From ff5ab4ffe0473e14024d158cb9eadc749b8fb49d Mon Sep 17 00:00:00 2001
From: Fraenkiman <frank.pcn@gmail.com>
Date: Mon, 24 Aug 2026 21:09:50 +0200
Subject: [PATCH 1/2] Fixes an 2nd XSS vulnerability

Thank you very much for reporting this, @anhdung1329
---
 fp-plugins/bbcode/plugin.bbcode.php | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/fp-plugins/bbcode/plugin.bbcode.php b/fp-plugins/bbcode/plugin.bbcode.php
index 85d727c3..0df9db9b 100644
--- a/fp-plugins/bbcode/plugin.bbcode.php
+++ b/fp-plugins/bbcode/plugin.bbcode.php
@@ -525,9 +525,11 @@ function do_bbcode_img($action, $attributes, $content, $params, $node_object) {
 		}
 	}
 
-	// Calculating the "loading" attribute of the image.
-	// For details, see https://developer.mozilla.org/en-US/docs/Web/HTML/Element/img#attr-loading
-	// -> "lazy" is default (see https://developer.mozilla.org/en-US/docs/Web/Performance/Lazy_loading)
+	/**
+	 * Calculating the "loading" attribute of the image.
+	 * For details, see https://developer.mozilla.org/en-US/docs/Web/HTML/Element/img#attr-loading
+	 * -> "lazy" is default (see https://developer.mozilla.org/en-US/docs/Web/Performance/Lazy_loading)
+	 */
 	$loadingValue = 'lazy';
 	// Use img attribute value if explicitly set
 	if (isset($attributes ['loading'])) {
@@ -808,7 +810,8 @@ function do_bbcode_color($action, $attributes, $content, $params, $node_object)
 	if ($action == 'validate') {
 		return true;
 	}
-	return '<span style="color:' . $attributes ['default'] . ';">' . $content . '</span>';
+	$color = isset($attributes ['default']) ? $attributes ['default'] : '';
+	return '<span style="color:' . plugin_bbcode_escape_html_attribute($color) . ';">' . $content . '</span>';
 }
 
 /**
@@ -871,7 +874,8 @@ function do_bbcode_size($action, $attributes, $content, $params, $node_object) {
 	if ($action == 'validate') {
 		return true;
 	}
-	return '<span style="font-size:' . $attributes ['default'] . ';">' . $content . '</span>';
+	$size = isset($attributes ['default']) ? $attributes ['default'] : '';
+	return '<span style="font-size:' . plugin_bbcode_escape_html_attribute($size) . ';">' . $content . '</span>';
 }
 
 /**
@@ -887,7 +891,8 @@ function do_bbcode_size($action, $attributes, $content, $params, $node_object) {
  * @return string
  */
 function do_bbcode_align($action, $attr, $content, $params, $node_object) {
-	return '<div style="text-align:' . $attr ['default'] . '">' . $content . '</div>';
+	$align = isset($attr ['default']) ? $attr ['default'] : '';
+	return '<div style="text-align:' . plugin_bbcode_escape_html_attribute($align) . '">' . $content . '</div>';
 }
 
 /**
@@ -958,7 +963,7 @@ function &plugin_bbcode_init() {
 	$bbcode->setGlobalCaseSensitive(false); // don't care about case sensitivity: img == IMG == Img
 	$bbcode->setMixedAttributeTypes(true);
 
-	/*
+	/**
 	 * Tags that are same in BBCode and HTML ([i]...[/i] => <i>...</i>)
 	 */
 	$bbcode_tags_simple = array(
@@ -997,7 +1002,7 @@ function &plugin_bbcode_init() {
 		$bbcode->setCodeFlag($bbtag, 'closetag', BBCODE_CLOSETAG_MUSTEXIST);
 	}
 
-	/*
+	/**
 	 * other tags
 	 */
 	// underlined text
@@ -1568,9 +1573,6 @@ function plugin_bbcode_undoHtml($text) {
 	return $text;
 }
 
-// ------------------------------------------------------------------------------
-// obfuscate mail adresses
-// ------------------------------------------------------------------------------
 /**
  * Obfuscates the given email adress with the given mode.
  * Thanks for spam-me-not.php to Rolf Offermanns!

From 7e5557a8f84c056484a4b49ef431af755e224655 Mon Sep 17 00:00:00 2001
From: Fraenkiman <frank.pcn@gmail.com>
Date: Mon, 24 Aug 2026 21:13:25 +0200
Subject: [PATCH 2/2] Update CHANGELOG.md

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 034e1717..f2ce3338 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -78,7 +78,7 @@
 
 ### Security
 - BBCode plugin: update to version 2.0.4
-    - An XSS vulnerability in the BBCode plugin has been fixed. ([#941](https://github.com/flatpressblog/flatpress/pull/941))
+    - An XSS vulnerability in the BBCode plugin has been fixed. ([#941](https://github.com/flatpressblog/flatpress/pull/941), [#945](https://github.com/flatpressblog/flatpress/pull/945))
 
 ## Themes
 ### Changes