. A message will show confirming activation was successful.
6.  For access to new updates, make sure you have added your valid License Key under Tickets –> Settings –> Licenses.

**Are there any troubleshooting steps I should try before I post a new thread in the support forum?**

First, make sure that you’re running the latest version of Event Tickets. If you’ve got any other add-ons, make sure those are current and running the latest code as well. Also be sure to check our knowledgebase.

The most common issues we see are either plugin or theme conflicts. You can test if a plugin or theme is conflicting by manually deactivating other plugins until just Event Tickets is running on your site. If the issue persists, revert to the default Twenty Twenty theme. If the issue is resolved after deactivating a specific plugin or your theme, you’ll know that is the source of the conflict.

Note that we aren’t going to say “tough luck” if you identify a plugin/theme conflict. While we can’t guarantee 100% integration with any plugin or theme out there, we will do our best (and reach out the plugin/theme author as needed) to figure out a solution that benefits everyone.

**I’m still stuck. Where do I go to file a bug or ask a question?**

Free plugin users can post in the Event Tickets support forum on WordPress.org. Our team reviews that forum weekly to look for bug reports.

If you’re already an Event Tickets Plus subscriber, you’re entitled to our actively-monitored Premium Support on our website. Generally, except in times of increased support loads, we reply to all premium support tickets within 24 hours during the business week.

**What’s the difference between Event Tickets and Events Tickets Plus?**

Event Tickets is our free ticketing plugin that has all the basics you need to sell tickets and collect RSVPs on your website. You can use Event Tickets with or without The Events Calendar.

Event Tickets Plus is a premium plugin that runs alongside Event Tickets and enhances it with extra features, including custom registration fields, shortcodes, WooCommerce integration, enhanced Stripe functionality for Stripe for Tickets Commerce, our mobile ticketing app and more.

Read more to learn which plugin is right for you.

**Do I need The Events Calendar to run Event Tickets?**

Nope! Event Tickets works with or without The Events Calendar. Even if you don’t have The Events Calendar, you can create RSVPs and tickets on WordPress pages and posts.

**Can I email attendees using Event Tickets?**

Yes. Event Tickets automatically sends an email confirmation after attendees register or RSVP for an event. If the attendee purchases a ticket, the confirmation email will also provide a ticket to scan at the door for admission.

**What add-ons are available for Event Tickets, and where can I read more about them?**

The following add-ons are available for The Events Calendar:

*   Events Calendar Pro, for adding premium calendar features like recurring events, advanced views, cool widgets, shortcodes, additional fields, and more!
*   Event Aggregator, a service that effortlessly fills your calendar with events from Meetup, Google Calendar, iCalendar, Eventbrite, CSV, and ICS.
*   Virtual Events, which optimizes your calendar for virtual events including Zoom integration, video and livestream embeds, SEO optimization for online events and more.
*   Event Tickets Plus, which allows you to sell tickets for your events using your favorite e-commerce platform.
*   Promoter, automated email communication made just for The Events Calendar and Event Tickets. Stay in touch with your attendees every step of the way.
*   Community Events, for allowing frontend event submission from your readers.
*   Community Tickets, which allows event organizers to sell tickets to the events they submit via Community Events.
*   Filter Bar, for adding advanced frontend filtering capabilities to your events calendar.
*   Eventbrite Tickets, for selling tickets to your event directly through Eventbrite.

**I have a feature idea. What’s the best way to tell you about it?**

We’ve got a LoopedIn page where we’re actively watching for feature ideas from the community. Vote up existing feature requests or add your own, and help us shape the future of the products business in a way that best meets the community’s needs.

**I’ve still got questions. Where can I find answers?**

Check out our extensive knowledgebase for articles on using, tweaking, and troubleshooting our plugins.

Both my client and myself are very disappointed with the modernization process of TEC + Tickets Pro to the Block Editor. Every step has been painful for over 6 months. We’ll be replacing this with a competing plugin.

Email support was good. Apart from referring to the manuals, as they should, they still investigated further and gave us a solution for our problem. Well done!

