# Vulnerability Summary ## Overview - **Vulnerability Type**: Cross-Site Scripting (XSS) - **Description**: In the `maxi-blocks` plugin, the `sc_string` function does not properly escape user input, allowing attackers to execute arbitrary JavaScript code by crafting malicious input. ## Impact Scope - **Affected Files**: - `core/class-maxi-api.php` - `core/class-maxi-style-cards.php` - **Affected Versions**: 2.1.10 and earlier ## Remediation - **Fixed Files**: - `core/class-maxi-api.php` - `core/class-maxi-style-cards.php` - **Fix Details**: - Escape `$data['sc_styles']` and `$data['sc_variables']` in the `sc_string` function to prevent XSS attacks. - Specific fix code is as follows: ```php // core/class-maxi-api.php // Before fix $new_style_card['maxi_blocks_style_card_styles'] = $data['sc_styles']; // After fix $new_style_card['maxi_blocks_style_card_styles'] = wp_strip_all_tags($data['sc_styles']); // Before fix $new_style_card['maxi_blocks_style_card_styles_preview'] = $data['sc_styles']; // After fix $new_style_card['maxi_blocks_style_card_styles_preview'] = wp_strip_all_tags($data['sc_styles']); // Before fix $new_style_card['maxi_blocks_style_card_styles'] = $data['sc_styles']; // After fix $new_style_card['maxi_blocks_style_card_styles'] = wp_strip_all_tags($data['sc_styles']); // Before fix $new_style_card['maxi_blocks_style_card_styles'] = $data['sc_styles']; // After fix $new_style_card['maxi_blocks_style_card_styles'] = wp_strip_all_tags($data['sc_styles']); // Before fix $new_style_card['maxi_blocks_style_card_styles'] = $data['sc_styles']; // After fix $new_style_card['maxi_blocks_style_card_styles'] = wp_strip_all_tags($data['sc_styles']); // Before fix $new_style_card['maxi_blocks_style_card_styles'] = $data['sc_styles']; // After fix $new_style_card['maxi_blocks_style_card_styles'] = wp_strip_all_tags($data['sc_styles']); // Before fix $new_style_card['maxi_blocks_style_card_styles'] = $data['sc_styles']; // After fix $new_style_card['maxi_blocks_style_card_styles'] = wp_strip_all_tags($data['sc_styles']); // Before fix $new_style_card['maxi_blocks_style_card_styles'] = $data['sc_styles']; // After fix $new_style_card['maxi_blocks_style_card_styles'] = wp_strip_all_tags($data['sc_styles']); // Before fix $new_style_card['maxi_blocks_style_card_styles'] = $data['sc_styles']; // After fix $new_style_card['maxi_blocks_style_card_styles'] = wp_strip_all_tags($data['sc_styles']); // Before fix $new_style_card['maxi_blocks_style_card_styles'] = $data['sc_styles']; // After fix $new_style_card['maxi_blocks_style_card_styles'] = wp_strip_all_tags($data['sc_styles']); // Before fix $new_style_card['maxi_blocks_style_card_styles'] = $data['sc_styles']; // After fix $new_style_card['maxi_blocks_style_card_styles'] = wp_strip_all_tags($data['sc_styles']); // Before fix $new_style_card['maxi_blocks_style_card_styles'] = $data['sc_styles']; // After fix $new_style_card['maxi_blocks_style_card_styles'] = wp_strip_all_tags($data['sc_styles']); // Before fix $new_style_card['maxi_blocks_style_card_styles'] = $data['sc_styles']; // After fix $new_style_card['maxi_blocks_style_card_styles'] = wp_strip_all_tags($data['sc_styles']); // Before fix $new_style_card['maxi_blocks_style_card_styles'] = $data['sc_styles']; // After fix $new_style_card['maxi_blocks_style_card_styles'] = wp_strip_all_tags($data['sc_styles']); // Before fix $new_style_card['maxi_blocks_style_card_styles'] = $data['sc_styles']; // After fix $new_style_card['maxi_blocks_style_card_styles'] = wp_strip_all_tags($data['sc_styles']); // Before fix $new_style_card['maxi_blocks_style_card_styles'] = $data['sc_styles']; // After fix $new_style_card['maxi_blocks_style_card_styles'] = wp_strip_all_tags($data['sc_styles']); // Before fix $new_style_card['maxi_blocks_style_card_styles'] = $data['sc_styles']; // After fix $new_style_card['maxi_blocks_style_card_styles'] = wp_strip_all_tags($data['sc_styles']); // Before fix $new_style_card['maxi_blocks_style_card_styles'] = $data['sc_styles']; // After fix $new_style_card['maxi_blocks_style_card_styles'] = wp_strip_all_tags($data['sc_styles']); // Before fix $new_style_card['maxi_blocks_style_card_styles'] = $data['sc_styles']; // After fix $new_style_card['maxi_blocks_style_card_styles'] = wp_strip_all_tags($data['sc_styles']); // Before fix $new_style_card['maxi_blocks_style_card_styles'] = $data['sc_styles']; // After fix $new_style_card['maxi_blocks_style_card_styles'] = wp_strip_all_tags($data['sc_styles']); // Before fix $new_style_card['maxi_blocks_style_card_styles'] = $data['sc_styles']; // After fix $new_style_card['maxi_blocks_style_card_styles'] = wp_strip_all_tags($data['sc_styles']); // Before fix $new_style_card['maxi_blocks_style_card_styles'] = $data['sc_styles']; // After fix $new_style_card['maxi_blocks_style_card_styles'] = wp_strip_all_tags($data['sc_styles']); // Before fix $new_style_card['maxi_blocks_style_card_styles'] = $data['sc_styles']; // After fix $new_style_card['maxi_bl