XSS Vulnerability?

The plugin should be updated as follows:

https://plugins.trac.ww.wp.xz.cn/browser/force-regenerate-thumbnails/trunk/force-regenerate-thumbnails.php#L203
Line 203 changed from this:

wp_redirect(add_query_arg('_wpnonce', wp_create_nonce('force-regenerate-thumbnails'), admin_url('tools.php?page=force-regenerate-thumbnails&goback=1&ids=' . $ids)));

to this:

wp_redirect(esc_url_raw(add_query_arg('_wpnonce', wp_create_nonce('force-regenerate-thumbnails'), admin_url('tools.php?page=force-regenerate-thumbnails&goback=1&ids=' . $ids))));

I tested on WP 4.2.2 and clicking on a single Media file’s “Force regenerate thumbnails” link works just fine.

Also, line 412 could be changed from:

<p><?php printf(__("You can regenerate all thumbnails for specific images from the <a href='%s'>Media</a> page. (WordPress 3.1+ only)", 'force-regenerate-thumbnails'), admin_url('upload.php')); ?></p>

to:

<p><?php printf(__("You can regenerate all thumbnails for specific images from the <a href='%s'>Media</a> page. (WordPress 3.1+ only)", 'force-regenerate-thumbnails'), admin_url('upload.php?mode=list')); ?></p>

to add ?mode=list
to make for a better UX when clicking the “Media” link at /wp-admin/tools.php?page=force-regenerate-thumbnails

yeah, not a good sign i’d say 🙁