/* modules/seo/models/xagio_tinymce.php:66 */
add_action('admin_post_xagio_pixabay_download', [
    'XAGIO_MODEL_TINYMCE',
    'pixabayDownloadImage'
]);

---

/* modules/seo/models/xagio_tinymce.php:73 */
public static function pixabayDownloadImage()
{

    check_ajax_referer('xagio_nonce', '_xagio_nonce');

    if (!isset($_POST['img'], $_POST['title'])) {
        wp_die('Required parameters are missing.', 'Missing Parameters', ['response' => 400]);
    }

    $uploads   = wp_upload_dir();
    $image_url = sanitize_text_field(wp_unslash($_POST['img']));
    $xagio_name      = sanitize_text_field(wp_unslash($_POST['title'])) . '.jpg';

    $filename            = wp_unique_filename($uploads['path'], $xagio_name, $unique_filename_callback = NULL);
    $wp_file_type        = wp_check_filetype($filename, NULL);
    $full_path_file_name = $uploads['path'] . "/" . $filename;

    $image_string = self::fetch_image($image_url);

---

/* modules/seo/models/xagio_tinymce.php:132 */
public static function curl_fetch_image($xagio_url)
{
    $xagio_response = wp_remote_get($xagio_url, [
        'timeout' => 10,
        // Adjust the timeout as needed
    ]);

    if (is_wp_error($xagio_response)) {
        return false; // Or handle the error as needed
    }

    $image = wp_remote_retrieve_body($xagio_response);
    return $image;
}

--- /home/deploy/wp-safety.org/data/plugin-versions/xagio-seo/7.1.0.30/modules/seo/models/xagio_tinymce.php	2025-12-12 11:54:16.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/xagio-seo/7.1.0.31/modules/seo/models/xagio_tinymce.php	2025-12-23 15:47:08.000000000 +0000
@@ -73,39 +73,75 @@
 
         public static function pixabayDownloadImage()
         {
-
             check_ajax_referer('xagio_nonce', '_xagio_nonce');
 
-            if (!isset($_POST['img'], $_POST['title'])) {
-                wp_die('Required parameters are missing.', 'Missing Parameters', ['response' => 400]);
+            // Block Subscribers / low-privilege users
+            if ( ! is_user_logged_in() || ! current_user_can('upload_files') ) {
+                xagio_json('error', 'Forbidden.');
+            }
+
+            if (empty($_POST['img']) || empty($_POST['title'])) {
+                xagio_json('error', 'Required parameters are missing.');
             }
 
             $uploads   = wp_upload_dir();
-            $image_url = sanitize_text_field(wp_unslash($_POST['img']));
-            $xagio_name      = sanitize_text_field(wp_unslash($_POST['title'])) . '.jpg';
+            $image_url = esc_url_raw(wp_unslash($_POST['img']));
+            $title     = sanitize_text_field(wp_unslash($_POST['title']));
+
+            if (empty($image_url) || empty($title)) {
+                xagio_json('error', 'Invalid parameters.');
+            }
+
+            // Allow Pixabay only
+            $allowed_hosts = [
+                'pixabay.com',
+                'www.pixabay.com',
+                'cdn.pixabay.com'
+            ];
+
+            $parts  = wp_parse_url($image_url);
+            $host   = strtolower($parts['host'] ?? '');
+            $scheme = strtolower($parts['scheme'] ?? '');
+
+            if (!$host || !in_array($host, $allowed_hosts, true)) {
+                xagio_json('error', 'Invalid image source.');
+            }
+
+            if (!in_array($scheme, ['http', 'https'], true)) {
+                xagio_json('error', 'Invalid image URL.');
+            }
+
+            $xagio_name = $title . '.jpg';
+            $filename   = wp_unique_filename($uploads['path'], $xagio_name, NULL);
 
-            $filename            = wp_unique_filename($uploads['path'], $xagio_name, $unique_filename_callback = NULL);
             $wp_file_type        = wp_check_filetype($filename, NULL);
-            $full_path_file_name = $uploads['path'] . "/" . $filename;
+            $full_path_file_name = trailingslashit($uploads['path']) . $filename;
 
             $image_string = self::fetch_image($image_url);
 
-            $fileSaved = xagio_file_put_contents($uploads['path'] . "/" . $filename, $image_string);
+            if ($image_string === false || $image_string === '') {
+                xagio_json('error', 'Failed to download image.');
+            }
+
+            $fileSaved = xagio_file_put_contents($full_path_file_name, $image_string);
             if (!$fileSaved) {
                 xagio_json('error', 'Cannot save this selected image to server. Please contact support.');
             }
 
             $attachment = [
-                'post_mime_type' => $wp_file_type['type'],
+                'post_mime_type' => $wp_file_type['type'] ?: 'image/jpeg',
                 'post_title'     => preg_replace('/\.[^.]+$/', '', $filename),
                 'post_content'   => '',
                 'post_status'    => 'inherit',
-                'guid'           => $uploads['url'] . "/" . $filename,
+                'guid'           => trailingslashit($uploads['url']) . $filename,
             ];
-            $attach_id  = wp_insert_attachment($attachment, $full_path_file_name, 0);
+            
+            $attach_id = wp_insert_attachment($attachment, $full_path_file_name, 0);
             if (!$attach_id) {
+                wp_delete_file($full_path_file_name);
                 xagio_json('error', 'Failed save this selected image into the database. Please contact support.');
             }
+
             require_once(ABSPATH . 'wp-admin/includes/image.php');
             $attach_data = wp_generate_attachment_metadata($attach_id, $full_path_file_name);
             wp_update_attachment_metadata($attach_id, $attach_data);
@@ -125,30 +161,29 @@
         {
             if (function_exists("curl_init")) {
                 return self::curl_fetch_image($xagio_url);
-            } else if (ini_get("allow_url_fopen")) {
-                return self::fopen_fetch_image($xagio_url);
             }
+
+            return false;
         }
 
         public static function curl_fetch_image($xagio_url)
         {
-            $xagio_response = wp_remote_get($xagio_url, [
+            $resp = wp_safe_remote_get($xagio_url, [
                 'timeout' => 10,
-                // Adjust the timeout as needed
+                'redirection' => 2,
+                'headers' => ['Accept' => 'image/*'],
             ]);
 
-            if (is_wp_error($xagio_response)) {
-                return false; // Or handle the error as needed
+            if (is_wp_error($resp)) {
+                return false;
             }
 
-            $image = wp_remote_retrieve_body($xagio_response);
-            return $image;
-        }
+            $content_type = wp_remote_retrieve_header($resp, 'content-type');
+            if (!$content_type || stripos($content_type, 'image/') !== 0) {
+                return false;
+            }
 
-        public static function xagio_fopen_fetch_image($xagio_url)
-        {
-            $image = xagio_file_get_contents($xagio_url, FALSE);
-            return $image;
+            return wp_remote_retrieve_body($resp);
         }