I’ve uploaded a patch/plugin to my GitHub repository here that temporarily solves the issue sanitizing the shortcode output. It’s totally free and GPL licensed.
In the readme.md file is explained what the code does and how to apply the patch (spoiler: is a plugin) 🙂
When the plugin author update the code or someone take care of it you’ll can deactivate and delete the patch.
Hi Fernando !
Well done!
It works perfectly.
Is there an update planned for Twenty20 Image Before-After, or is this plugin permanently discontinued?
I don’t know, the author hasn’t update the plugin 1 year ago and doesn’t answer in the forum. His only active profile is at LinkedIN :/
It would be fine if the author could ask for help.
@fernandot Thank you for the fix.
Hi @netdemo, thank you for your patience — and for flagging this so clearly.
Good news: version 2.0.6 fixes the Stored XSS vulnerability (CVE-2022-4580). All [twenty20] shortcode attributes are now properly validated and escaped (offset, direction, width, image IDs, and the before/after labels), in the shortcode, the widget, and the Elementor widget. No shortcode changes are needed on your side — just update the plugin.
A big thank you to @fernandot for the temporary patch plugin (twenty20-image-before-after-xss-security-patch (https://github.com/fernandotellado/twenty20-image-before-after-xss-security-patch/)) — it protected users while the official fix was in review, and the detailed write-up of the sanitization approach was genuinely helpful. Thank you, Fernando!
Once you’ve updated to 2.0.6, it’s safe to deactivate and delete the temporary patch, and to reactivate Twenty20. Please let me know here if anything looks off after updating.
