From abb9d401eecfe6a58de47e395014df3c123bff39 Mon Sep 17 00:00:00 2001
From: vuckro <maribel_waters@howtocore.com>
Date: Wed, 10 Jun 2026 11:45:03 +0200
Subject: [PATCH] fix(security): escape customer/product output in Broadcast
 list table
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

column_target_customers() and column_target_products() interpolated
customer display names, email addresses and product names straight into
HTML — including into single-quoted aria-label attributes. A customer
controls their own display name, so a crafted name (display names are not
HTML-escaped by WordPress on save and may contain quotes) is stored and
then rendered unescaped when a network admin views the Broadcasts list,
yielding stored XSS in the network-admin context.

Escape each interpolated value for its context with esc_url() for links,
esc_attr() for attribute values and esc_html() for text nodes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 inc/list-tables/class-broadcast-list-table.php | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/inc/list-tables/class-broadcast-list-table.php b/inc/list-tables/class-broadcast-list-table.php
index 6eff74534..e78fcfb47 100644
--- a/inc/list-tables/class-broadcast-list-table.php
+++ b/inc/list-tables/class-broadcast-list-table.php
@@ -182,11 +182,11 @@ public function column_target_customers($item) {
 
 				$email = $customer->get_email_address();
 
-				$html = "<a href='{$customer_link}' class='wu-p-2 wu-flex wu-flex-grow wu-bg-gray-100 wu-rounded wu-items-center wu-border wu-border-solid wu-border-gray-300'>
+				$html = "<a href='" . esc_url($customer_link) . "' class='wu-p-2 wu-flex wu-flex-grow wu-bg-gray-100 wu-rounded wu-items-center wu-border wu-border-solid wu-border-gray-300'>
 										{$avatar}
 										<div class='wu-pl-2'>
-												<strong class='wu-block'>{$display_name} <small class='wu-font-normal'>(#{$id})</small></strong>
-												<small>{$email}</small>
+												<strong class='wu-block'>" . esc_html($display_name) . " <small class='wu-font-normal'>(#" . esc_html((string) $id) . ")</small></strong>
+												<small>" . esc_html($email) . "</small>
 										</div>
 								</a>";
 
@@ -215,7 +215,7 @@ public function column_target_customers($item) {
 
 					$customer_link = wu_network_admin_url('wp-ultimo-edit-customer', $url_atts);
 
-					$html .= "<div class='wu-flex wu--mr-4'><a role='tooltip' aria-label='{$tooltip_name}' href='{$customer_link}'>{$avatar}</a></div>";
+					$html .= "<div class='wu-flex wu--mr-4'><a role='tooltip' aria-label='" . esc_attr($tooltip_name) . "' href='" . esc_url($customer_link) . "'>{$avatar}</a></div>";
 				}
 
 				if ($targets_count < 7) {
@@ -363,7 +363,7 @@ public function column_target_products($item) {
 		</div>';
 			}
 
-			$html .= "<div class='wu-flex wu--mr-4'><a role='tooltip' aria-label='{$product_name}' href='{$product_link}'>{$image}</a></div>";
+			$html .= "<div class='wu-flex wu--mr-4'><a role='tooltip' aria-label='" . esc_attr($product_name) . "' href='" . esc_url($product_link) . "'>{$image}</a></div>";
 		}
 
 		if ($product_count > 1 && $product_count < 5) {