Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : May 6, 2026

CVE-2024-13362: Freemius <= 2.10.1 – Reflected DOM-Based Cross-Site Scripting via url Parameter (easy-facebook-likebox)

CVE ID CVE-2024-13362
Plugin easy-facebook-likebox
Severity Medium (CVSS 6.1)
CWE 79
Vulnerable Version 6.6.5
Patched Version 6.6.6
Disclosed April 29, 2026

Analysis Overview

Atomic Edge analysis of CVE-2024-13362:

This is a reflected DOM-based cross-site scripting (XSS) vulnerability in the Freemius SDK library, affecting versions 2.10.1 and earlier. The vulnerability resides in the ‘url’ parameter handling within Freemius’s checkout/upgrade flow. An unauthenticated attacker can inject arbitrary JavaScript into the page context without server-side escaping, leading to execution when a victim clicks a crafted link. The CVSS score is 6.1 (Medium).

The root cause is insufficient input sanitization and output escaping of the ‘url’ parameter. Freemius processes this parameter in client-side JavaScript to construct dynamic content. The vulnerable code is in the Freemius SDK’s JavaScript files (not shown in the provided diff, as the diff focuses on the Easy Social Feed plugin’s integration). However, the diff shows how plugins using Freemius pass user-controlled URL parameters into Freemius’s functions (e.g., efl_fs()->get_upgrade_url()) without proper validation. The Freemius SDK itself then renders the URL value into the DOM without escaping, allowing script injection.

To exploit this, an attacker crafts a URL like: https://victim-site.com/wp-admin/admin.php?page=easy-facebook-likebox&url=javascript:alert(‘XSS’) or a data URI with malicious JavaScript. When the victim clicks a link or is redirected to this crafted URL, the Freemius SDK reads the ‘url’ parameter from the query string and directly writes it into the page’s innerHTML or similar DOM property. No authentication is required; the attacker only needs to trick the user into visiting the crafted link.

The patch across multiple files in the diff replaces hardcoded external upgrade URLs (e.g., https://easysocialfeed.com/pricing/?utm_source=upgrade-pro) with calls to efl_fs()->get_upgrade_url(), which is a Freemius SDK function. This function introduces proper URL validation and escaping. Additionally, the patch removes the esf_hide_upgrade_menu_item function which output raw CSS with user-controlled data, and adds checks like isset() and empty() to prevent undefined array key access. These changes ensure URLs are generated server-side through validated SDK methods rather than being passed directly from user input.

If exploited, an attacker can execute arbitrary JavaScript in the context of the victim’s WordPress admin dashboard. This can lead to session hijacking, theft of authentication cookies, defacement, redirection to malicious sites, or further privilege escalation by abusing the victim’s session to perform administrative actions. Since the vulnerability is reflected and requires user interaction, the practical impact is limited to targeted attacks against site administrators who can be tricked into clicking a malicious link.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff 
--- a/easy-facebook-likebox/admin/class-esf-admin.php
+++ b/easy-facebook-likebox/admin/class-esf-admin.php
@@ -24,14 +24,6 @@
 				'admin_head',
 				array(
 					$this,
-					'esf_hide_upgrade_menu_item',
-				)
-			);
-
-			add_action(
-				'admin_head',
-				array(
-					$this,
 					'esf_debug_token',
 				)
 			);
@@ -237,7 +229,7 @@
 			);

 			add_submenu_page(
-				null,
+				'hidden',
 				__( 'Welcome', 'easy-facebook-likebox' ),
 				__( 'Welcome', 'easy-facebook-likebox' ),
 				'administrator',
@@ -262,13 +254,6 @@
 			}
 		}

-		public function esf_hide_upgrade_menu_item() {
-			echo '<style>
-				.wp-submenu-wrap li:has(.upgrade-mode) {
-					display: none !important;
-				}
-			</style>';
-		}
 		/**
 		 * Includes view of welcome page
 		 *
@@ -439,7 +424,7 @@
 						<?php esc_html_e( 'before the sale ends!', 'easy-facebook-likebox' ); ?>
 					</p>
 					<div class="fl_support_btns">
-						<a href="https://easysocialfeed.com/pricing/?utm_source=upgrade-pro&utm_medium=facebook-upgrade&utm_campaign=plugin-users"
+						<a href="<?php echo admin_url( 'admin.php?page=feed-them-all-pricing' ) ?>"
 							class="esf_hide_sale button button-primary">
 							<?php esc_html_e( 'Checkout Now', 'easy-facebook-likebox' ); ?>
 						</a>
@@ -756,7 +741,7 @@
 					'coupon'            => 'ESPF17',
 					'discount'          => '17%',
 					'button-text'       => 'Upgrade Now',
-					'button-url'        => 'https://easysocialfeed.com/pricing/?utm_source=upgrade-pro&utm_medium=instagram-upgrade&utm_campaign=plugin-users',
+					'button-url'        => efl_fs()->get_upgrade_url(),
 					'target'            => '',
 				);

--- a/easy-facebook-likebox/admin/views/html-admin-page-easy-social-feed.php
+++ b/easy-facebook-likebox/admin/views/html-admin-page-easy-social-feed.php
@@ -251,7 +251,7 @@

 							<p>
 								<?php
-								if ( strpos( $mt_plugin['active_installs'], 'Just' ) !== false ) {
+								if ( esf_safe_strpos( $mt_plugin['active_installs'], 'Just' ) !== false ) {
 									esc_html_e( $mt_plugin['active_installs'] );
 								} else {
 									esc_html_e( 'Active Installs: ', 'easy-facebook-likebox' );
--- a/easy-facebook-likebox/easy-facebook-likebox.php
+++ b/easy-facebook-likebox/easy-facebook-likebox.php
@@ -4,7 +4,7 @@
  * Plugin Name: Easy Social Feed
  * Plugin URI:        https://wordpress.org/plugins/easy-facebook-likebox
  * Description:       Formerly "Easy Facebook Like Box and Custom Facebook Feed" plugin allows you to easily display custom facebook feed, custom Instagram photos and videos feed, page plugin (like box) on your website using either widget or shortcode to increase facbook fan page likes. You can use the shortcode generator. Additionally, it also now allows you to display the customized facebook feed on your website using the same color scheme of your website. Its completely customizable with lots of optional settings. Its also responsive facebook like box at the same time.
- * Version:           6.6.5
+ * Version:           6.6.6
  * Author:            Easy Social Feed
  * Author URI:        https://easysocialfeed.com/
  * Text Domain:       easy-facebook-likebox
@@ -25,7 +25,7 @@
             global $efl_fs;
             if ( !isset( $efl_fs ) ) {
                 // Include Freemius SDK.
-                require_once dirname( __FILE__ ) . '/freemius/start.php';
+                require_once __DIR__ . '/vendor/freemius/start.php';
                 $efl_fs = fs_dynamic_init( array(
                     'id'              => '4142',
                     'slug'            => 'easy-facebook-likebox',
@@ -58,8 +58,8 @@
     //======================================================================
     // Code for the Main structure
     //======================================================================
-    $options = get_option( 'fta_settings' );
-    $fb_status = $options['plugins']['facebook']['status'];
+    $options = get_option( 'fta_settings', array() );
+    $fb_status = ( isset( $options['plugins']['facebook']['status'] ) ? $options['plugins']['facebook']['status'] : 'activated' );
     if ( isset( $options['plugins']['facebook'] ) ) {
         $fb = $options['plugins']['facebook'];
     } else {
@@ -80,7 +80,7 @@

         add_action( 'widgets_init', 'register_fblx_widget' );
     }
-    $insta_status = $options['plugins']['instagram']['status'];
+    $insta_status = ( isset( $options['plugins']['instagram']['status'] ) ? $options['plugins']['instagram']['status'] : 'activated' );
     if ( isset( $options['plugins']['instagram'] ) ) {
         $insta = $options['plugins']['instagram'];
     } else {
@@ -99,7 +99,7 @@
     }
     if ( !class_exists( 'Feed_Them_All' ) ) {
         class Feed_Them_All {
-            public $version = '6.6.5';
+            public $version = '6.6.6';

             public $fta_slug = 'easy-facebook-likebox';

