bw_button – security fix

This post demonstrates the security fix implemented to prevent Cross Site Scripting using the class parameter in the bw_button shortcode.

Without the fix, when the button is hovered over a JavaScript alert box is displayed.

With the fix applied the JavaScript alert message is NOT DISPLAYED when the button is hovered over.

dummy

[bw_button class=' " onmouseover=alert(5) ']

The fix also applies to the following shortcodes:

• bw_contact_button
• bw_link

Contact oik

bw_button – security fix