Mykyta Synelnikov 302731f252 Fix: Address CVE-2025-13217 and improve input sanitization ...

Resolved CVE-2025-13217 by implementing proper input sanitization and escaping for iframe URLs in YouTube, Vimeo, and Google Maps embeds. This update ensures safer handling of user-provided links to mitigate potential security vulnerabilities.

2025-12-05 17:56:45 +02:00

..

rest

* fixed CVE-2024-12276;

2025-02-03 16:17:37 +02:00

class-access.php

* fixed CVE-2024-12276;

2025-02-03 16:17:37 +02:00

class-account.php

- fix change email permissions

2025-04-30 12:02:03 +03:00

class-ajax-common.php

* maybe fixed CVE-2024-10528;

2024-11-05 11:55:07 +02:00

class-blocks.php

- fix restrictions for all blocks

2025-06-19 15:30:30 +03:00

class-builtin.php

- fix country name

2025-06-18 11:11:09 +03:00

class-cron.php

Fix invalid 'start_of_week' handling in weekly events logic

2025-09-05 15:24:28 +03:00

class-date-time.php

- finally reviewed #1361;

2023-12-01 12:50:13 +02:00

class-external-integrations.php

- fixed using esc_attr() in href="" attributes;

2024-03-27 11:06:02 +02:00

class-fields.php

- allow webp image format

2025-09-22 12:48:39 +03:00

class-files.php

- allow webp image format

2025-09-22 12:48:39 +03:00

class-fonticons.php

- FontIcons libraries moving to legacy;

2023-09-26 12:25:49 +03:00

class-form.php

Prevent shortcode execution in user input sanitization.

2025-06-24 17:16:28 +03:00

class-gdpr.php

- partially reviewed #1361;

2023-11-30 10:55:00 +02:00

class-login.php

- updated hookdocs;

2023-07-18 12:06:17 +03:00

class-logout.php

- updated hookdocs;

2023-07-18 12:06:17 +03:00

class-mail.php

Refactor email placeholders and deprecate obsolete methods

2025-05-19 14:26:39 +03:00

class-member-directory-meta.php

Fix cover image size handling and add fallback for invalid sizes

2025-09-06 14:42:15 +03:00

class-member-directory.php

Fix cover image size handling and add fallback for invalid sizes

2025-09-06 14:42:15 +03:00

class-multisite.php

- fixed scroll via enqueue new scroll library;

2019-05-02 18:29:00 +03:00

class-options.php

- WPCS;

2024-03-07 14:56:55 +02:00

class-password.php

Refactor email placeholders and deprecate obsolete methods

2025-05-19 14:26:39 +03:00

class-permalinks.php

Refactor email placeholders and deprecate obsolete methods

2025-05-19 14:26:39 +03:00

class-plugin-updater.php

* updated requests to site URL;

2025-01-31 15:19:28 +02:00

class-profile.php

Add new hooks, refactor workflows, and deprecate unused functions

2025-06-25 16:01:08 +03:00

class-query.php

* fixed CVE-2024-12276;

2025-02-03 16:17:37 +02:00

class-register.php

- updated hookdocs;

2023-07-18 12:06:17 +03:00

class-rewrite.php

* Admin Users bulk-actions

2024-09-24 13:18:48 +03:00

class-roles-capabilities.php

* fixed um_current_user_can();

2024-11-15 11:16:55 +02:00

class-setup.php

Refactor batch action scheduling for account status updates (#1692)

2025-06-18 15:17:19 +03:00

class-shortcodes.php

Update dependencies and enhance emotize method

2025-11-07 14:18:38 +02:00

class-templates.php

- WPCS for defined constants;

2023-09-13 22:56:32 +03:00

class-uploader.php

* fixed CVE-2024-12276;

2025-02-03 16:17:37 +02:00

class-user-posts.php

* fixed CVE-2024-12276;

2025-02-03 16:17:37 +02:00

class-user.php

Refactor email placeholders and deprecate obsolete methods

2025-05-19 14:26:39 +03:00

class-validation.php

- reviewd #1237;

2023-07-04 12:44:06 +03:00

um-actions-access.php

* fixed sending emails upon registration;

2024-10-10 18:18:56 +03:00

um-actions-account.php

Prevent shortcode execution in user input sanitization.

2025-06-24 17:16:28 +03:00

um-actions-ajax.php

- intermediate results with sanitizing form handlers;

2021-06-29 02:51:54 +03:00

um-actions-form.php

Fix email validation logic in Ultimate Member forms

2025-06-25 18:09:48 +03:00

um-actions-global.php

* added honeypot scripts/styles via

2025-01-30 13:00:17 +02:00

um-actions-login.php

Merge pull request #1694 from ultimatemember/fix/fetch_user_while_password_reset_link

2025-06-18 13:25:16 +03:00

um-actions-misc.php

* added security condition to check that one logged-in user cannot activate another one user via email activation link;

2024-10-11 18:47:40 +03:00

um-actions-profile.php

Add $args and $user_id to 'um_after_profile_header_name'

2025-12-02 10:27:13 +02:00

um-actions-register.php

Merge pull request #1694 from ultimatemember/fix/fetch_user_while_password_reset_link

2025-06-18 13:25:16 +03:00

um-actions-save-profile.php

* fixed #1434;

2024-09-26 17:39:57 +03:00

um-actions-user.php

- added escape functions, security fix for XSS;

2019-08-08 00:36:33 +03:00

um-actions-wpadmin.php

- intermediate results with sanitizing form handlers;

2021-06-29 02:51:54 +03:00

um-filters-account.php

- reviewd #1237;

2023-07-04 12:44:06 +03:00

um-filters-avatars.php

* reviewed #1582;

2024-11-13 17:20:52 +02:00

um-filters-commenting.php

- fixed using esc_attr() in href="" attributes;

2024-03-27 11:06:02 +02:00

um-filters-fields.php

Fix: Address CVE-2025-13217 and improve input sanitization

2025-12-05 17:56:45 +02:00

um-filters-files.php

- fixed user registration;

2018-03-20 13:24:38 +02:00

um-filters-login.php

* fixed sending emails upon registration;

2024-10-10 18:18:56 +03:00

um-filters-misc.php

- fixed user registration;

2018-03-20 13:24:38 +02:00

um-filters-navmenu.php

- fixed conditional menu handlers for MegaMenu themes (#1334);

2024-01-04 00:54:19 +02:00

um-filters-profile.php

* fixed deprecated function

2024-09-27 18:01:58 +03:00

um-filters-user.php

* Admin Users bulk-actions

2024-09-24 13:18:48 +03:00