XSS Vulnerability in Allure

[clementsm]

I was checking the site I was implementing using the Allure them for the search XSS vulnerability, and it appears to be vulnerable...

You can verify this as follows:

 http://mydomain.com/?s="</title><script language="javscript" type="text/javascript">alert('This Should Not Happen!!!!');</script>"

I have tested against the Default theme to eliminate a wordpress bug (2.9.2) and after checking out the Studiopress code it seems that the function sp_breadcrumb defined in breadcrumbs.php does not use html_entities to sanitize the value of $output (ok, I looked at it really briefly, so that may not be the root cause)

Ok, and a follow up: Simple to fix:

The issue is in breadcrumbs.php, which is in the tools folder (Joost's plugin)

Just add the following line:

$output = htmlentities($output, ENT_QUOTES, get_bloginfo('charset'));

at the end of the file just prior to the following section:

if ($display) {
                echo $prefix.$output.$suffix;
        } else {
                return $prefix.$output.$suffix;
        }
}

?>

And that fixes it. Given that the error is in this file, I would guess that some of the other Studiopress themes are vulnerable to this same thing, but I did not check all the themes.