From f8aa007100919a32546d667b7621e2bb22eadee2 Mon Sep 17 00:00:00 2001
From: mattyrob <mattyrobuk@gmail.com>
Date: Tue, 6 Jun 2023 19:59:49 +0100
Subject: [PATCH] Update, see description

* HTML code modernisation
* Correct Premium link used in documentation
* Security hardening
* Add Premium URL header
---
 ChangeLog.txt                       |   7 ++
 ReadMe.txt                          |   4 +-
 admin/send-email.php                |   8 +-
 admin/settings.php                  | 112 +++++++++++++--------------
 admin/subscribers.php               |  61 ++++++++-------
 classes/class-s2-admin.php          |  58 +++++++-------
 classes/class-s2-ajax.php           |   2 +
 classes/class-s2-core.php           |  19 +++--
 classes/class-s2-counter-widget.php |  12 +--
 classes/class-s2-form-widget.php    |  20 ++---
 classes/class-s2-forms.php          |  43 ++++++-----
 classes/class-s2-frontend.php       |  94 ++++++++++++++++++-----
 classes/class-s2-list-table.php     |  70 +++++++++++------
 classes/class-s2-multisite.php      |   4 +-
 include/s2-colorpicker.js           |  10 +--
 include/s2-dismiss.js               |   1 -
 include/s2-user-admin.css           | 113 +++++++++++++---------------
 subscribe2.php                      |   1 +
 tinymce/css/content.css             |  17 ++---
 tinymce/editor-plugin4.js           |   4 +-
 20 files changed, 384 insertions(+), 276 deletions(-)

diff --git a/ChangeLog.txt b/ChangeLog.txt
index 51b1f90..3a84513 100644
--- a/ChangeLog.txt
+++ b/ChangeLog.txt
@@ -1,3 +1,10 @@
+= 11.8 =
+
+* HTML code modernisation
+* Correct Premium link used in documentation
+* Security hardening
+* Add Premium URL header
+
 = 11.7 =
 
 * Ensure Editor button is added if enabled
diff --git a/ReadMe.txt b/ReadMe.txt
index 713e1d5..6b457b1 100644
--- a/ReadMe.txt
+++ b/ReadMe.txt
@@ -3,7 +3,7 @@ Contributors: MattyRob
 Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&amp;hosted_button_id=2387904
 Tags: posts, subscription, email, subscribe, notify, notification
 Requires at least: 1.0.0
-Tested up to: 1.2
+Tested up to: 1.5.3
 License: GPLv3
 
 Sends a list of subscribers an email notification when you publish new posts.
@@ -29,7 +29,7 @@ The format of the email can also be customised for per-post notifications, Subsc
 * HTML excerpt (Registered Users only).
 * HTML full post (Registered Users only).
 
-If you want to send full content HTML emails to Public Subscribers too then upgrade to [Subscribe2 HTML](http://semperplugins.com/plugins/subscribe2-html/).
+If you want to send full content HTML emails to Public Subscribers too then upgrade to [Subscribe2 HTML](https://checkout.freemius.com/mode/dialog/plugin/5502/plan/8921/).
 
