CVE-2024-6391
Published
CVSS v3
6.4
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT
Description
The oik plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bw_button shortcode in all versions up to, and including, 4.10.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
<p>Now with 9 blocks:</p>
<ul>
<li>Address – Displays your address from oik-options</li>
<li>Contact form – Displays a contact form</li>
<li>Contact field – Part of the Contact form</li>
<li>Countdown – Countdown / count since timer</li>
<li>Dynamic content – Dynamic content block</li>
<li>Follow me – Displays your social media links</li>
<li>Google Maps – Displays a Google Maps map using oik options</li>
<li>PayPal button – PayPal button for: Pay Now, Buy Now, Donate, Add to Cart, and View Cart / Checkout</li>
<li>Shortcode block for oik shortcodes – Expands oik shortcodes</li>
</ul>
<p>The <em>oik base</em> plugin provides a series of advanced WordPress shortcodes that help you display dynamic content from your website’s pages, posts, attachments, links and custom post types.<br />
The OIK Information Kit uses lazy smart shortcode technology to display your WordPress website’s content including your often included key-information.<br />
The functionality in the oik base plugin is used by over 40 other WordPress plugins, providing powerful facilities for an efficient, performant website.</p>
<p>oik now provides over 80 shortcodes including:</p>
<ul>
<li>[bw_pages], [bw_posts], [bw_thumbs], [bw_attachments], [bw_images], [bw_pdf] shortcodes to list subpages, posts, attachments or custom post types </li>
<li>[bw_cycle] to display content using jQuery cycle.</li>
<li>[bw_list], [bw_tree] to display lists of links to pages, posts, attachments or custom post types </li>
<li>[bw_table] to tabulate pages, posts or custom post types</li>
<li>[bw_bookmarks] to list links</li>
<li>[paypal] shortcodes for PayPal buttons: Pay Now, Buy Now, Donate, Add to Cart, View Cart/Checkout</li>
<li>[bw_block] & [bw_eblock], [div] & [ediv], [clear] – to create block structures within your pages, posts and even widgets</li>
<li>[bw_button], [bw_contact_button] – to provide call-to-action button style links for Artisteer themes</li>
<li>helper shortcodes for web designers and developers: [bw_editcss], [bwtrace], [bw_wpadmin], [bw_wtf], [stag] & [etag]</li>
</ul>
<p>oik helps you to display information about you, your company, your social networking ids and your website using standard formats that search engines such as Google recognise.</p>
<ul>
<li>You enter your information once, then use oik shortcodes to display it wherever you want; in titles, post and page content, header, sidebar and footer widgets.</li>
<li>Whenever you need to change a value you only need to update it in one place; and your website is updated instantly.</li>
<li>Shortcodes to display often included key information include: [bw_contact], [bw_telephone], [bw_mobile], [bw_mailto], [bw_company], [bw_address], [bw_show_googlemap], [bw_directions], [bw_logo], [bw_qrcode], [bw_copyright]</li>
<li>For your social networking use the [bw_follow_me] shortcode to display your links to Twitter, Facebook, LinkedIn, etcetera</li>
</ul>
<p>Features:</p>
<ul>
<li>oik provides buttons to help you write the shortcodes, showing you the parameters you can choose and default values </li>
<li>oik provides a shortcode discovery page where you can find out about every shortcode which is active in your site</li>
<li>lazy programming means that code is only loaded when it’s actually needed</li>
<li>smart means that the shortcodes can recognise the content in which they’re used and adjust their behaviour accordingly</li>
<li>oik is extendable – plugin developers can build on the oik base functionality </li>
<li>using the oik API: help, syntax information, examples AND HTML snippets can be produced for any plugin or theme that provides shortcodes</li>
<li>oik is theme independent; meaning that you can change your theme without having to worry about whether or not the shortcodes will still work.</li>
<li>oik uses microformats so that Google and other search engines can understand your content.</li>
</ul>
<h3>Further reading</h3>
<p>If you want to read more about the oik plugins then please visit the<br />
<a href="https://www.oik-plugins.com/oik" rel="nofollow ugc">oik plugin</a><br />
<strong>“the oik plugin – for often included key-information”</strong></p>
<h4>Other plugins</h4>
<p>Other plugins which depend upon the oik API are available on WordPress.org:</p>
<ul>