@@ -205,11 +205,10 @@
              * fta_plugins Holds all the FTA plugins data
              */
             public function fta_plugins() {
-                $Feed_Them_All = new Feed_Them_All();
-                $fb_status = $Feed_Them_All->fta_get_settings();
-                $fb_status = $fb_status['plugins']['facebook']['status'];
-                $insta_status = $Feed_Them_All->fta_get_settings();
-                $insta_status = $insta_status['plugins']['instagram']['status'];
+                $feed_them_all = new Feed_Them_All();
+                $settings = $feed_them_all->fta_get_settings();
+                $fb_status = ( isset( $settings['plugins']['facebook']['status'] ) ? $settings['plugins']['facebook']['status'] : 'activated' );
+                $insta_status = ( isset( $settings['plugins']['instagram']['status'] ) ? $settings['plugins']['instagram']['status'] : 'activated' );
                 if ( empty( $fb_status ) ) {
                     $fb_status = 'activated';
                 }
@@ -245,7 +244,7 @@
              */
             public function fta_get_settings( $key = null ) {
                 $fta_settings = get_option( 'fta_settings', false );
-                if ( $key ) {
+                if ( $key && isset( $fta_settings[$key] ) ) {
                     $fta_settings = $fta_settings[$key];
                 }
                 return $fta_settings;
--- a/easy-facebook-likebox/facebook/admin/class-easy-facebook-likebox-admin.php
+++ b/easy-facebook-likebox/facebook/admin/class-easy-facebook-likebox-admin.php
@@ -384,13 +384,13 @@
             $all_cache = array();
             if ( $efbl_trans_results ) {
                 foreach ( $efbl_trans_results as $efbl_trans_result ) {
-                    if ( strpos( $efbl_trans_result->name, 'efbl' ) !== false && strpos( $efbl_trans_result->name, 'posts' ) !== false && strpos( $efbl_trans_result->name, 'timeout' ) == false ) {
+                    if ( esf_safe_strpos( $efbl_trans_result->name, 'efbl' ) !== false && esf_safe_strpos( $efbl_trans_result->name, 'posts' ) !== false && esf_safe_strpos( $efbl_trans_result->name, 'timeout' ) == false ) {
                         $efbl_trans_posts[$efbl_trans_result->name] = $efbl_trans_result->value;
                     }
-                    if ( strpos( $efbl_trans_result->name, 'efbl' ) !== false && strpos( $efbl_trans_result->name, 'bio' ) !== false && strpos( $efbl_trans_result->name, 'timeout' ) == false ) {
+                    if ( esf_safe_strpos( $efbl_trans_result->name, 'efbl' ) !== false && esf_safe_strpos( $efbl_trans_result->name, 'bio' ) !== false && esf_safe_strpos( $efbl_trans_result->name, 'timeout' ) == false ) {
                         $efbl_trans_bio[$efbl_trans_result->name] = $efbl_trans_result->value;
                     }
-                    if ( strpos( $efbl_trans_result->name, 'efbl' ) !== false && strpos( $efbl_trans_result->name, 'group' ) !== false && strpos( $efbl_trans_result->name, 'timeout' ) == false ) {
+                    if ( esf_safe_strpos( $efbl_trans_result->name, 'efbl' ) !== false && esf_safe_strpos( $efbl_trans_result->name, 'group' ) !== false && esf_safe_strpos( $efbl_trans_result->name, 'timeout' ) == false ) {
                         $efbl_trans_group[$efbl_trans_result->name] = $efbl_trans_result->value;
                     }
                 }
--- a/easy-facebook-likebox/facebook/admin/includes/efbl-customizer-extend.php
+++ b/easy-facebook-likebox/facebook/admin/includes/efbl-customizer-extend.php
@@ -153,7 +153,7 @@
 			<p><?php echo $this->description; ?></p>

 			<p><?php echo __( 'Upgrade today and get a ' . $banner_info['discount'] . ' discount with coupon code <code>' . $banner_info['coupon'] . '</code>', 'easy-facebook-likebox' ); ?> </p>
-			<a href="https://easysocialfeed.com/pricing/?utm_source=upgrade-pro&utm_medium=facebook-upgrade&utm_campaign=plugin-users"
+			<a href="<?php echo efl_fs()->get_upgrade_url(); ?>"
 			   class="fta-upgrade-btn"><?php echo __( 'Upgrade to pro', 'easy-facebook-likebox' ); ?>
 			</a>
 			<?php
--- a/easy-facebook-likebox/facebook/admin/views/html-admin-page-easy-facebook-likebox.php
+++ b/easy-facebook-likebox/facebook/admin/views/html-admin-page-easy-facebook-likebox.php
@@ -10,10 +10,6 @@
 $ESF_Admin   = new ESF_Admin();
 $banner_info = $ESF_Admin->esf_upgrade_banner();

-if($_GET['page'] == 'easy-facebook-likebox'){
-	$banner_info['button-url'] = "https://easysocialfeed.com/pricing/?utm_source=upgrade-pro&utm_medium=facebook-upgrade&utm_campaign=plugin-users";
-}
-
 $fta_settings = $FTA->fta_get_settings();
 if ( isset( $fta_settings['hide_plugin'] ) ) {
 	$hide_plugin = $fta_settings['hide_plugin'];
@@ -234,7 +230,7 @@

 									<p>
 									<?php
-									if ( strpos( $mt_plugin['active_installs'], 'Just' ) !== false ) {
+									if ( esf_safe_strpos( $mt_plugin['active_installs'], 'Just' ) !== false ) {
 											esc_html_e( $mt_plugin['active_installs'] );
 									} else {
 										esc_html_e( 'Active Installs: ', 'easy-facebook-likebox' );
@@ -324,7 +320,7 @@
 				<h5><?php esc_html_e( 'Premium Feature', 'easy-facebook-likebox' ); ?></h5>
 				<p><?php esc_html_e( "We're sorry, posts filter is not included in your plan. Please upgrade to premium version to unlock this and all other cool features.", 'easy-facebook-likebox' ); ?>
 					<a target="_blank"
-					   href="https://easysocialfeed.com/custom-facebook-feed/?utm_source=trydemo&utm_medium=facebook-upgrade&utm_campaign=plugin-user"><?php esc_html_e( 'Check out the demo', 'easy-facebook-likebox' ); ?></a>
+					   href="https://easysocialfeed.com/custom-facebook-feed"><?php esc_html_e( 'Check out the demo', 'easy-facebook-likebox' ); ?></a>
 				</p>
 				<p><?php esc_html_e( 'Upgrade today and get ' . $banner_info['discount'] . ' discount! On the checkout click on "Have a promotional code?', 'easy-facebook-likebox' ); ?></br>
 			   <?php if ( $banner_info['coupon'] ) { ?>
@@ -351,7 +347,7 @@
 				<h5><?php esc_html_e( 'Premium Feature', 'easy-facebook-likebox' ); ?></h5>
 				<p><?php esc_html_e( 'Add load more button at the bottom of each feed to load more posts, events, photos, videos, or albums.', 'easy-facebook-likebox' ); ?>
 					<a target="_blank"
-					   href="https://easysocialfeed.com/custom-facebook-feed/?utm_source=trydemo&utm_medium=facebook-upgrade&utm_campaign=plugin-user"><?php esc_html_e( 'Check out the demo', 'easy-facebook-likebox' ); ?></a>
+					   href="https://easysocialfeed.com/custom-facebook-feed"><?php esc_html_e( 'Check out the demo', 'easy-facebook-likebox' ); ?></a>
 				</p>
 				<p><?php esc_html_e( 'Upgrade today and get  ' . $banner_info['discount'] . ' discount! On the checkout click on "Have a promotional code?', 'easy-facebook-likebox' ); ?></br>
 					<?php if ( $banner_info['coupon'] ) { ?>
@@ -359,7 +355,7 @@
 					<?php } ?>
 				</p>
 				<hr/>
-				<a href="https://easysocialfeed.com/pricing/?utm_source=upgrade-pro&utm_medium=facebook-upgrade&utm_campaign=plugin-users"
+				<a href="<?php echo efl_fs()->get_upgrade_url(); ?>"
 				   class=" btn"><span class="dashicons dashicons-unlock"></span><?php esc_html_e( 'Buy Now', 'easy-facebook-likebox' ); ?>
 				</a>

@@ -380,7 +376,7 @@
 					<?php } ?>
 				</p>
 				<hr/>
-				<a href="https://easysocialfeed.com/pricing/?utm_source=upgrade-pro&utm_medium=facebook-upgrade&utm_campaign=plugin-users"
+				<a href="<?php echo efl_fs()->get_upgrade_url(); ?>"
 				   class=" btn"><span class="dashicons dashicons-unlock"></span><?php esc_html_e( 'Buy Now', 'easy-facebook-likebox' ); ?>
 				</a>

@@ -394,7 +390,7 @@
 				<h5><?php esc_html_e( 'Premium Feature', 'easy-facebook-likebox' ); ?></h5>
 				<p><?php esc_html_e( 'We are sorry grid layout is not included in your plan. Please upgrade to premium version to unlock this and all other cool features.', 'easy-facebook-likebox' ); ?>
 					<a target="_blank"
-					   href="https://easysocialfeed.com/custom-facebook-feed/grid/?utm_source=trydemo&utm_medium=facebook-upgrade&utm_campaign=plugin-user"><?php esc_html_e( 'Check out the demo', 'easy-facebook-likebox' ); ?></a>
+					   href="https://easysocialfeed.com/custom-facebook-feed/grid"><?php esc_html_e( 'Check out the demo', 'easy-facebook-likebox' ); ?></a>
 				</p>
 				<p><?php esc_html_e( 'Upgrade today and get ' . $banner_info['discount'] . ' discount! On the checkout click on "Have a promotional code?', 'easy-facebook-likebox' ); ?></br>
 					<?php if ( $banner_info['coupon'] ) { ?>
@@ -402,7 +398,7 @@
 					<?php } ?>
 				</p>
 				<hr/>
-				<a href="https://easysocialfeed.com/pricing/?utm_source=upgrade-pro&utm_medium=facebook-upgrade&utm_campaign=plugin-users"
+				<a href="<?php echo efl_fs()->get_upgrade_url(); ?>"
 				   class=" btn"><span class="dashicons dashicons-unlock"></span><?php esc_html_e( 'Upgrade to pro', 'easy-facebook-likebox' ); ?>
 				</a>
 			</div>
@@ -415,7 +411,7 @@
 				<h5><?php esc_html_e( 'Premium Feature', 'easy-facebook-likebox' ); ?></h5>
 				<p><?php esc_html_e( 'We are sorry masonry layout is not included in your plan. Please upgrade to premium version to unlock this and all other cool features.', 'easy-facebook-likebox' ); ?>
 					<a target="_blank"
-					   href="https://easysocialfeed.com/custom-facebook-feed/masonry/?utm_source=trydemo&utm_medium=facebook-upgrade&utm_campaign=plugin-user"><?php esc_html_e( 'Check out the demo', 'easy-facebook-likebox' ); ?></a>
+					   href="https://easysocialfeed.com/custom-facebook-feed/masonry"><?php esc_html_e( 'Check out the demo', 'easy-facebook-likebox' ); ?></a>
 				</p>
 				<p><?php esc_html_e( 'Upgrade today and get ' . $banner_info['discount'] . ' discount! On the checkout click on "Have a promotional code?', 'easy-facebook-likebox' ); ?></br>
 					<?php if ( $banner_info['coupon'] ) { ?>
@@ -423,7 +419,7 @@
 					<?php } ?>
 				</p>
 				<hr/>
-				<a href="https://easysocialfeed.com/pricing/?utm_source=upgrade-pro&utm_medium=facebook-upgrade&utm_campaign=plugin-users"
+				<a href="<?php echo efl_fs()->get_upgrade_url(); ?>"
 				   class=" btn"><span class="dashicons dashicons-unlock"></span><?php esc_html_e( 'Upgrade to pro', 'easy-facebook-likebox' ); ?>
 				</a>