 == Installation ==
 
diff --git a/admin/send-email.php b/admin/send-email.php
index 3b5865c..60677d8 100644
--- a/admin/send-email.php
+++ b/admin/send-email.php
@@ -117,15 +117,15 @@
 if ( ! isset( $_POST['content'] ) ) {
 	$body = '';
 }
-echo '<p><label>' . esc_html__( 'Subject', 'subscribe2-for-cp' ) . ': <input type="text" size="69" name="subject" value="' . esc_attr( $subject ) . '" /></label> <br><br>';
+echo '<p><label>' . esc_html__( 'Subject', 'subscribe2-for-cp' ) . ': <input type="text" size="69" name="subject" value="' . esc_attr( $subject ) . '"></label> <br><br>';
 echo '<label><span class="screen-reader-text">' . esc_html__( 'Email body', 'subscribe2-for-cp' ) . '</span><textarea rows="12" cols="75" name="content">' . esc_textarea( $body ) . '</textarea></label>';
 echo "<br><div id=\"upload_files\"><input type=\"file\" name=\"file[]\"></div>\r\n";
-echo '<input type="button" class="button-secondary" name="addmore" value="' . esc_attr( __( 'Add More Files', 'subscribe2-for-cp' ) ) . "\" onClick=\"add_file_upload();\" />\r\n";
+echo '<input type="button" class="button-secondary" name="addmore" value="' . esc_attr( __( 'Add More Files', 'subscribe2-for-cp' ) ) . "\" onClick=\"add_file_upload();\">\r\n";
 echo "<br><br>\r\n";
 echo esc_html__( 'Recipients:', 'subscribe2-for-cp' ) . ' ';
 s2cp()->display_subscriber_dropdown( apply_filters( 's2_subscriber_dropdown_default', 'registered' ), false );
-echo '<input type="hidden" name="s2_admin" value="mail" />';
-echo '<p class="submit"><input type="submit" class="button-secondary" name="preview" value="' . esc_attr( __( 'Preview', 'subscribe2-for-cp' ) ) . '" />&nbsp;<input type="submit" class="button-primary" name="send" value="' . esc_attr( __( 'Send', 'subscribe2-for-cp' ) ) . '" /></p>';
+echo '<input type="hidden" name="s2_admin" value="mail">';
+echo '<p class="submit"><input type="submit" class="button-secondary" name="preview" value="' . esc_attr( __( 'Preview', 'subscribe2-for-cp' ) ) . '">&nbsp;<input type="submit" class="button-primary" name="send" value="' . esc_attr( __( 'Send', 'subscribe2-for-cp' ) ) . '"></p>';
 echo '</form></div>' . "\r\n";
 echo '<div style="clear: both;"><p>&nbsp;</p></div>';
 ?>
diff --git a/admin/settings.php b/admin/settings.php
index e47160e..a4ac94f 100644
--- a/admin/settings.php
+++ b/admin/settings.php
@@ -191,8 +191,8 @@
 
 wp_nonce_field( 'subscribe2-options_subscribers' . S2VERSION );
 
-echo '<input type="hidden" name="s2_admin" value="options" />' . "\r\n";
-echo '<input type="hidden" id="jsbcclimit" value="' . esc_attr( s2cp()->subscribe2_options['bcclimit'] ) . '" />';
+echo '<input type="hidden" name="s2_admin" value="options">' . "\r\n";
+echo '<input type="hidden" id="jsbcclimit" value="' . esc_attr( s2cp()->subscribe2_options['bcclimit'] ) . '">';
 
 switch ( $current_tab ) {
 	case 'email':
@@ -203,30 +203,30 @@
 		echo '<span id="s2bcclimit_1"><span id="s2bcclimit" style="background-color: #FFFBCC">' . esc_html( s2cp()->subscribe2_options['bcclimit'] ) . '</span> ';
 		echo '<a href="#" onclick="s2Show(\'bcclimit\'); return false;">' . esc_html__( 'Edit', 'subscribe2-for-cp' ) . '</a></span>' . "\r\n";
 		echo '<span id="s2bcclimit_2">' . "\r\n";
-		echo '<input type="text" name="bcclimit" value="' . esc_attr( s2cp()->subscribe2_options['bcclimit'] ) . '" size="3" />' . "\r\n";
+		echo '<input type="text" name="bcclimit" value="' . esc_attr( s2cp()->subscribe2_options['bcclimit'] ) . '" size="3">' . "\r\n";
 		echo '<a href="#" onclick="s2Update(\'bcclimit\'); return false;">' . esc_html__( 'Update', 'subscribe2-for-cp' ) . '</a>' . "\r\n";
 		echo '<a href="#" onclick="s2Revert(\'bcclimit\'); return false;">' . esc_html__( 'Revert', 'subscribe2-for-cp' ) . '</a></span>' . "\n";
 
