View All Posts Page Plugin view-all-posts-pages.php action_admin_notices_activation cross site scripting

An attacker can exploit this vulnerability by manipulating the URL to inject malicious scripts. The vulnerability lies within the `action_admin_notices_activation` function in the `view-all-posts-pages.php` file. By crafting a specific URL, an attacker can trigger the cross-site scripting flaw, potentially leading to unauthorized actions or information disclosure. The attack can be initiated remotely, requiring no special privileges beyond the ability to send a crafted URL to a user or the server. [ref_id=1]

The vulnerability is located in the `action_admin_notices_activation` function within the file `view-all-posts-pages.php`. The specific lines affected involve the use of `admin_url( add_query_arg( $this->notice_key, 1, 'index.php' ) )`, where the output was not properly escaped. The patch modifies these lines to use `esc_url( admin_url( add_query_arg( $this->notice_key, 1, 'index.php' ) ) )`. [patch_id=4375436]

The patch addresses the vulnerability by correctly escaping the URL arguments passed to `admin_url()` within the `action_admin_notices_activation` function. Specifically, the `add_query_arg()` function's output is now properly sanitized using `esc_url()`. This prevents the injection of malicious script payloads into the URL, thereby mitigating the cross-site scripting risk. The change ensures that user-supplied data within query arguments does not lead to unintended script execution. [patch_id=4375436]