@@ -438,7 +434,7 @@
 				<h5><?php esc_html_e( 'Premium Feature', 'easy-facebook-likebox' ); ?></h5>
 				<p><?php esc_html_e( 'We are sorry carousel layout is not included in your plan. Please upgrade to premium version to unlock this and all other cool features.', 'easy-facebook-likebox' ); ?>
 					<a target="_blank"
-					   href="https://easysocialfeed.com/custom-facebook-feed/carousel/?utm_source=trydemo&utm_medium=facebook-upgrade&utm_campaign=plugin-user"><?php esc_html_e( 'Check out the demo', 'easy-facebook-likebox' ); ?></a>
+					   href="https://easysocialfeed.com/custom-facebook-feed/carousel"><?php esc_html_e( 'Check out the demo', 'easy-facebook-likebox' ); ?></a>
 				</p>
 				<p><?php esc_html_e( 'Upgrade today and get ' . $banner_info['discount'] . ' discount! On the checkout click on "Have a promotional code?', 'easy-facebook-likebox' ); ?></br>
 					<?php if ( $banner_info['coupon'] ) { ?>
@@ -446,7 +442,7 @@
 					<?php } ?>
 				</p>
 				<hr/>
-				<a href="https://easysocialfeed.com/pricing/?utm_source=upgrade-pro&utm_medium=facebook-upgrade&utm_campaign=plugin-users"
+				<a href="<?php echo efl_fs()->get_upgrade_url(); ?>"
 				   class=" btn"><span class="dashicons dashicons-unlock"></span><?php esc_html_e( 'Upgrade to pro', 'easy-facebook-likebox' ); ?>
 				</a>

@@ -466,7 +462,7 @@
 					<?php } ?>
 				</p>
 				<hr/>
-				<a href="https://easysocialfeed.com/pricing/?utm_source=upgrade-pro&utm_medium=facebook-upgrade&utm_campaign=plugin-users"
+				<a href="<?php echo efl_fs()->get_upgrade_url(); ?>"
 				   class=" btn"><span class="dashicons dashicons-unlock"></span><?php esc_html_e( 'Upgrade to pro', 'easy-facebook-likebox' ); ?>
 				</a>

@@ -486,7 +482,7 @@
 					<?php } ?>
 				</p>
 				<hr/>
-				<a href="https://easysocialfeed.com/pricing/?utm_source=upgrade-pro&utm_medium=facebook-upgrade&utm_campaign=plugin-users"
+				<a href="<?php echo efl_fs()->get_upgrade_url(); ?>"
 				   class=" btn"><span class="dashicons dashicons-unlock"></span><?php esc_html_e( 'Upgrade to pro', 'easy-facebook-likebox' ); ?>
 				</a>

@@ -506,7 +502,7 @@
 					<?php } ?>
 				</p>
 				<hr/>
-				<a href="https://easysocialfeed.com/pricing/?utm_source=upgrade-pro&utm_medium=facebook-upgrade&utm_campaign=plugin-users"
+				<a href="<?php echo efl_fs()->get_upgrade_url(); ?>"
 				   class=" btn"><span class="dashicons dashicons-unlock"></span><?php esc_html_e( 'Upgrade to pro', 'easy-facebook-likebox' ); ?>
 				</a>

@@ -526,7 +522,7 @@
 					<?php } ?>
 				</p>
 				<hr/>
-				<a href="https://easysocialfeed.com/pricing/?utm_source=upgrade-pro&utm_medium=facebook-upgrade&utm_campaign=plugin-users"
+				<a href="<?php echo efl_fs()->get_upgrade_url(); ?>"
 				   class="btn"><span class="dashicons dashicons-unlock"></span><?php esc_html_e( 'Upgrade to pro', 'easy-facebook-likebox' ); ?>
 				</a>

@@ -541,10 +537,10 @@
 		<div class="mif-modal-content"><span class="mif-lock-icon"><span class="dashicons dashicons-lock"></span></span>
 			<h5><?php esc_html_e( 'Multifeed', 'easy-facebook-likebox' ); ?></h5>
 			<p><?php esc_html_e( 'The Multifeed gives you the ability to display multiple posts or events from multiple Facebook accounts in one single feed ordered by date.', 'easy-facebook-likebox' ); ?>
-				<a target="_blank" href="https://easysocialfeed.com/custom-facebook-feed/multifeed/?utm_source=trydemo&utm_medium=facebook-upgrade&utm_campaign=plugin-user"><?php esc_html_e( 'Check out the demo', 'easy-facebook-likebox' ); ?></a>
+				<a target="_blank" href="https://easysocialfeed.com/custom-facebook-feed/multifeed"><?php esc_html_e( 'Check out the demo', 'easy-facebook-likebox' ); ?></a>
 			</p>
 			<hr>
-			<a href="https://easysocialfeed.com/pricing/?utm_source=upgrade-pro&utm_medium=facebook-upgrade&utm_campaign=plugin-users"
+			<a href="<?php echo esc_url( efl_fs()->get_upgrade_url() ); ?>"
 			   class=" btn"><span class="dashicons dashicons-unlock"></span><?php esc_html_e( 'Get Started', 'easy-facebook-likebox' ); ?>
 			</a>
 		</div>
--- a/easy-facebook-likebox/facebook/admin/views/html-how-to-use-tab.php
+++ b/easy-facebook-likebox/facebook/admin/views/html-how-to-use-tab.php
@@ -9,7 +9,7 @@
 global $efbl_skins;
 $FTA = new Feed_Them_All();
 $fta_settings = $FTA->fta_get_settings();
-$efbl_default_likebox_notice = '';
+$first_page_id = '';
 ?>
 <div id="efbl-general" class="col s12 efbl_tab_c slideLeft <?php
 echo esc_attr( ( $active_tab == 'efbl-general' ? 'active' : '' ) );
@@ -128,7 +128,7 @@
 do_action( 'esf_fb_page_attr' );
 ?>>
 												<?php
-if ( $fta_settings['plugins']['facebook']['approved_pages'] ) {
+if ( isset( $fta_settings['plugins']['facebook']['approved_pages'] ) && !empty( $fta_settings['plugins']['facebook']['approved_pages'] ) ) {
     $i = 0;
     foreach ( $fta_settings['plugins']['facebook']['approved_pages'] as $efbl_page ) {
         $i++;
@@ -178,7 +178,9 @@
 											<?php
 if ( !class_exists( 'Esf_Multifeed_Facebook_Frontend' ) ) {
     ?>
-												<a href="https://easysocialfeed.com/pricing/?utm_source=upgrade-pro&utm_medium=facebook-upgrade&utm_campaign=plugin-users"><?php
+												<a href="<?php
+    echo esc_url( efl_fs()->get_upgrade_url() );
+    ?>"><?php
     esc_html_e( 'Multifeed: Display posts from multiple pages in single feed (pro-feature)', 'easy-facebook-likebox' );
     ?></a>
 											<?php
@@ -498,7 +500,11 @@
 								<span class="mif_detail_head"><?php
 esc_html_e( 'Filter posts', 'easy-facebook-likebox' );
 ?>
-									<a href="https://easysocialfeed.com/pricing/?utm_source=upgrade-pro&utm_medium=facebook-upgrade&utm_campaign=plugin-users">(<?php esc_html_e( 'pro', 'easy-facebook-likebox' );?>)</a>
+									<a href="<?php
+echo esc_url( efl_fs()->get_upgrade_url() );
+?>">(<?php
+esc_html_e( 'pro', 'easy-facebook-likebox' );
+?>)</a>
 								</span>
 							</div>
 							<div class="collapsible-body">
@@ -513,7 +519,9 @@
 								<span class="mif_detail_head"><?php
 esc_html_e( 'Events Filter', 'easy-facebook-likebox' );
 ?> <a
-											href="https://easysocialfeed.com/pricing/?utm_source=upgrade-pro&utm_medium=facebook-upgrade&utm_campaign=plugin-users">(<?php
+											href="<?php
+echo esc_url( efl_fs()->get_upgrade_url() );
+?>">(<?php
 esc_html_e( 'pro', 'easy-facebook-likebox' );
 ?>)</a></span>
 							</div>
@@ -594,7 +602,9 @@
 								<span class="mif_detail_head"><?php
 esc_html_e( 'Load More', 'easy-facebook-likebox' );
 ?> <a
-											href="https://easysocialfeed.com/pricing/?utm_source=upgrade-pro&utm_medium=facebook-upgrade&utm_campaign=plugin-users">(<?php
+											href="<?php
+echo esc_url( efl_fs()->get_upgrade_url() );
+?>">(<?php
 esc_html_e( 'pro', 'easy-facebook-likebox' );
 ?>)</a></span>
 							</div>
@@ -610,7 +620,9 @@
 								<span class="mif_detail_head"><?php
 esc_html_e( 'Show live stream only', 'easy-facebook-likebox' );
 ?> <a
-											href="https://easysocialfeed.com/pricing/?utm_source=upgrade-pro&utm_medium=facebook-upgrade&utm_campaign=plugin-users">(<?php
+											href="<?php
+echo esc_url( efl_fs()->get_upgrade_url() );
+?>">(<?php
 esc_html_e( 'pro', 'easy-facebook-likebox' );
 ?>)</a></span>
 							</div>
--- a/easy-facebook-likebox/facebook/admin/views/html-likebox-tab.php
+++ b/easy-facebook-likebox/facebook/admin/views/html-likebox-tab.php
@@ -46,9 +46,6 @@
 									class="dashicons dashicons-admin-page right"></span>
 						</a>
 					</div>
-					<?php
-esc_html_e( $efbl_default_likebox_notice );
-?>
 					<h5 class="efbl_more_head"><?php
 esc_html_e( 'Need More Options?', 'easy-facebook-likebox' );
 ?></h5>
@@ -340,7 +337,9 @@
 					<span class="mif_detail_head"><?php
 esc_html_e( 'Tabs', 'easy-facebook-likebox' );
 ?> <a
-								href="https://easysocialfeed.com/pricing/?utm_source=upgrade-pro&utm_medium=facebook-upgrade&utm_campaign=plugin-users">(<?php
+								href="<?php
+echo esc_url( efl_fs()->get_upgrade_url() );
+?>">(<?php
 esc_html_e( 'pro', 'easy-facebook-likebox' );
 ?>)</a></span>
 				</div>
--- a/easy-facebook-likebox/facebook/admin/views/html-moderate-tab.php
+++ b/easy-facebook-likebox/facebook/admin/views/html-moderate-tab.php
@@ -22,7 +22,7 @@
 									class="icons efbl_moderate_page_id">
 								<?php
 								$type = 'page';
-								if ( $fta_settings['plugins']['facebook']['approved_pages'] ) {
+								if ( isset( $fta_settings['plugins']['facebook']['approved_pages'] ) && ! empty( $fta_settings['plugins']['facebook']['approved_pages'] ) ) {
 									$i = 0;
 									foreach ( $fta_settings['plugins']['facebook']['approved_pages'] as $efbl_page ) {
 										$i++;
@@ -101,10 +101,10 @@
 						$banner_info = $ESF_Admin->esf_upgrade_banner();
 						?>
 						<div class="efbl-moderate-pro">
-							<a href="https://easysocialfeed.com/pricing/?utm_source=trydemo&utm_medium=facebook-upgrade&utm_campaign=plugin-users"
+							<a href="<?php echo efl_fs()->get_upgrade_url(); ?>&trial=true"
 							   class="trial-btn"><?php esc_html_e( 'Free 7-day PRO trial', 'easy-facebook-likebox' ); ?>
 							</a>
-							<a href="https://easysocialfeed.com/pricing/?utm_source=upgrade-pro&utm_medium=facebook-upgrade&utm_campaign=plugin-userss"
+							<a href="<?php echo efl_fs()->get_upgrade_url(); ?>"
 							   class=" btn pro-btn"><span class="dashicons dashicons-unlock right"></span><?php esc_html_e( 'Upgrade to pro', 'easy-facebook-likebox' ); ?>
 							</a>
 							<p><?php esc_html_e( 'Upgrade today and get ' . $banner_info['discount'] . ' discount! On the checkout click on "Have a promotional code?" and enter', 'easy-facebook-likebox' ); ?>
--- a/easy-facebook-likebox/facebook/frontend/includes/Mobile_Detect.php
+++ b/easy-facebook-likebox/facebook/frontend/includes/Mobile_Detect.php
@@ -726,7 +726,7 @@
 		 */
 		public function getHttpHeader( $header ) {
 			//are we using PHP-flavored headers?
-			if ( strpos( $header, '_' ) === false ) {
+			if ( esf_safe_strpos( $header, '_' ) === false ) {
 				$header = str_replace( '-', '_', $header );
 				$header = strtoupper( $header );
 			}
@@ -941,7 +941,7 @@
 				if ( isset( $this->httpHeaders[ $mobileHeader ] ) ) {
 					if ( is_array( $matchType['matches'] ) ) {
 						foreach ( $matchType['matches'] as $_match ) {
-							if ( strpos( $this->httpHeaders[ $mobileHeader ], $_match ) !== false ) {
+							if ( esf_safe_strpos( $this->httpHeaders[ $mobileHeader ], $_match ) !== false ) {
 								return true;
 							}
 						}
--- a/easy-facebook-likebox/facebook/frontend/includes/core-functions.php
+++ b/easy-facebook-likebox/facebook/frontend/includes/core-functions.php
@@ -40,7 +40,7 @@
                 $difference %= $value;
                 $retval .= (( $retval ? ' ' : '' )) . $time . ' ';
                 $retval .= ( $time > 1 ? $date_time_strings[$key . 's'] : $date_time_strings[$key] );
-                $granularity--;
+                --$granularity;
             }
             if ( $granularity == '0' ) {
                 break;
@@ -72,6 +72,10 @@
 }
 if ( !function_exists( 'efbl_parse_url' ) ) {
     function efbl_parse_url(  $url  ) {
+        // check if url is valid
+        if ( !filter_var( $url, FILTER_VALIDATE_URL ) && !empty( $url ) ) {
+            return $url;
+        }
         $fb_url = parse_url( $url );
         $fanpage_url = str_replace( '/', '', $fb_url['path'] );
         return $fanpage_url;
@@ -175,7 +179,7 @@
             foreach ( $array as $efbl_reaction ) {
                 $efbl_reaction = (array) $efbl_reaction;
                 if ( $needle == $efbl_reaction['type'] ) {
-                    $efbl_reaction_count++;
+                    ++$efbl_reaction_count;
                     $efbl_reaction_array['data'][] = $efbl_reaction;
                 }
             }
@@ -521,7 +525,7 @@
      *
      * @return string
      */
-    function efbl_eventdate(  $original, $date_format, $custom_date  ) {
+    function efbl_eventdate(  $original, $date_format = '', $custom_date = ''  ) {
         switch ( $date_format ) {
             case '2':
                 $print = date_i18n( '<k>F jS, </k>g:ia', $original );
@@ -636,4 +640,19 @@
         return $efbl_bio_data;
     }

+}
+if ( !function_exists( 'efbl_has_connected_account' ) ) {
+    /**
+     * Check if the page has connected account
+     * @return bool
+     */
+    function efbl_has_connected_account() {
+        $FTA = new Feed_Them_All();
+        $fta_settings = $FTA->fta_get_settings();
+        if ( isset( $fta_settings['plugins']['facebook']['approved_pages'] ) && !empty( $fta_settings['plugins']['facebook']['approved_pages'] ) ) {
+            return true;
+        }
+        return false;
+    }
+
 }
 No newline at end of file
--- a/easy-facebook-likebox/facebook/frontend/views/feed.php
+++ b/easy-facebook-likebox/facebook/frontend/views/feed.php
@@ -15,12 +15,16 @@
  * @copyright 2020 MaltaThemes
  */
 $instance = apply_filters( 'efbl_feed_shortcode_params', $instance );
+if ( !efbl_has_connected_account() ) {
+    echo '<div class="efbl_feed_wraper"><p class="efbl_error_msg">' . __( 'Whoops! No connected account found. Try connecting an account first.', 'easy-facebook-likebox' ) . '</p></div>';
+    return;
+}
 global $post;
 $efbl_demo_page_id = efbl_demo_page_id();
 $is_public_page = '';
 $is_multifeed = false;
 // if "," exists in fanpage_id, then it's a multifeed
-if ( isset( $instance['fanpage_id'] ) && !empty( $instance['fanpage_id'] ) && strpos( $instance['fanpage_id'], ',' ) !== false ) {
+if ( isset( $instance['fanpage_id'] ) && !empty( $instance['fanpage_id'] ) && esf_safe_strpos( $instance['fanpage_id'], ',' ) !== false ) {
     $account_ids = explode( ',', $instance['fanpage_id'] );
     if ( is_array( $account_ids ) && count( $account_ids ) > 1 ) {
         $is_multifeed = true;
@@ -134,18 +138,22 @@
     } else {
         $efbl_number_of_cols = 3;
     }
+    $load_description_action = 'efbl_load_more_description';
     ?>

