linux4me2

Hi @brisch,

I just uploaded v. 1.4, which I believe addresses all the potential security issues reported by Wordfence and brings the code of Menu In Post up to current WordPress guidelines.

I made a lot of code changes, so although I tested it and debugged it, please let me know if I missed anything.

Thank you again for making me aware of the security vulnerabilities.

Hi Brigitte,

Thanks for letting me know. I was not aware of this.

According to the link you provided, the issue is a cross-site scripting vulnerability that “makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.”

If I understand that correctly, it means that in order to take advantage of the vulnerability, the attacker would have to be someone with login credentials as a contributor or higher for the site. As long as you trust all the users for the site with contributor or higher access, it seems like it would be safe to continue using the plugin until I investigate further and (hopefully) release a patch.

If you have any doubts about the users of the site with such access, I recommend disabling and deleting the plugin until I have released a fix.

I will post back here with my progress.

It looks like you have the CSS in there correctly for the “vop” class, which is set as an attribute for the menu as it should be, and the menu is being rendered in the HTML correctly by Menu In Post, but for some reason I haven’t been able to figure out, your CSS for the list style is being ignored, despite it not showing as overridden (crossed out) in Firefox Developer Tools.

There is a list-style-type: none; further up the hierarchy for .site-footer .container .padder > ul > li, which might prevent your CSS from having an effect since your menu is an unordered list within the unordered list in .padder that makes up the footer, but even when I remove that rule, the list style rules you’ve set don’t work.

According to ChatGPT:

If a parent UL (or LI) has a shorthand like list-style: none (or
list-style-type: none) applied, that can suppress markers for descendant
lists in many browsers, so child ULs may not show bullets even when
their own rules appear in DevTools. The child’s rule can show (not
crossed out) but the marker still won’t render because the ancestor’s
list-style setting prevents the browser from generating markers for the
list subtree.

Resetting the full shorthand on the specific child list fixes it (not
just list-style-type). Example to add to your stylesheet: ul.vop {
list-style: disc outside none !important; }

I couldn’t get that to work on your site

The menu looks like it’s being rendered just fine to me, and your site looks good to me, so if it were me I would probably leave it as is, but if you want some kind of list-item marker there, a possible workaround would be to use a pseudo-element with the following selector:

.vop > li > a::before {
	content: " • ";
}

When I try that, it puts a bullet before each link in your menu and looks pretty good, though when I don’t translate the page to English, it causes your “Privacy Policy” line to wrap.

You’re welcome. I’ll leave this unresolved for now in case you have more questions, and close it in a couple of weeks if I don’t hear from you.