Repository navigation
Release 3.4.3 - #114
Merged
Merged
Release 3.4.3#114
Conversation
Comment authors control a link's href and post authors control its data-* attributes, but those values reached fancyBox's HTML templates and option merging as if they came from site code. Escape video template values, build thumbnails through the DOM, refuse unsafe URL schemes, sanitize HTML and Ajax slides, and let links set only a fixed list of options. Fixes CVE-2026-96571. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
DOMPurify's html profile keeps style elements, form controls and style attributes, so markup in a link's data-caption could affect the whole page. Route every caption through one stricter sanitizer. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A crafted URL could open a link to an external page in the lightbox straight away. Deep links to images and same-site content are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The link-matching pattern could backtrack exponentially on a crafted URL, blocking the main thread for everyone who loaded the page. Smilies, emoji and avatars also no longer turn a link into a lightbox trigger. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The script fields print on every page, and manage_options alone lets a multisite site administrator write them. Keep the stored value when the user lacks unfiltered_html, and show the fields as read-only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
WordPress.org review expects wp_add_inline_style and wp_add_inline_script. The inline script now always follows the library, which also fixes a dead lightbox when the plugin and jQuery were both loaded in the footer. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Remove the Tested up to plugin header, which Plugin Check reports as an error, prefix the variables shared by the admin partials, rename the last unprefixed function, and record why load_plugin_textdomain() is still required. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
That step receives the SVN password, and `stable` is a moving reference. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
✅ WordPress Plugin Check Report
📊 ReportAll checks passed! No errors or warnings found. 🤖 Generated by WordPress Plugin Check Action • Learn more about Plugin Check |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Security release for CVE-2026-96571, plus the related problems found in a full audit of the plugin.
unfiltered_htmlto edit or switch on the custom JavaScript settingsOne commit per feature. The changelog in
readme.txtlists the behaviour changes.Testing
End-to-end in Chromium against real WordPress installs, including a real anonymous comment and Contributor posts:
🤖 Generated with Claude Code