 	<div class="efbl_feeds_holder efbl_feeds_<?php
     esc_attr_e( $layout );
+    ?> <?php
     esc_attr_e( $carousel_class );
+    ?> <?php
     do_action( 'efbl_feed_custom_class' );
-    ?>" <?php
+    ?>
+	" <?php
     esc_attr_e( $carousel_atts );
     ?> <?php
     do_action( 'efbl_feed_custom_attrs' );
     ?>
-		    data-template="<?php
+			data-template="<?php
     esc_attr_e( $layout );
     ?>">
 		<?php
@@ -182,11 +190,9 @@
                 $feed_type = '';
             }
             if ( efl_fs()->is_plan( 'facebook_premium', true ) or efl_fs()->is_plan( 'combo_premium', true ) ) {
-            } else {
-                if ( !$is_moderate ) {
-                    if ( isset( $story->story ) && strpos( $story->story, 'live' ) !== false ) {
-                        continue;
-                    }
+            } elseif ( !$is_moderate ) {
+                if ( isset( $story->story ) && esf_safe_strpos( $story->story, 'live' ) !== false ) {
+                    continue;
                 }
             }
             if ( isset( $story->title ) ) {
@@ -335,7 +341,7 @@
                 $j = 0;
                 if ( $text_tags ) {
                     foreach ( $text_tags as $message_tag ) {
-                        $j++;
+                        ++$j;
                         $tag_name = $message_tag->name;
                         $tag_link = '<a href="https://facebook.com/' . $message_tag->id . '" target="' . $link_target . '">' . $message_tag->name . '</a>';
                         $post_text = str_replace( $tag_name, $tag_link, $post_text );
@@ -362,6 +368,9 @@
             if ( $filter == 'albums' && $story->count == 0 ) {
                 continue;
             }
+            if ( $filter == 'albums' && !isset( $story->photos->data ) ) {
+                continue;
+            }
             $video_iframe = null;
             if ( isset( $story->attachments->data['0']->type ) ) {
                 $story_attach_type = $story->attachments->data['0']->type;
@@ -394,7 +403,6 @@
                 'target' => $link_target,
             ) );
             $efbl_feed_comments_popup_url = '';
-            $load_description_action = 'efbl_load_more_description';
             $efbl_reactions_modal = '';
             if ( isset( $story->reactions->data ) ) {
                 $reactions_arr = $story->reactions->data;
@@ -426,9 +434,9 @@
                 }
             }
             require $efbl_templateurl;
-            $i++;
+            ++$i;
             if ( 'added_photos' == $feed_type || 'added_video' == $feed_type ) {
-                $pi++;
+                ++$pi;
             }
             if ( $i == $post_limit ) {
                 break;
@@ -466,37 +474,33 @@
 				<?php
     }
     // If no posts found
-} else {
-    if ( isset( $efbl_queried_data['error'] ) && !empty( $efbl_queried_data['error'] ) ) {
-        ?>
+} elseif ( isset( $efbl_queried_data['error'] ) && !empty( $efbl_queried_data['error'] ) ) {
+    ?>
 					<p class="efbl_error_msg"> <?php
-        esc_html_e( $efbl_queried_data['error'] );
-        ?> </p>
+    esc_html_e( $efbl_queried_data['error'] );
+    ?> </p>
 				<?php
+} elseif ( $filter ) {
+    if ( isset( $events_filter ) && $events_filter == 'upcoming' ) {
+        $events_filter_name = __( 'upcoming', 'easy-facebook-likebox' );
     } else {
-        if ( $filter ) {
-            if ( isset( $events_filter ) && $events_filter == 'upcoming' ) {
-                $events_filter_name = __( 'upcoming', 'easy-facebook-likebox' );
-            } else {
-                $events_filter_name = '';
-            }
-            ?>
+        $events_filter_name = '';
+    }
+    ?>

 						<p class="efbl_error_msg"><?php
-            esc_html_e( "{$efbl_bio_data->name} don't have any {$events_filter_name} {$filter}.", 'easy-facebook-likebox' );
-            ?> </p>
+    esc_html_e( "{$efbl_bio_data->name} don't have any {$events_filter_name} {$filter}.", 'easy-facebook-likebox' );
+    ?> </p>

-					<?php
-        } else {
-            ?>
+				<?php
+} else {
+    ?>

 						<p class="efbl_error_msg"><?php
-            echo apply_filters( 'efbl_error_message', __( 'Whoops! Nothing found according to your query, Try changing fanpage ID.', 'easy-facebook-likebox' ) );
-            ?> </p>
+    echo apply_filters( 'efbl_error_message', __( 'Whoops! Nothing found according to your query, Try changing fanpage ID.', 'easy-facebook-likebox' ) );
+    ?> </p>

 					<?php
-        }
-    }
 }
 ?>

--- a/easy-facebook-likebox/facebook/frontend/views/templates/template-halfwidth.php
+++ b/easy-facebook-likebox/facebook/frontend/views/templates/template-halfwidth.php
@@ -6,6 +6,7 @@
 if ( !defined( 'ABSPATH' ) ) {
     exit;
 }
+$efbl_event_date_formatting = '';
 if ( $is_album_feed ) {
 } else {
     $efbl_ver = 'free';
@@ -59,7 +60,7 @@
 												<?php
                 esc_attr_e( $efbl_free_popup_type );
                 ?>
-							 data-storylink="
+							data-storylink="
 							<?php
                 echo esc_url( $story_link );
                 ?>
@@ -79,7 +80,7 @@
 							<?php
                 esc_attr_e( $efbl_free_popup_class );
                 ?>
-							 efbl-cff-item_number-
+							efbl-cff-item_number-
 							<?php
                 esc_attr_e( $pi );
                 ?>
@@ -91,7 +92,7 @@
                     ?>

 										<i class="icon icon-esf-plus efbl-plus"
-										   aria-hidden="true"></i>
+											aria-hidden="true"></i>

 									<?php
                 }
@@ -100,13 +101,13 @@
                 if ( $feed_type == 'added_video' || $feed_attachment_type == 'video_inline' ) {
                     ?>
 										<i class="icon icon-esf-clone icon-esf-video-camera"
-										   aria-hidden="true"></i>
+											aria-hidden="true"></i>
 										<?php
                 }
                 if ( isset( $story->attachments->data['0']->subattachments->data ) && !empty( $story->attachments->data['0']->subattachments->data ) ) {
                     ?>
 										<i class="icon icon-esf-clone efbl_multimedia"
-										   aria-hidden="true"></i>
+											aria-hidden="true"></i>
 									<?php
                 }
                 ?>
@@ -114,7 +115,7 @@
 								<img alt="<?php
                 esc_attr_e( $story_name );
                 ?>"
-									 src="<?php
+									src="<?php
                 echo esc_url( $story->attachments->data[0]->media->image->src );
                 ?>"/>
 								<div class="efbl-overlay">
@@ -125,7 +126,7 @@
                     ?>

 										<i class="icon icon-esf-plus efbl-plus"
-										   aria-hidden="true"></i>
+											aria-hidden="true"></i>