So many bug when it comes to payment and support is so so so slow. I am losing sales because to this. Using Stripe: Apple pay freezes No Way to turn off Apple Pay, turning it off doesnt save Can't validate webhook Support keeps asking me to create a staging to test, sure, but they take a week to reply. Some support staff even told me they have no experience with apple pay and it is not their feature, i mean...come on...its right there in your setting

Followed the documentation, but cannot get Stripe to validate webhook. Read other support threads and have confirmed that everything is in order as per the documentation. I was testing out the plugin, but given the time wasted, there is no way I will continue to use it to sell tickets if the free version which includes a 2% fee doesn't work, why would I bother upgrading to the premium version. Seem to much of a risk. Also, looking at people comments, it seems support is slow (they are constantly away from the office/out of the office. Look at other plugins out there.

Constant issues. Nearly impossible to make work. Stops working for no apparent reason. I make websites, used probably hundreds of different plugins over the years. This is in the top 5 worst. There is an easy/user friendly way to do things. This plugin does the opposite in nearly every avenue.

Despite having over 18 months of warning from EDD that their plugin needed updating, they have failed to make any progress whatsoever. They use incompatible, depreciated methods which means tickets sold do not have the attendees details saved, just the purchaser. If I could give this negative stars, I would.

Read all 130 reviews

“Event Tickets and Registration” is open source software. The following people have contributed to this plugin.

Contributors

**\[5.5.8\] 2023-02-22**

*   Version – Event Tickets 5.5.8 is only compatible with The Events Calendar 6.0.10 and higher.
*   Version – Event Tickets 5.5.8 is only compatible with Event Tickets Plus 5.6.7 and higher.
*   Tweak – PHP version compatibility bumped to PHP 7.4
*   Tweak – Version Composer updated to 2
*   Tweak – Version Node updated to 18.13.0
*   Tweak – Version NPM update to 8.19.3
*   Tweak – Reduce JavaScript bundle sizes for Blocks editor

**\[5.5.7\] 2023-02-09**

*   Enhancement – Added currency format options to alter currency decimal separator, thousand separator, and number of decimal places. \[ET-1608\]
*   Tweak – Updated Currency options in Tickets Commerce settings for Croatian users from Kuna (HRK) to Euro (EUR). \[ET-1625\]
*   Tweak – Updated Attendee Registration Fields upsell notice to only display in admin dashboard. \[CT-67\]
*   Fix – Resolve provisional IDs properly on the event edit screen for ticket management actions. \[ET-1632\]
*   Fix – Fixed Ticket Commerce cart cookies not getting saved. \[ET-1629\]
*   Language – 28 new strings added, 189 updated, 5 fuzzied, and 3 obsoleted

**\[5.5.6\] 2023-01-16**

*   Tweak – Updated the settings description for stock handling options. \[ET-1603\]
*   Tweak – Added the tribe-tickets__tickets-item--shared-capacity wrapper class for tickets having shared capacity. \[ETP-841\]
*   Tweak – Added a dashboard notice for sites running PHP versions lower than 7.4 to alert them that the minimum version of PHP is changing to 7.4 in February 2023.
*   Enhancement – Added search capabilities to the Tickets Commerce Orders report page. \[ET-1259\]
*   Fix – Allow loading attendance page with event_id params that use The Events Calendar provisional IDs. \[ET-1624\]
*   Language – 4 new strings added, 43 updated, 0 fuzzied, and 2 obsoleted

**\[5.5.5\] 2022-12-08**

*   Fix – Remove need for Platform Controls to verify webhook signatures in Stripe. \[ET-1508\]
*   Fix – Fixed the order of tickets in an event changing when you haven’t manually requested it. \[ET-1568\]
*   Fix – Fixed shared capacity tickets only showing the lowest capacity between the shared pool tickets. \[ETP-815\]
*   Tweak – Removed locale param for Tickets Commerce JS SDK as per PayPal recommendation. \[ET-1615\]
*   Language – 110 new strings added, 193 updated, 5 fuzzied, and 24 obsoleted

**\[5.5.4\] 2022-11-09**

*   Fix – Fixes multiple of the same ticket form being on the same page being out of sync. \[GTRIA-729\]
*   Fix – Added a JS event that checks for attendee label validation if ET+ is active. \[ETP-803\]

