JSON API User <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter

// controllers/User.php (vulnerable version approx. lines 973-1010)

	public function post_comment()
	{
        // ... (truncated authorization checks)

		if (!isset($json_api->query->content)) {
			$json_api->error("Please include 'content' var in your request.");
		}

		if (!isset($json_api->query->comment_status)) {
			$json_api->error("Please include 'comment_status' var in your request. Possible values are comment_status=1 (approved) or comment_status=hold (not-approved)");
		} else
			$comment_status = $json_api->query->comment_status;

		if ($comment_status == 'hold')
			$comment_status = 0;

		$user_info = get_userdata($user_id);

		$time = current_time('mysql');
		$agent = $_SERVER['HTTP_USER_AGENT'];
		$ip = $_SERVER['REMOTE_ADDR'];

		$data = array(
			'comment_post_ID' => $json_api->query->post_id,
			'comment_author' => $user_info->user_login,
			'comment_author_email' => $user_info->user_email,
			'comment_author_url' => $user_info->user_url,
			'comment_content' => $json_api->query->content,
			'comment_type' => '',
			'comment_parent' => 0,
			'user_id' => $user_info->ID,
			'comment_author_IP' => $ip,
			'comment_agent' => $agent,
			'comment_date' => $time,
			'comment_approved' => $comment_status,
		);

		$comment_id = wp_insert_comment($data);

--- /home/deploy/wp-safety.org/data/plugin-versions/json-api-user/4.1.0/controllers/User.php	2024-09-26 15:40:20.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/json-api-user/4.1.2/controllers/User.php	2026-06-17 23:20:04.000000000 +0000
@@ -1,5 +1,10 @@
 <?php
 
+// Prevent direct access to this file.
+if (!defined('ABSPATH')) {
+	exit;
+}
+
 /*
   Controller name: User
   Controller description: User Registration, Authentication, User Info, User Meta, FB Login, BuddyPress xProfile Fields methods
@@ -973,38 +978,76 @@
 			$json_api->error("Please include 'content' var in your request.");
 		}
 
-		if (!isset($json_api->query->comment_status)) {
-			$json_api->error("Please include 'comment_status' var in your request. Possible values are comment_status=1 (approved) or comment_status=hold (not-approved)");
-		} else
-			$comment_status = $json_api->query->comment_status;
+		$post_id = absint($json_api->query->post_id);
 
-		if ($comment_status == 'hold')
-			$comment_status = 0;
+		if (!$post_id || !get_post($post_id)) {
+			$json_api->error("Invalid 'post_id'. The specified post does not exist.");
+		}
+
+		if (!comments_open($post_id)) {
+			$json_api->error("Comments are closed for this post.");
+		}
 
+		// Sanitize the comment content
+		$content = wp_unslash($json_api->query->content);
+		$content = wp_filter_post_kses($content);
+
+		if ('' === trim(wp_strip_all_tags($content))) {
+			$json_api->error("Comment 'content' is empty after sanitization.");
+		}
+
+		wp_set_current_user($user_id);
 		$user_info = get_userdata($user_id);
 
-		$time = current_time('mysql');
-		$agent = $_SERVER['HTTP_USER_AGENT'];
-		$ip = $_SERVER['REMOTE_ADDR'];
-
-		$data = array(
-			'comment_post_ID' => $json_api->query->post_id,
-			'comment_author' => $user_info->user_login,
+		$requested_status = isset($json_api->query->comment_status)
+			? $json_api->query->comment_status
+			: 'hold';
+
+		$commentdata = array(
+			'comment_post_ID'      => $post_id,
+			'comment_author'       => $user_info->user_login,
 			'comment_author_email' => $user_info->user_email,
-			'comment_author_url' => $user_info->user_url,
-			'comment_content' => $json_api->query->content,
-			'comment_type' => '',
-			'comment_parent' => 0,
-			'user_id' => $user_info->ID,
-			'comment_author_IP' => $ip,
-			'comment_agent' => $agent,
-			'comment_date' => $time,
-			'comment_approved' => $comment_status,
+			'comment_author_url'   => $user_info->user_url,
+			'comment_content'      => $content,
+			'comment_type'         => '',
+			'comment_parent'       => 0,
+			'user_id'              => $user_info->ID,
+			'comment_author_IP'    => $_SERVER['REMOTE_ADDR'],
+			'comment_agent'        => isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : '',
 		);
 
-		//print_r($data);
+		if ($requested_status === '1' && current_user_can('moderate_comments')) {
+			$commentdata['comment_approved'] = 1;
+		}
+
+		$comment_id = wp_new_comment($commentdata, true);
 
-		$comment_id = wp_insert_comment($data);
+		if (is_wp_error($comment_id)) {
+			$json_api->error($comment_id->get_error_message());
+		}