Mykyta Synelnikov a102d22ce1 Prevent shortcode execution in user input sanitization. ...

Added `strip_shortcodes` across various sanitization routines to ensure user inputs do not execute shortcodes. This enhances security by blocking unintended shortcode processing in fields such as text, email, URLs, and form descriptions.

2025-06-24 17:16:28 +03:00

..

rest

* fixed CVE-2024-12276;

2025-02-03 16:17:37 +02:00

class-access.php

* fixed CVE-2024-12276;

2025-02-03 16:17:37 +02:00

class-account.php

- fix change email permissions

2025-04-30 12:02:03 +03:00

class-ajax-common.php

* maybe fixed CVE-2024-10528;

2024-11-05 11:55:07 +02:00

class-blocks.php

- fix restrictions for all blocks

2025-06-19 15:30:30 +03:00

class-builtin.php

- fix country name

2025-06-18 11:11:09 +03:00

class-cron.php

- UM cron class review;

2023-07-07 13:34:55 +03:00

class-date-time.php

- finally reviewed #1361;

2023-12-01 12:50:13 +02:00

class-external-integrations.php

- fixed using esc_attr() in href="" attributes;

2024-03-27 11:06:02 +02:00

class-fields.php

Added docs

2025-05-12 13:25:24 +03:00

class-files.php

* sorted deprecated function;

2024-11-29 14:24:35 +02:00

class-fonticons.php

- FontIcons libraries moving to legacy;

2023-09-26 12:25:49 +03:00

class-form.php

Prevent shortcode execution in user input sanitization.

2025-06-24 17:16:28 +03:00

class-gdpr.php

- partially reviewed #1361;

2023-11-30 10:55:00 +02:00

class-login.php

- updated hookdocs;

2023-07-18 12:06:17 +03:00

class-logout.php

- updated hookdocs;

2023-07-18 12:06:17 +03:00

class-mail.php

Refactor email placeholders and deprecate obsolete methods

2025-05-19 14:26:39 +03:00

class-member-directory-meta.php

- fixed a member directory 'select' filter query

2025-04-11 16:04:55 +03:00

class-member-directory.php

Filter out empty meta values in usermeta queries. Alternative of #1707

2025-06-23 12:45:55 +03:00

class-multisite.php

- fixed scroll via enqueue new scroll library;

2019-05-02 18:29:00 +03:00

class-options.php

- WPCS;

2024-03-07 14:56:55 +02:00

class-password.php

Refactor email placeholders and deprecate obsolete methods

2025-05-19 14:26:39 +03:00

class-permalinks.php

Refactor email placeholders and deprecate obsolete methods

2025-05-19 14:26:39 +03:00

class-plugin-updater.php

* updated requests to site URL;

2025-01-31 15:19:28 +02:00

class-profile.php

Merge pull request #1683 from ultimatemember/fix/sitehealth

2025-06-24 16:56:38 +03:00

class-query.php

* fixed CVE-2024-12276;

2025-02-03 16:17:37 +02:00

class-register.php

- updated hookdocs;

2023-07-18 12:06:17 +03:00

class-rewrite.php

* Admin Users bulk-actions

2024-09-24 13:18:48 +03:00

class-roles-capabilities.php

* fixed um_current_user_can();

2024-11-15 11:16:55 +02:00

class-setup.php

Refactor batch action scheduling for account status updates (#1692)

2025-06-18 15:17:19 +03:00

class-shortcodes.php

- small typo fix

2025-06-16 10:05:04 +03:00

class-templates.php

- WPCS for defined constants;

2023-09-13 22:56:32 +03:00

class-uploader.php

* fixed CVE-2024-12276;

2025-02-03 16:17:37 +02:00

class-user-posts.php

* fixed CVE-2024-12276;

2025-02-03 16:17:37 +02:00

class-user.php

Refactor email placeholders and deprecate obsolete methods

2025-05-19 14:26:39 +03:00

class-validation.php

- reviewd #1237;

2023-07-04 12:44:06 +03:00

um-actions-access.php

* fixed sending emails upon registration;

2024-10-10 18:18:56 +03:00

um-actions-account.php

Prevent shortcode execution in user input sanitization.

2025-06-24 17:16:28 +03:00

um-actions-ajax.php

- intermediate results with sanitizing form handlers;

2021-06-29 02:51:54 +03:00

um-actions-form.php

Ensure email validation handles primary and secondary emails.

2025-06-18 14:28:38 +03:00

um-actions-global.php

* added honeypot scripts/styles via

2025-01-30 13:00:17 +02:00

um-actions-login.php

Merge pull request #1694 from ultimatemember/fix/fetch_user_while_password_reset_link

2025-06-18 13:25:16 +03:00

um-actions-misc.php

* added security condition to check that one logged-in user cannot activate another one user via email activation link;

2024-10-11 18:47:40 +03:00

um-actions-profile.php

- fixed PHP Warning that occurs when using the getimagesize function with an image from an external source.

2025-04-02 22:23:14 +03:00

um-actions-register.php

Merge pull request #1694 from ultimatemember/fix/fetch_user_while_password_reset_link

2025-06-18 13:25:16 +03:00

um-actions-save-profile.php

* fixed #1434;

2024-09-26 17:39:57 +03:00

um-actions-user.php

- added escape functions, security fix for XSS;

2019-08-08 00:36:33 +03:00

um-actions-wpadmin.php

- intermediate results with sanitizing form handlers;

2021-06-29 02:51:54 +03:00

um-filters-account.php

- reviewd #1237;

2023-07-04 12:44:06 +03:00

um-filters-avatars.php

* reviewed #1582;

2024-11-13 17:20:52 +02:00

um-filters-commenting.php

- fixed using esc_attr() in href="" attributes;

2024-03-27 11:06:02 +02:00

um-filters-fields.php

* fixed HTML formatted textarea;

2024-10-10 11:56:55 +03:00

um-filters-files.php

- fixed user registration;

2018-03-20 13:24:38 +02:00

um-filters-login.php

* fixed sending emails upon registration;

2024-10-10 18:18:56 +03:00

um-filters-misc.php

- fixed user registration;

2018-03-20 13:24:38 +02:00

um-filters-navmenu.php

- fixed conditional menu handlers for MegaMenu themes (#1334);

2024-01-04 00:54:19 +02:00

um-filters-profile.php

* fixed deprecated function

2024-09-27 18:01:58 +03:00

um-filters-user.php

* Admin Users bulk-actions

2024-09-24 13:18:48 +03:00