Fixed security issue where Knowledge Base slug in settings was not sanitized.

Author: ajaydsouza

includes/class-cpt.php

@@ -35,7 +35,7 @@ public function __construct() {
 	 * @since 2.3.0
 	 */
 	public static function register_post_type() {
-		$slug     = \wzkb_get_option( 'kb_slug', 'knowledgebase' );
+		$slug     = sanitize_title( \wzkb_get_option( 'kb_slug', 'knowledgebase' ) );
 		$archives = defined( 'WZKB_DISABLE_ARCHIVE' ) && WZKB_DISABLE_ARCHIVE ? false : $slug;
 		$rewrite  = defined( 'WZKB_DISABLE_REWRITE' ) && WZKB_DISABLE_REWRITE ? false : array(
 			'slug'       => $slug,
@@ -104,8 +104,8 @@ public static function register_post_type() {
 	 * @since 2.3.0
 	 */
 	public static function register_taxonomies() {
-		$catslug = \wzkb_get_option( 'category_slug', 'section' );
-		$tagslug = \wzkb_get_option( 'tag_slug', 'kb-tags' );
+		$catslug = sanitize_title( \wzkb_get_option( 'category_slug', 'section' ) );
+		$tagslug = sanitize_title( \wzkb_get_option( 'tag_slug', 'kb-tags' ) );
 
 		$args = array(
 			'hierarchical'      => true,

knowledgebase.php

@@ -13,7 +13,7 @@
  * Plugin Name: WebberZone Knowledge Base
  * Plugin URI: https://github.com/WebberZone/knowledgebase
  * Description: Create a multi-product knowledge base on your WordPress site.
- * Version: 2.3.1
+ * Version: 2.3.2
  * Author: WebberZone
  * Author URI: https://webberzone.com
  * License: GPL-2.0+
@@ -37,7 +37,7 @@
 	 *
 	 * @var string $wzkb_version Plugin version
 	 */
-	define( 'WZKB_VERSION', '2.3.1' );
+	define( 'WZKB_VERSION', '2.3.2' );
 }
 
 if ( ! defined( 'WZKB_PLUGIN_DIR' ) ) {

readme.txt

@@ -113,11 +113,16 @@ You can report security bugs through the Patchstack Vulnerability Disclosure Pro
 
 == Upgrade Notice ==
 
-= 2.3.1 =
-Fixed security issue where arguments passed to the shortcodes were not properly sanitized.
+= 2.3.2 =
+Fixed security issue where Knowledge Base slug in settings was not sanitized.
 
 == Changelog ==
 
+= 2.3.2 =
+
+* Bug fixes:
+	* Fixed security issue where Knowledge Base slug in settings was not sanitized.
+
 = 2.3.1 =
 
 * Bug fixes: