add_query_arg XSS

• sokratesagogo

• April 21, 2015 at 5:01 am

With reference to the latest Sucuri advisory is a patch forthcoming w.r.t. add_query_arg()

• John Huebner

• June 18, 2015 at 11:21 am

Hey there, for anyone that is wondering as well.

ACF does use add_query_arg(), but neither of the two places this is used depends on user input. The vulnerability reported by Sucuri was has to do with using user input without escaping it when using this function.

~JH