**\[5.5.3\] 2022-10-31**

*   Fix – Orderby param not working for Attendee archive REST API. \[ET-1591\]
*   Fix – Properly save the check-in details for attendees on check-in. \[ETP-819\]
*   Fix – TicketsCommerce ticketed events not showing up for Events REST API. \[ET-1567\]
*   Fix – Update version of Firebase/JWT in Common from 5.x to 6.3.0
*   Enhancement – Added support for name and email param for searching in Attendee archive REST API. \[ET-1591\]
*   Enhancement – Add template tag to properly check if The Events Calendar is active. \[ETP-820\]
*   Enhancement – Add attendance information to the events REST API endpoint. \[ET-1580\]
*   Enhancement – Add check_in argument support for attendees REST API endpoint. \[ET-1588\]
*   Language – 0 new strings added, 18 updated, 0 fuzzied, and 0 obsoleted

**\[5.5.2\] 2022-10-20**

*   Fix – Update version of Firebase/JWT in Common from 5.x to 6.3.0

**\[5.5.1\] 2022-09-22**

*   Fix – Listing tickets is no longer limited by the global settings. \[ET-1584\]
*   Fix – Correct parameter type hinting when param can be null. \[ET-1582\]
*   Fix – Showing Checkout not available and credit card fields at the same time for PayPal gateway in TicketsCommerce. \[ETP-812\]
*   Language – 0 new strings added, 1 updated, 0 fuzzied, and 0 obsoleted

**\[5.5.0\] 2022-09-06**

*   Version – Event Tickets 5.5.0 is only compatible with The Events Calendar 6.0.0 and higher.
*   Version – Event Tickets 5.5.0 is only compatible with Event Tickets Plus 5.6.0 and higher.
*   Enhancement – Adds a compatibility layer to work with the new Recurrence Backend Engine in TEC/ECP.
*   Language – 4 new strings added, 49 updated, 0 fuzzied, and 3 obsoleted

See changelog for all versions

CVE-2019-16120: Event Tickets and Registration

SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries.php album_id parameter.

CVE-2019-16119

Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php.

CVE-2019-16118

Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php.

CVE-2019-16117

The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789.

*   Details
*   Reviews
*   Installation
*   Development

Allows users to replace the default 404 page with a custom page from the Pages section in the Admin Panel. Or you can specify a complete URL to redirect on 404.

**Important Note**

Please open issues on Github. I will not be using the WordPress.org support area.

**Features**

*   Full 404 Page Control
*   Record 404 Page Data
*   Custom Page Redirect
*   Custom URL Redirect

**How does it work?**

*   WordPress Page: Choose a custom page from the Admin Panel
*   URL: Enter a custom URL for 404
*   Stats: List of all 404s

*   Extract the downloaded ZIP file.
*   Copy the custom-404-pro folder to the wp-content/plugins directory.
*   Activate from the Plugins Section.

**Why is the 404 custom redirect not working?**

Some users have reported an issue with the Divi theme where the 404 redirect does not work. In such cases, please disable the Divi theme and try again. It’s usually a good practice to start disabling themes/plugins one by one and work your way backward to see what might be causing the issue.

**Why are my plugin preferences not being saved?**

Uninstall the plugin from the Plugins page (important!) and reinstall it. Never remove plugin folders directly from your WordPress installation as this DOES NOT cleanup plugin database tables.

Thank you so much for this brilliant plugin. I am not technically confident, cannot do much by way of coding and get overwhelmed with geek speak. I downloaded this plugin after trying (and failing with) another, and within 10 minutes had my custom 404 page up and running. This has saved me time, energy and stress. Thank you so much. I have just donated something small too to support you in your work and creativity.

На мой взгляд, это лучшее и простое дополнение для перенаправления! Перенаправляет даже с «закрытой страницы» ?author=1 что другие подобные дополнения делать не могут. Молодец.

ignore this, wrong plugin.

This plugin was working great for us until we adjust the settings to start logging the 404 pages. Then, the custom page we selected in Wordpress for the 404 to route to stops working. Is this a known bug?

Works simple and fine! Congratulations!

Gets the job done in seconds. Super easy to use!