 										<?php
                 }
@@ -134,13 +135,13 @@
                 if ( $feed_type == 'added_video' ) {
                     ?>
 										<i class="icon icon-esf-clone icon-esf-video-camera"
-										   aria-hidden="true"></i>
+											aria-hidden="true"></i>
 										<?php
                 }
                 if ( isset( $story->attachments->data['0']->subattachments->data ) && !empty( $story->attachments->data['0']->subattachments->data ) ) {
                     ?>
 										<i class="icon icon-esf-clone efbl_multimedia"
-										   aria-hidden="true"></i>
+											aria-hidden="true"></i>
 										<?php
                 }
                 ?>
@@ -176,17 +177,17 @@
 									<a href="https://facebook.com/<?php
                 esc_attr_e( $page_id );
                 ?>"
-									   title="<?php
+										title="<?php
                 esc_attr_e( $story_name );
                 ?>"
-									   rel="nofollow"
-									   target="<?php
+										rel="nofollow"
+										target="<?php
                 esc_attr_e( $link_target );
                 ?>">
 										<img alt="<?php
                 esc_attr_e( $story_name );
                 ?>"
-											 src="<?php
+											src="<?php
                 echo esc_url( $auth_img_src );
                 ?>"/></a>
 								</div>
@@ -207,7 +208,7 @@
                 ?>
 											<div class="efbl-verified-status">
 												<i class="icon icon-esf-check"
-												   aria-hidden="true"></i>
+													aria-hidden="true"></i>
 											</div>
 										<?php
             }
@@ -238,8 +239,8 @@
 								<a href="<?php
             echo esc_url( $story_link );
             ?>"
-								   rel="nofollow"
-								   target="<?php
+									rel="nofollow"
+									target="<?php
             esc_attr_e( $link_target );
             ?>">
 									<?php
@@ -333,9 +334,9 @@
 					<a href="<?php
                 echo esc_url( $story->attachments->data['0']->url );
                 ?>"
-					   class="efbl_link_image"
-					   rel="nofollow"
-					   target="<?php
+						class="efbl_link_image"
+						rel="nofollow"
+						target="<?php
                 esc_attr_e( $link_target );
                 ?>"><img
 								alt="<?php
@@ -372,17 +373,17 @@
 									<a href="https://facebook.com/<?php
                 esc_attr_e( $page_id );
                 ?>"
-									   title="<?php
+										title="<?php
                 esc_attr_e( $story_name );
                 ?>"
-									   rel="nofollow"
-									   target="<?php
+										rel="nofollow"
+										target="<?php
                 esc_attr_e( $link_target );
                 ?>">
 										<img alt="<?php
                 esc_attr_e( $story_name );
                 ?>"
-											 src="<?php
+											src="<?php
                 echo esc_url( $auth_img_src );
                 ?>"/></a>
 								</div>
@@ -403,7 +404,7 @@
                 ?>
 											<div class="efbl-verified-status">
 												<i class="icon icon-esf-check"
-												   aria-hidden="true"></i>
+													aria-hidden="true"></i>
 											</div>
 										<?php
             }
@@ -460,8 +461,8 @@
 							<a href="<?php
         echo esc_url( $story->attachments->data['0']->url );
         ?>"
-							   rel="nofollow"
-							   target="<?php
+								rel="nofollow"
+								target="<?php
         esc_attr_e( $link_target );
         ?>">
 								<?php
@@ -503,19 +504,19 @@
             ?>?action=efbl_generate_popup_html" <?php
             esc_attr_e( $efbl_free_popup_type );
             ?>
-						   data-storylink="<?php
+							data-storylink="<?php
             echo esc_url( $story_link );
             ?>"
-						   data-linktext="<?php
+							data-linktext="<?php
             echo __( 'Read full story', 'easy-facebook-likebox' );
             ?>"
-						   data-caption="<?php
+							data-caption="<?php
             echo htmlentities( $post_text );
             ?>"
-						   data-itemnumber="<?php
+							data-itemnumber="<?php
             esc_attr_e( $pi );
             ?>"
-						   class="efbl_feed_popup <?php
+							class="efbl_feed_popup <?php
             esc_attr_e( $efbl_free_popup_class );
             ?> efbl-cff-item_number-<?php
             esc_attr_e( $pi );
@@ -523,8 +524,8 @@
 							<img src="<?php
             echo esc_url( $feed_img );
             ?>"
-								 class="img-responsive"
-								 alt="<?php
+								class="img-responsive"
+								alt="<?php
             esc_attr_e( $story_from_name );
             ?>"/>
 							<div class="efbl-overlay">
@@ -535,7 +536,7 @@
                 ?>

 									<i class="icon icon-esf-plus efbl-plus"
-									   aria-hidden="true"></i>
+										aria-hidden="true"></i>

 								<?php
             }
@@ -544,13 +545,13 @@
             if ( $feed_type == 'added_video' ) {
                 ?>
 									<i class="icon icon-esf-clone icon-esf-video-camera"
-									   aria-hidden="true"></i>
+										aria-hidden="true"></i>
 									<?php
             }
             if ( isset( $story->attachments->data['0']->subattachments->data ) && !empty( $story->attachments->data['0']->subattachments->data ) ) {
                 ?>
 									<i class="icon icon-esf-clone efbl_multimedia"
-									   aria-hidden="true"></i>
+										aria-hidden="true"></i>
 								<?php
             }
             ?>
@@ -580,17 +581,17 @@
 									<a href="https://facebook.com/<?php
                 esc_attr_e( $page_id );
                 ?>"
-									   title="<?php
+										title="<?php
                 esc_attr_e( $story_name );
                 ?>"
-									   rel="nofollow"
-									   target="<?php
+										rel="nofollow"
+										target="<?php
                 esc_attr_e( $link_target );
                 ?>">
 										<img alt="<?php
                 esc_attr_e( $story_name );
                 ?>"
-											 src="<?php
+											src="<?php
                 echo esc_url( $auth_img_src );
                 ?>"/></a>
 								</div>
@@ -611,7 +612,7 @@
                 ?>
 											<div class="efbl-verified-status">
 												<i class="icon icon-esf-check"
-												   aria-hidden="true"></i>
+													aria-hidden="true"></i>
 											</div>
 										<?php
             }
@@ -641,8 +642,8 @@
 								<a href="https://www.facebook.com<?php
             echo esc_url( $story->permalink_url );
             ?>"
-								   rel="nofollow"
-								   target="<?php
+									rel="nofollow"
+									target="<?php
             esc_attr_e( $link_target );
             ?>">
 									<?php
@@ -693,8 +694,8 @@
 								<a href="<?php
             echo esc_url( $story->link );
             ?>"
-								   rel="nofollow"
-								   target="<?php
+									rel="nofollow"
+									target="<?php
             esc_attr_e( $link_target );
             ?>">
 									<?php
@@ -758,17 +759,17 @@
 									<a href="https://facebook.com/<?php
                     esc_attr_e( $page_id );
                     ?>"
-									   rel="nofollow"
-									   title="<?php
+										rel="nofollow"
+										title="<?php
                     esc_attr_e( $story_name );
                     ?>"
-									   target="<?php
+										target="<?php
                     esc_attr_e( $link_target );
                     ?>">
 										<img alt="<?php
                     esc_attr_e( $story_name );
                     ?>"
-											 src="<?php
+											src="<?php
                     echo esc_url( $auth_img_src );
                     ?>"/></a>
 								</div>
@@ -789,7 +790,7 @@
                     ?>
 											<div class="efbl-verified-status">
 												<i class="icon icon-esf-check"
-												   aria-hidden="true"></i>
+													aria-hidden="true"></i>
 											</div>
 										<?php
                 }
--- a/easy-facebook-likebox/facebook/includes/easy-custom-facebook-feed-widget.php
+++ b/easy-facebook-likebox/facebook/includes/easy-custom-facebook-feed-widget.php
@@ -294,7 +294,9 @@
 				<?php
         echo __( "We're sorry, posts filter is not included in your plan. Please upgrade to premium version to unlock this and all other cool features. ", 'easy-facebook-likebox' );
         ?>
-					<a href="https://easysocialfeed.com/pricing/?utm_source=upgrade-pro&utm_medium=facebook-upgrade&utm_campaign=plugin-users"> <?php
+					<a href="<?php
+        echo esc_url( efl_fs()->get_upgrade_url() );
+        ?>"> <?php
         echo __( 'Upgrade to PRO', 'easy-facebook-likebox' );
         ?> </a>
 					<?php
@@ -438,7 +440,9 @@
 					<?php
             _e( "We're sorry, load more feature is not included in your plan. Please upgrade to premium version to unlock this and all other cool features.", 'easy-facebook-likebox' );
             ?>
-					<a href="https://easysocialfeed.com/pricing/?utm_source=upgrade-pro&utm_medium=facebook-upgrade&utm_campaign=plugin-users>"><?php
+					<a href="<?php
+            echo esc_url( efl_fs()->get_upgrade_url() );
+            ?>"><?php
             _e( 'Upgrade to PRO', 'easy-facebook-likebox' );
             ?></a>
 				</p>
@@ -459,7 +463,9 @@
 				<?php
             _e( "We're sorry, live stream feature is not included in your plan. Please upgrade to premium version to unlock this and all other cool features.", 'easy-facebook-likebox' );
             ?>
-				<a href="https://easysocialfeed.com/pricing/?utm_source=upgrade-pro&utm_medium=facebook-upgrade&utm_campaign=plugin-users"><?php
+				<a href="<?php
+            echo esc_url( efl_fs()->get_upgrade_url() );
+            ?>"><?php
             _e( 'Upgrade to PRO', 'easy-facebook-likebox' );
             ?></a>
 			</p>
--- a/easy-facebook-likebox/facebook/includes/easy-facebook-page-plugin-widget.php
+++ b/easy-facebook-likebox/facebook/includes/easy-facebook-page-plugin-widget.php
@@ -115,7 +115,7 @@
 			<p>
 			<?php
         echo __( "We're sorry, Tabs feature is not included in your plan. Please upgrade to premium version to unlock this and all other cool features. ", 'easy-facebook-likebox' );
-        echo '<a href="https://easysocialfeed.com/pricing/?utm_source=upgrade-pro&utm_medium=facebook-upgrade&utm_campaign=plugin-users">' . __( 'Upgrade to PRO', 'easy-facebook-likebox' ) . '</a></p>';
+        echo '<a href="' . efl_fs()->get_upgrade_url() . '">' . __( 'Upgrade to PRO', 'easy-facebook-likebox' ) . '</a></p>';
         ?>

