Andyt8

Hello, thank you for the information. Were you able to contact Patchstack? They may have more in-depth information. Perhaps there is much more to it than what is publicly available.

Hello,

Thank you for your response. I don’t know the original source. My security plugin read several public sources and is still reporting that. It looks like it should be something about “Broken Access Control”. Sorry, I found no links until now.

I found several websites explaining Broken Access Control for different plugins – maybe that is a general problem? However, nothing about Wikipedia Preview Plugin execpt of my plugin (Defender Pro) with CVSS 6.5, which is too much to ignore it.

By the way, there was also a report for another plugin and the developer answered a quick faster. There was the same. No information for the developer – really strange process.

According to the website (developer from security plugin), it should be Patchstack. With that, I found https://patchstack.com/database/wordpress/plugin/wikipedia-preview/vulnerability/wordpress-wikipedia-preview-plugin-1-15-0-broken-access-control-vulnerability

Hopefully it helps?

best regards, Andyt

Hello Finn,

Thank you for your fast response. I don’t know the original source. My security plugin read several sources. However, I found the following:

-) https://wpscan.com/vulnerability/c9fe39c5-ec0f-490b-8ceb-45fd47b8f772/

-) https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/statify-widget/statify-widget-146-authenticated-contributor-stored-cross-site-scripting

Hopefully that is a help for you?

best regards, Andyt

Danke für die schnelle Rückmeldung.

Ich bin gezwungen ein Cache-Plugin zu nutzen. Sonst dauert das Darstellen viel zu lange. vServer ist bei CPU begrenzt. WP Fastest Cache und Hummingbird scheinen grundlegend mit Leaflet zu arbeiten. Letzterer erkennt sogar automatisch, dass drei js-Dateien ausgeschlossen sein müssen. Nur mit diesen erscheint das Phänomen nicht. Die ausgeschlossenen Dateien lauten gestures_leaflet.js, elevation_js.js und leaflet-gpxgroup.min.js. Habe aber weitere hinzugefügt.

Bei memache, was bei Webseiten-Zustand angeführt wird, ist das wieder anders. Da werden php-code und Datenbankabfragen zwischengespeichert. Ich kann da leider nichts ausklammern. Es scheint, die erste Abfrage bewirkt, wie später die Antworten für alle anderen Abfragen aussehen. Wurde DSVGO noch nicht bestätigt, dann bleibt das auch so. Egal wie oft man dann darauf klickt. Wurde dies bestätigt, dann ist das für alle anderen ebenso. Die sehen dann eine leere Stelle wo die DSVGO-Abfrage bzw. die Leaflet-Map sein sollte.

Das wird vermutlich für das Kontrollfeld ähnlich sein. Wobei mir noch unklar ist, wie hier die Logik ist.

PS.: die Angelegenheit mit memache und DSVGO werde ich später bei Github übertragen.

just one mistake from my last post…

According to a request for a different plugin for the same function, the plugin should now it is rendering for RSS Feed and show only a message.

It should be “know” and not “now”.

Maybe I start to add a manual message after the Leaflet Map… if an automatic function will be not possible.

By the way, RSS technology is the best to stay informed for many sources at one place. Therefore, I still use a Web-RSS-Reader and get infos from over 250 sources.

There would be another way for such situation (user use RSS-Feed on my website and get a new article with Leaflet Map, which will not be shown on RSS Feed). I’m able to disable full-text rss-feed, but I don’t like that by my own for other RSS Feeds – so I still want to give others the full version.

Hi, the situation with Shariff Wrapper is solved. At the moment, there are still missing pictures.

regards, Andyt

Hi,

Now it is possible for me to show the different representation. The link to Leaflet was created with the plugin “Wikipedia Preview”. Two changes to the other links are immediately noticeable. First, they are missing the nice icon behind the link and second, this is underlined separately.

My question now would be, can I fix this somehow, that this looks like the other links?

For the first problem, the plugin doesn’t seem to create a proper link. I also miss the preview when I move the mouse over the link. Usually I see in the web browser where the link goes.

Example: https://blackseals.net/blog/2023/09/07/umstieg-auf-leaflet-fuer-openstreetmap/