Read all 22 reviews

“Custom 404 Pro” is open source software. The following people have contributed to this plugin.

Contributors

*    Kunal

**3.9.0**

*   Support WordPress 6.3

**3.8.2**

*   Fix logs vuln

**3.8.1**

*   Fix Search vuln

**3.8.0**

*   Support WordPress 6.2

**3.7.4**

*   Fix SQL injection

**3.7.3**

*   Fix vulnerabilities

**3.7.2**

*   Fix CSRF vulnerability in Logs table

**3.7.1**

*   Fix path vulnerability

**3.7.0**

*   Support WordPress 6.1

**3.6.0**

*   Support WordPress 6.0

**3.5.0**

*   Support WordPress 5.9

**3.4.0**

*   Support WordPress 5.8

**3.3.0**

*   Add Multisite Support

**3.2.21**

*   Support WordPress 5.7

**3.2.20**

*   Support WordPress 5.6

**3.2.19**

*   Support WordPress 5.5

**3.2.18**

*   Integrate GitHub actions

**3.2.17**

*   Bump version to support 5.4

**3.2.16**

*   Bump version to support 5.3.2

**3.2.15**

*   Bump version to support 5.3.1

**3.2.14**

*   Update Readme to include FAQ

**3.2.13**

*   Remove upgrader script

**3.2.12**

*   Updates + Remove Migrate & Reset Tabs

**3.2.11**

*   Fix Redirect Bug

**3.2.10**

*   More updates and fixes

**3.2.9**

*   Fix Reflected XSS in other places according to the WordPress Plugin Notice

**3.2.8**

*   Fix Reflected XSS

**3.2.7**

*   Version Bump to support WordPress 5.2

**3.2.6**

*   Follow WordPress Coding Standards

**3.2.5**

*   Update from v2 to v3 for all users

**3.2.4**

*   Error Logging

**3.2.3**

*   \[BUGFIX\] Migrate logs changed to 500

**3.2.2**

*   \[NEW\] Migrate Tab: Migrate Logs from Plugin version < 3.0.0 to the new logging system
*   \[BUGFIX\] Typo in Reset Tab when deleting old logs

**3.2.1**

*   \[NEW\] Bulk Action: Delete All Logs now available

**3.2.0**

*   Exports Logs as CSV
*   Better model for showing Admin Notices
*   Validating URL (required and structure) when URL mode chosen for redirection
*   General cleanup

**3.1.1**

*   Fix Log IP default setting

**3.1.0**

*   Logging IP is now optional

**3.0.5**

*   Fix Upgrader function bug

**3.0.4**

*   Fix Settings not saving Bug

**3.0.3**

*   Fix Uninstall Bug

**3.0.2**

*   Streamlining the upgrade process

**3.0.0**

*   Complete re-write from the ground-up with a new logging mechanism and better base for future development

**2.1.1**

*   Add Referer so users know where the 404 came from

**2.1.0**

*   Cleanup on uninstall
*   Email blog title
*   Fix unnecessary CSS and JS loading

**2.0.3**

*   Disable logging by default

**2.0.2**

*   Fixed Donate Links

**2.0.1**

*   Small bugfix while clearing logs

**2.0.0**

*   Better feedback while Clearing Logs
*   Added 404 Option to Log Type

**1.4.0**

*   Option to Clear Logs
*   Option to Stop Logging

**1.3.12**

*   Fixed github issue #3

**1.3.10**

*   Fixed some bugs

**1.3.9**

*   Redefined Log Filters with User Agent API

**1.3.8**

*   Added User Agent Filter

**1.3.0**

*   Changed entire plugin to a Custom Post Type Layout
*   More structure to the plugin, better code

**1.0.0**

*   Initial Release

CVE-2019-15838: Custom 404 Pro

The rsvpmaker plugin before 6.2 for WordPress has SQL injection.

CVE-2019-15646: RSVPMaker

The rsvpmaker plugin before 5.6.4 for WordPress has SQL injection.

CVE-2018-21004

The ad-inserter plugin before 2.4.20 for WordPress has path traversal.

CVE-2019-15323: Ad Inserter – Ad Manager & AdSense Ads

The give plugin before 2.4.7 for WordPress has XSS via a donor name.

