XSS Vulnerability

Hi Jules,

I’ve not seen or heard of a report of this. Please elaborate where you found this and details on the issue.

Cheers,
Jeroen

You can see the info at PatchStack:

https://patchstack.com/database/vulnerability/wp-dashboard-notes/wordpress-wp-dashboard-notes-plugin-1-0-11-cross-site-scripting-xss-vulnerability?_a_id=431

Thanks!

Thanks for adding the link @ptaubman – I guess I should have included that ??

Thanks for the link. Though I cannot find any details on the actual vulnerability on that page. I checked the code again and it looks like everything is sanitized before updating the data. I do think there could be additional escaping of data, but this should only be affected if there’s compromised data written to the database in the first place (you probably have a different/larger issue if that happens), not sure if that would be enough for a XSS vulnerability and if that is what they’re referring to. Any additional information that can be provided would be helpful.

@sormano , a message with all the information was sent via the contact form on your website on 2024-07-01 at 13:10:32 (EEST). Since we got zero replies and no patched version was released, the vulnerability was disclosed.

Hi Darius,

Does not appear like I’ve received anything. Could you please reach out again with details through this page/form; https://jeroensormani.com/contact/

Thanks

@sormano check your Slack DMs on the official WordPress Slack.

Thanks. Released 1.0.12

Great, I’ll ping the triage team so they can validate the patch asap.

I got confirmation from the triage team, recently released version 1.0.12 has a sufficient patch. Thank you!

Thank you, @darius_fx, for your communication, and @sormano, thanks for taking care of this!