<li><a href="https://www.wordpress.org/extend/plugins/bbboing" rel="nofollow ugc">bbboing</a> – obfuscate text but leave it readable</li>
<li><a href="https://www.wordpress.org/extend/plugins/cookie-cat" rel="nofollow ugc">cookie-cat</a> – [cookies] shortcode to list the cookies your website may use</li>
<li><a href="https://www.wordpress.org/extend/plugins/oik-batchmove" rel="nofollow ugc">oik-batchmove</a> – batch change post categories or published date</li>
<li><a href="https://wordpress.org/extend/plugins/oik-nivo-slider/" rel="ugc">oik-nivo-slider</a> – [nivo] shortcode for the jQuery “Nivo slider” for posts, pages, attachments and custom post types</li>
<li><a href="https://www.wordpress.org/extend/plugins/oik-privacy-policy" rel="nofollow ugc">oik-privacy-policy</a> – generate a privacy policy page, compliant with UK cookie law (EU cookie directive)</li>
<li><a href="https://wordpress.org/plugins/oik-read-more" rel="ugc">oik-read-more</a> – progressively reveal content by clicking on “read more” buttons</li>
</ul>
<p>Plugins which participate with oik shared libraries are:</p>
<ul>
<li><a href="https://wordpress.org/plugins/oik-bwtrace/" rel="ugc">oik-bwtrace</a> – Debug trace for WordPress, including action and filter tracing</li>
<li><a href="https://www.wordpress.org/extend/plugins/oik-css" rel="nofollow ugc">oik-css</a> – [bw_css] for CSS styling per page</li>
<li><a href="https://wordpress.org/extend/plugins/uk-tides/" rel="ugc">uk-tides</a> – [bw_tides] shortcode for tide times and heights in the UK (replaces oik-tides)</li>
</ul>
<p>These plugins are not dependent upon oik:</p>
<ul>
<li><a href="https://wordpress.org/plugins/allow-reinstalls/" rel="ugc">allow-reinstalls</a> – Allow re-installation of plugins and themes by upload</li>
<li><a href="https://wordpress.org/plugins/oik-weight-zone-shipping" rel="ugc">oik-weight-zone-shipping</a> – Weight Zone Shipping for WooCommerce</li>
<li><a href="https://wordpress.org/plugins/oik-weightcountry-shipping" rel="ugc">oik-weightcountry-shipping</a> – Weight/Country Shipping for WooCommerce</li>
</ul>
<p>More FREE and Premium plugins are available from <a href="https://www.oik-plugins.com/wordpress-plugins-from-oik-plugins/" rel="nofollow ugc">oik-plugins.com</a> including:</p>
<ul>
<li><a href="https://www.oik-plugins.com/oik-plugins/diy-oik" rel="nofollow ugc">diy-oik</a> – Do-It-Yourself shortcodes</li>
<li><a href="https://www.oik-plugins.com/oik-plugins/oik-blocks" rel="nofollow ugc">oik-blocks</a> – WordPress blocks for oik shortcodes</li>
<li><a href="https://www.oik-plugins.com/oik-plugins/external-link-warning-jquery/" rel="nofollow ugc">oik-External link warning jQuery</a> – Warns visitor about leaving your site</li>
<li><a href="https://www.oik-plugins.com/oik-plugins/oik-fields-custom-post-type-field-apis" rel="nofollow ugc">oik-fields</a> – custom post type field APIs</li>
<li><a href="https://www.oik-plugins.com/oik-plugins/oik-ms-oik-multisite-shortcodes/" rel="nofollow ugc">oik-ms</a> – oik MultiSite shortcodes</li>
<li><a href="https://www.oik-plugins.com/oik-plugins/oik-mshot" rel="nofollow ugc">oik-mshot</a> – Shortcode to display the “mshot” of an URL; oik-fields extension</li>
<li><a href="https://www.oik-plugins.com/oik-plugins/oik-rating" rel="nofollow ugc">oik-rating</a> – 5 star rating custom field; oik-fields extension</li>
<li><a href="https://www.oik-plugins.com/oik-plugins/oik-testimonials" rel="nofollow ugc">oik-testimonials</a> – Manage and display testimonials.</li>
<li><a href="https://www.oik-plugins.com/oik-plugins/oik-todo-todo-list" rel="nofollow ugc">oik-todo</a> – TO DO list</li>
<li><a href="https://www.oik-plugins.com/oik-plugins/oik-types" rel="nofollow ugc">oik-types</a> – custom content type, field and taxonomy manager</li>
<li><a href="https://www.oik-plugins.com/oik-plugins/oik-user" rel="nofollow ugc">oik-user</a> – display oik information for each site user</li>
</ul>
<p>oik plugins are suitable for:</p>
<ul>
<li>WordPress site owners</li>
<li>WordPress site administrators</li>
<li>WordPress designers</li>
<li>WordPress web site developers </li>
<li>WordPress plugin developers</li>
</ul>
<p>oik plugins are tested with:</p>
<ul>
<li>WordPress</li>
<li>WordPress Multisite</li>
<li>PHP 8.1, PHP 8.2, PHP 8.3 & PHP 8.4</li>
<li>PHPUnit 9.6, 10.5 & 11.4</li>
</ul>
<p>All of the plugins are developed using a set of functions that can make PHP and HTML coding a bit easier.<br />
These are known as the <a href="https://www.oik-plugins.com/apis/oik-apis" rel="nofollow ugc">OIK Application Programming Interface (OIK API)</a></p>
WordPress Plugin Directory