**Exploitation Level:** Medium / Remote

**DREAD Score:** 6.6

**Vulnerability:** Stored XSS on an administrative page

**Patched Version:** 2.4.7

​​Give is a WordPress plugin which allows users to setup a donation page on a website. It currently has 60k installs.

​​During a recent audit of the plugin, we found a severe vulnerability which allows donors to inject arbitrary code on an administrative page.

​​If you are using a version lower than **2.4.7,** you should update immediately.

> Note: A forced update was pushed by the developers, and all affected users should now be patched and protected against this vulnerability.

​​When creating a donation, all of the arguments are sanitized as text fields, but this method does not take into consideration where the variables are reflected. Thanks to this oversight, a malicious user can still perform an injection on the donors page after making a donation.

​​Due to the reflection point, the injection can only be seen by users with sufficient permissions to see the donors — this means that a malicious script could do a lot of damage while acting as these users.

****​​Timeline****

*   ​​**2019-05-03**: Initial disclosure to Give
*   ​​**2019-05-07**: Partial patch released (2.4.6)
*   ​​**2019-05-10**: Notified vendor of possible bypasses
*   ​​**2019-05-14**: Complete patch released (2.4.7)
*   **2019-05-21**: Patch pushed to all customers via auto-update

****​​Technical Details****

​​When processing a donation, the plugin recursively sanitizes every POSTed variable using the sanitize\_text\_field method.

​​The function handling the donation form

​​The function recursively cleaning text fields

​​Under this plugin, a **Donation** uses multiple data structures:

*   ​​**Donation**, which contains the donation content itself.

*   **Donor**, which contains the data related to the user performing the donation.

​​​​If the user performing the donation is a guest, meaning this is the first donation using this email, a new donor will be created with the provided information.

​​Donor creation

​​Under the admin panel, you can see either one of the two created entities by the donation: The **Donors** and The **Donations**.

​​Both of these pages are tables where we can see, filter, and modify the data. On the Donors table, few custom attributes are added on tags to facilitate the website interactivity. Among these is the _data-name_ attribute, which has the donor name value. As you can see on the donor creation code, this value is the full name of the donor. This attribute is used on two tags: The row tag and the column checkbox input.

​​The code can be found under _class-donor-table.php:_

​​Injection on the table row tag

​​Injection on the column checkbox

​​The name of our user was sanitized using the _sanitize\_text\_field_ method, which performs the following actions per the WordPress documentation:

*   ​​Checks for invalid UTF-8

*   ​​Converts single < characters to entities

*   ​​Strips all tags

*   ​​Removes line breaks, tabs, and extra whitespace

*   ​​Strips octets

​​You might notice it removes the **_tags_**, but it does not mention being safe as **_attribute._** ​​With that in mind, it is possible to escape the _data-name_ attribute and add an event on the input.

​Having the following name:

_Name " onfocus="alert(document.domain)" autofocus="_

gives us the following HTML on the input injection:

_<input class="donor-selector" type="checkbox" name="donor\[\]" value="1"_ 

  _data-name="Name_ **_"_** 

  **_onfocus="alert(document.domain)"_** 

  **_autofocus=""_** _/>_

Using the autofocus attributes will trigger the onfocus event without user interaction, which can execute malicious code.

**Conclusion**

Cross-site scripting (XSS) is a widespread vulnerability that allows an attacker to inject malicious content into a site.

In the case of Stored XSS (as seen with this particular vulnerability), the payload is stored in the site’s database and retrieved with every page request. If left unpatched, it can be very dangerous, as an attacker acting as a donor can obtain complete control of the browser environment.

To protect against this vulnerability, we strongly encourage **Give** users to update to **version 2.4.7** as soon as possible. In the event that you can’t immediately update your plugin, you can leverage the Sucuri Firewall or equivalent technology to virtually patch the vulnerability.

Antony Garand is Sucuri's Threat Researcher who joined the company in 2019. Antony's main responsibilities include researching vulnerabilities and dissecting malware. His professional experience covers many years of security research and development. When Antony isn't breaking stuff, you might find him at the dog park or learning new skills. Connect with him on Twitter

**Reader Interactions**

Tag

#wordpress