 		<p>
--- a/easy-facebook-likebox/freemius/assets/css/admin/index.php
+++ b/easy-facebook-likebox/freemius/assets/css/admin/index.php
@@ -1,3 +0,0 @@
-<?php
-	// Silence is golden.
-	// Hide file structure from users on unprotected servers.
 No newline at end of file
--- a/easy-facebook-likebox/freemius/assets/css/index.php
+++ b/easy-facebook-likebox/freemius/assets/css/index.php
@@ -1,3 +0,0 @@
-<?php
-	// Silence is golden.
-	// Hide file structure from users on unprotected servers.
 No newline at end of file
--- a/easy-facebook-likebox/freemius/assets/img/index.php
+++ b/easy-facebook-likebox/freemius/assets/img/index.php
@@ -1,3 +0,0 @@
-<?php
-	// Silence is golden.
-	// Hide file structure from users on unprotected servers.
 No newline at end of file
--- a/easy-facebook-likebox/freemius/assets/index.php
+++ b/easy-facebook-likebox/freemius/assets/index.php
@@ -1,3 +0,0 @@
-<?php
-	// Silence is golden.
-	// Hide file structure from users on unprotected servers.
 No newline at end of file
--- a/easy-facebook-likebox/freemius/assets/js/index.php
+++ b/easy-facebook-likebox/freemius/assets/js/index.php
@@ -1,3 +0,0 @@
-<?php
-	// Silence is golden.
-	// Hide file structure from users on unprotected servers.
 No newline at end of file
--- a/easy-facebook-likebox/freemius/config.php
+++ b/easy-facebook-likebox/freemius/config.php
@@ -1,391 +0,0 @@
-<?php
-    /**
-     * @package     Freemius
-     * @copyright   Copyright (c) 2015, Freemius, Inc.
-     * @license     https://www.gnu.org/licenses/gpl-3.0.html GNU General Public License Version 3
-     * @since       1.0.4
-     */
-
-    if ( ! defined( 'ABSPATH' ) ) {
-        exit;
-    }
-
-    if ( ! defined( 'WP_FS__SLUG' ) ) {
-        define( 'WP_FS__SLUG', 'freemius' );
-    }
-    if ( ! defined( 'WP_FS__DEV_MODE' ) ) {
-        define( 'WP_FS__DEV_MODE', false );
-    }
-
-    #--------------------------------------------------------------------------------
-    #region API Connectivity Issues Simulation
-    #--------------------------------------------------------------------------------
-
-    if ( ! defined( 'WP_FS__SIMULATE_NO_API_CONNECTIVITY' ) ) {
-        define( 'WP_FS__SIMULATE_NO_API_CONNECTIVITY', false );
-    }
-    if ( ! defined( 'WP_FS__SIMULATE_NO_CURL' ) ) {
-        define( 'WP_FS__SIMULATE_NO_CURL', false );
-    }
-    if ( ! defined( 'WP_FS__SIMULATE_NO_API_CONNECTIVITY_CLOUDFLARE' ) ) {
-        define( 'WP_FS__SIMULATE_NO_API_CONNECTIVITY_CLOUDFLARE', false );
-    }
-    if ( ! defined( 'WP_FS__SIMULATE_NO_API_CONNECTIVITY_SQUID_ACL' ) ) {
-        define( 'WP_FS__SIMULATE_NO_API_CONNECTIVITY_SQUID_ACL', false );
-    }
-    if ( WP_FS__SIMULATE_NO_CURL ) {
-        define( 'FS_SDK__SIMULATE_NO_CURL', true );
-    }
-    if ( WP_FS__SIMULATE_NO_API_CONNECTIVITY_CLOUDFLARE ) {
-        define( 'FS_SDK__SIMULATE_NO_API_CONNECTIVITY_CLOUDFLARE', true );
-    }
-    if ( WP_FS__SIMULATE_NO_API_CONNECTIVITY_SQUID_ACL ) {
-        define( 'FS_SDK__SIMULATE_NO_API_CONNECTIVITY_SQUID_ACL', true );
-    }
-
-    #endregion
-
-    if ( ! defined( 'WP_FS__SIMULATE_FREEMIUS_OFF' ) ) {
-        define( 'WP_FS__SIMULATE_FREEMIUS_OFF', false );
-    }
-
-    if ( ! defined( 'WP_FS__PING_API_ON_IP_OR_HOST_CHANGES' ) ) {
-        /**
-         * @since  1.1.7.3
-         * @author Vova Feldman (@svovaf)
-         *
-         * I'm not sure if shared servers periodically change IP, or the subdomain of the
-         * admin dashboard. Also, I've seen sites that have strange loop of switching
-         * between domains on a daily basis. Therefore, to eliminate the risk of
-         * multiple unwanted connectivity test pings, temporary ignore domain or
-         * server IP changes.
-         */
-        define( 'WP_FS__PING_API_ON_IP_OR_HOST_CHANGES', false );
-    }
-
-    /**
-     * If your dev environment supports custom public network IP setup
-     * like VVV, please update WP_FS__LOCALHOST_IP with your public IP
-     * and uncomment it during dev.
-     */
-    if ( ! defined( 'WP_FS__LOCALHOST_IP' ) ) {
-        // VVV default public network IP.
-        define( 'WP_FS__VVV_DEFAULT_PUBLIC_IP', '192.168.50.4' );
-
-//		define( 'WP_FS__LOCALHOST_IP', WP_FS__VVV_DEFAULT_PUBLIC_IP );
-    }
-
-    /**
-     * If true and running with secret key, the opt-in process
-     * will skip the email activation process which is invoked
-     * when the email of the context user already exist in Freemius
-     * database (as a security precaution, to prevent sharing user
-     * secret with unauthorized entity).
-     *
-     * IMPORTANT:
-     *      AS A SECURITY PRECAUTION, WE VALIDATE THE TIMESTAMP OF THE OPT-IN REQUEST.
-     *      THEREFORE, MAKE SURE THAT WHEN USING THIS PARAMETER,YOUR TESTING ENVIRONMENT'S
-     *      CLOCK IS SYNCED.
-     */
-    if ( ! defined( 'WP_FS__SKIP_EMAIL_ACTIVATION' ) ) {
-        define( 'WP_FS__SKIP_EMAIL_ACTIVATION', false );
-    }
-
-
-    #--------------------------------------------------------------------------------
-    #region Directories
-    #--------------------------------------------------------------------------------
-
-    if ( ! defined( 'WP_FS__DIR' ) ) {
-        define( 'WP_FS__DIR', dirname( __FILE__ ) );
-    }
-    if ( ! defined( 'WP_FS__DIR_INCLUDES' ) ) {
-        define( 'WP_FS__DIR_INCLUDES', WP_FS__DIR . '/includes' );
-    }
-    if ( ! defined( 'WP_FS__DIR_TEMPLATES' ) ) {
-        define( 'WP_FS__DIR_TEMPLATES', WP_FS__DIR . '/templates' );
-    }
-    if ( ! defined( 'WP_FS__DIR_ASSETS' ) ) {
-        define( 'WP_FS__DIR_ASSETS', WP_FS__DIR . '/assets' );
-    }
-    if ( ! defined( 'WP_FS__DIR_CSS' ) ) {
-        define( 'WP_FS__DIR_CSS', WP_FS__DIR_ASSETS . '/css' );
-    }
-    if ( ! defined( 'WP_FS__DIR_JS' ) ) {
-        define( 'WP_FS__DIR_JS', WP_FS__DIR_ASSETS . '/js' );
-    }
-    if ( ! defined( 'WP_FS__DIR_IMG' ) ) {
-        define( 'WP_FS__DIR_IMG', WP_FS__DIR_ASSETS . '/img' );
-    }
-    if ( ! defined( 'WP_FS__DIR_SDK' ) ) {
-        define( 'WP_FS__DIR_SDK', WP_FS__DIR_INCLUDES . '/sdk' );
-    }
-
-    #endregion
-
-    /**
-     * Domain / URL / Address
-     */
-    define( 'WP_FS__ROOT_DOMAIN_PRODUCTION', 'freemius.com' );
-    define( 'WP_FS__DOMAIN_PRODUCTION', 'wp.freemius.com' );
-    define( 'WP_FS__ADDRESS_PRODUCTION', 'https://' . WP_FS__DOMAIN_PRODUCTION );
-
-    if ( ! defined( 'WP_FS__DOMAIN_LOCALHOST' ) ) {
-        define( 'WP_FS__DOMAIN_LOCALHOST', 'wp.freemius' );
-    }
-    if ( ! defined( 'WP_FS__ADDRESS_LOCALHOST' ) ) {
-        define( 'WP_FS__ADDRESS_LOCALHOST', 'http://' . WP_FS__DOMAIN_LOCALHOST . ':8080' );
-    }
-
-    if ( ! defined( 'WP_FS__TESTING_DOMAIN' ) ) {
-        define( 'WP_FS__TESTING_DOMAIN', 'fswp' );
-    }
-
-    #--------------------------------------------------------------------------------
-    #region HTTP
-    #--------------------------------------------------------------------------------
-
-    if ( ! defined( 'WP_FS__IS_HTTP_REQUEST' ) ) {
-        define( 'WP_FS__IS_HTTP_REQUEST', isset( $_SERVER['HTTP_HOST'] ) && isset( $_SERVER['REQUEST_METHOD'] ) );
-    }
-
-    if ( ! defined( 'WP_FS__IS_HTTPS' ) ) {
-        define( 'WP_FS__IS_HTTPS', ( WP_FS__IS_HTTP_REQUEST &&
-                                     // Checks if CloudFlare's HTTPS (Flexible SSL support).
-                                     isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) &&
-                                     'https' === strtolower( $_SERVER['HTTP_X_FORWARDED_PROTO'] )
-                                   ) ||
-                                   // Check if HTTPS request.
-                                   ( isset( $_SERVER['HTTPS'] ) && 'on' == $_SERVER['HTTPS'] ) ||
-                                   ( isset( $_SERVER['SERVER_PORT'] ) && 443 == $_SERVER['SERVER_PORT'] )
-        );
-    }
-
-    if ( ! defined( 'WP_FS__IS_POST_REQUEST' ) ) {
-        define( 'WP_FS__IS_POST_REQUEST', ( WP_FS__IS_HTTP_REQUEST &&
-                                            strtoupper( $_SERVER['REQUEST_METHOD'] ) == 'POST' ) );
-    }
-
-    if ( ! defined( 'WP_FS__REMOTE_ADDR' ) ) {
-        define( 'WP_FS__REMOTE_ADDR', fs_get_ip() );
-    }
-
-    if ( ! defined( 'WP_FS__IS_LOCALHOST' ) ) {
-        if ( defined( 'WP_FS__LOCALHOST_IP' ) ) {
-            define( 'WP_FS__IS_LOCALHOST', ( WP_FS__LOCALHOST_IP === WP_FS__REMOTE_ADDR ) );
-        } else {
-            define( 'WP_FS__IS_LOCALHOST', WP_FS__IS_HTTP_REQUEST &&
-                                           is_string( WP_FS__REMOTE_ADDR ) &&
-                                           ( substr( WP_FS__REMOTE_ADDR, 0, 4 ) === '127.' ||
-                                             WP_FS__REMOTE_ADDR === '::1' )
-            );
-        }
-    }
-
-    if ( ! defined( 'WP_FS__IS_LOCALHOST_FOR_SERVER' ) ) {
-        define( 'WP_FS__IS_LOCALHOST_FOR_SERVER', ( ! WP_FS__IS_HTTP_REQUEST ||
-                                                    false !== strpos( $_SERVER['HTTP_HOST'], 'localhost' ) ) );
-    }
-
-    #endregion
-
-    if ( ! defined( 'WP_FS__IS_PRODUCTION_MODE' ) ) {
-        // By default, run with Freemius production servers.
-        define( 'WP_FS__IS_PRODUCTION_MODE', true );
-    }
-
-    if ( ! defined( 'WP_FS__ADDRESS' ) ) {
-        define( 'WP_FS__ADDRESS', ( WP_FS__IS_PRODUCTION_MODE ? WP_FS__ADDRESS_PRODUCTION : WP_FS__ADDRESS_LOCALHOST ) );
-    }
-
-
-    #--------------------------------------------------------------------------------
-    #region API
-    #--------------------------------------------------------------------------------
-
-    if ( ! defined( 'WP_FS__API_ADDRESS_LOCALHOST' ) ) {
-        define( 'WP_FS__API_ADDRESS_LOCALHOST', 'http://api.freemius-local.com:8080' );
-    }
-    if ( ! defined( 'WP_FS__API_SANDBOX_ADDRESS_LOCALHOST' ) ) {
-        define( 'WP_FS__API_SANDBOX_ADDRESS_LOCALHOST', 'http://sandbox-api.freemius:8080' );
-    }
-
-    // Set API address for local testing.
-    if ( ! WP_FS__IS_PRODUCTION_MODE ) {
-        if ( ! defined( 'FS_API__ADDRESS' ) ) {
-            define( 'FS_API__ADDRESS', WP_FS__API_ADDRESS_LOCALHOST );
-        }
-        if ( ! defined( 'FS_API__SANDBOX_ADDRESS' ) ) {
-            define( 'FS_API__SANDBOX_ADDRESS', WP_FS__API_SANDBOX_ADDRESS_LOCALHOST );
-        }
-    }
-
-    #endregion
-
-    #--------------------------------------------------------------------------------
-    #region Checkout
-    #--------------------------------------------------------------------------------
-
-    if ( ! defined( 'FS_CHECKOUT__ADDRESS_PRODUCTION' ) ) {
-        define( 'FS_CHECKOUT__ADDRESS_PRODUCTION', 'https://checkout.freemius.com' );
-    }
-
-    if ( ! defined( 'FS_CHECKOUT__ADDRESS_LOCALHOST' ) ) {
-        define( 'FS_CHECKOUT__ADDRESS_LOCALHOST', 'http://checkout.freemius-local.com:8080' );
-    }
-
-    if ( ! defined( 'FS_CHECKOUT__ADDRESS' ) ) {
-        define( 'FS_CHECKOUT__ADDRESS', ( WP_FS__IS_PRODUCTION_MODE ? FS_CHECKOUT__ADDRESS_PRODUCTION : FS_CHECKOUT__ADDRESS_LOCALHOST ) );
-    }
-
-    #endregion
-
-    define( 'WP_FS___OPTION_PREFIX', 'fs' . ( WP_FS__IS_PRODUCTION_MODE ? '' : '_dbg' ) . '_' );
-
-    if ( ! defined( 'WP_FS__ACCOUNTS_OPTION_NAME' ) ) {
-        define( 'WP_FS__ACCOUNTS_OPTION_NAME', WP_FS___OPTION_PREFIX . 'accounts' );
-    }
-    if ( ! defined( 'WP_FS__API_CACHE_OPTION_NAME' ) ) {
-        define( 'WP_FS__API_CACHE_OPTION_NAME', WP_FS___OPTION_PREFIX . 'api_cache' );
-    }
-    if ( ! defined( 'WP_FS__GDPR_OPTION_NAME' ) ) {
-        define( 'WP_FS__GDPR_OPTION_NAME', WP_FS___OPTION_PREFIX . 'gdpr' );
-    }
-    define( 'WP_FS__OPTIONS_OPTION_NAME', WP_FS___OPTION_PREFIX . 'options' );
-
-    /**
-     * Module types
-     *
-     * @since 1.2.2
-     */
-    define( 'WP_FS__MODULE_TYPE_PLUGIN', 'plugin' );
-    define( 'WP_FS__MODULE_TYPE_THEME', 'theme' );
-
-    /**
-     * Billing Frequencies
-     */
-    define( 'WP_FS__PERIOD_ANNUALLY', 'annual' );
-    define( 'WP_FS__PERIOD_MONTHLY', 'monthly' );
-    define( 'WP_FS__PERIOD_LIFETIME', 'lifetime' );
-
-    /**
-     * Plans
-     */
-    define( 'WP_FS__PLAN_DEFAULT_PAID', false );
-    define( 'WP_FS__PLAN_FREE', 'free' );
-    define( 'WP_FS__PLAN_TRIAL', 'trial' );
-
-    /**
-     * Times in seconds
-     */
-    if ( ! defined( 'WP_FS__TIME_5_MIN_IN_SEC' ) ) {
-        define( 'WP_FS__TIME_5_MIN_IN_SEC', 300 );
-    }
-    if ( ! defined( 'WP_FS__TIME_10_MIN_IN_SEC' ) ) {
-        define( 'WP_FS__TIME_10_MIN_IN_SEC', 600 );
-    }
-//	define( 'WP_FS__TIME_15_MIN_IN_SEC', 900 );
-    if ( ! defined( 'WP_FS__TIME_12_HOURS_IN_SEC' ) ) {
-        define( 'WP_FS__TIME_12_HOURS_IN_SEC', 43200 );
-    }
-    if ( ! defined( 'WP_FS__TIME_24_HOURS_IN_SEC' ) ) {
-        define( 'WP_FS__TIME_24_HOURS_IN_SEC', WP_FS__TIME_12_HOURS_IN_SEC * 2 );
-    }
-    if ( ! defined( 'WP_FS__TIME_WEEK_IN_SEC' ) ) {
-        define( 'WP_FS__TIME_WEEK_IN_SEC', 7 * WP_FS__TIME_24_HOURS_IN_SEC );
-    }
-
-    #--------------------------------------------------------------------------------
-    #region Debugging
-    #--------------------------------------------------------------------------------
-
-    if ( ! defined( 'WP_FS__DEBUG_SDK' ) ) {
-        $debug_mode = get_option( 'fs_debug_mode', null );
-
-        if ( $debug_mode === null ) {
-            $debug_mode = false;
-            add_option( 'fs_debug_mode', $debug_mode );
-        }
-
-        define( 'WP_FS__DEBUG_SDK', is_numeric( $debug_mode ) ? ( 0 < $debug_mode ) : WP_FS__DEV_MODE );
-    }
-
-    if ( ! defined( 'WP_FS__ECHO_DEBUG_SDK' ) ) {
-        define( 'WP_FS__ECHO_DEBUG_SDK', WP_FS__DEV_MODE && ! empty( $_GET['fs_dbg_echo'] ) );
-    }
-    if ( ! defined( 'WP_FS__LOG_DATETIME_FORMAT' ) ) {
-        define( 'WP_FS__LOG_DATETIME_FORMAT', 'Y-m-d H:i:s' );
-    }
-    if ( ! defined( 'FS_API__LOGGER_ON' ) ) {
-        define( 'FS_A

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity 
# Atomic Edge WAF Rule - CVE-2024-13362
SecRule REQUEST_URI "@contains /wp-admin/admin.php" 
  "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2024-13362 - Reflected XSS via url parameter in Freemius',severity:'CRITICAL',tag:'CVE-2024-13362'"
SecRule ARGS_GET:url "@rx (?:javascript|data|vbscript|onw+s*=|alert|prompt|confirm)" 
  "t:lowercase,t:urlDecode,chain"
SecRule ARGS_GET:page "@streq easy-facebook-likebox" 
  "t:none"

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School