 		echo '<br><br>' . esc_html__( 'Send Admins notifications for new', 'subscribe2-for-cp' ) . ': ';
-		echo '<label><input type="radio" name="admin_email" value="subs"' . checked( s2cp()->subscribe2_options['admin_email'], 'subs', false ) . ' />' . "\r\n";
+		echo '<label><input type="radio" name="admin_email" value="subs"' . checked( s2cp()->subscribe2_options['admin_email'], 'subs', false ) . '>' . "\r\n";
 		echo esc_html__( 'Subscriptions', 'subscribe2-for-cp' ) . '</label>&nbsp;&nbsp;';
-		echo '<label><input type="radio" name="admin_email" value="unsubs"' . checked( s2cp()->subscribe2_options['admin_email'], 'unsubs', false ) . ' />' . "\r\n";
+		echo '<label><input type="radio" name="admin_email" value="unsubs"' . checked( s2cp()->subscribe2_options['admin_email'], 'unsubs', false ) . '>' . "\r\n";
 		echo esc_html__( 'Unsubscriptions', 'subscribe2-for-cp' ) . '</label>&nbsp;&nbsp;';
-		echo '<label><input type="radio" name="admin_email" value="both"' . checked( s2cp()->subscribe2_options['admin_email'], 'both', false ) . ' />' . "\r\n";
+		echo '<label><input type="radio" name="admin_email" value="both"' . checked( s2cp()->subscribe2_options['admin_email'], 'both', false ) . '>' . "\r\n";
 		echo esc_html__( 'Both', 'subscribe2-for-cp' ) . '</label>&nbsp;&nbsp;';
-		echo '<label><input type="radio" name="admin_email" value="none"' . checked( s2cp()->subscribe2_options['admin_email'], 'none', false ) . ' />' . "\r\n";
+		echo '<label><input type="radio" name="admin_email" value="none"' . checked( s2cp()->subscribe2_options['admin_email'], 'none', false ) . '>' . "\r\n";
 		echo esc_html__( 'Neither', 'subscribe2-for-cp' ) . '</label><br><br>' . "\r\n";
 
 		echo esc_html__( 'Include theme CSS stylesheet in HTML notifications', 'subscribe2-for-cp' ) . ': ';
-		echo '<label><input type="radio" name="stylesheet" value="yes"' . checked( s2cp()->subscribe2_options['stylesheet'], 'yes', false ) . ' /> ';
+		echo '<label><input type="radio" name="stylesheet" value="yes"' . checked( s2cp()->subscribe2_options['stylesheet'], 'yes', false ) . '> ';
 		echo esc_html__( 'Yes', 'subscribe2-for-cp' ) . '</label>&nbsp;&nbsp;';
-		echo '<label><input type="radio" name="stylesheet" value="no"' . checked( s2cp()->subscribe2_options['stylesheet'], 'no', false ) . ' /> ';
+		echo '<label><input type="radio" name="stylesheet" value="no"' . checked( s2cp()->subscribe2_options['stylesheet'], 'no', false ) . '> ';
 		echo esc_html__( 'No', 'subscribe2-for-cp' ) . '</label><br><br>' . "\r\n";
 
 		echo esc_html__( 'Send Emails for Pages', 'subscribe2-for-cp' ) . ': ';
-		echo '<label><input type="radio" name="pages" value="yes"' . checked( s2cp()->subscribe2_options['pages'], 'yes', false ) . ' /> ';
+		echo '<label><input type="radio" name="pages" value="yes"' . checked( s2cp()->subscribe2_options['pages'], 'yes', false ) . '> ';
 		echo esc_html__( 'Yes', 'subscribe2-for-cp' ) . '</label>&nbsp;&nbsp;';
-		echo '<label><input type="radio" name="pages" value="no"' . checked( s2cp()->subscribe2_options['pages'], 'no', false ) . ' /> ';
+		echo '<label><input type="radio" name="pages" value="no"' . checked( s2cp()->subscribe2_options['pages'], 'no', false ) . '> ';
 		echo esc_html__( 'No', 'subscribe2-for-cp' ) . '</label><br><br>' . "\r\n";
 
 		$s2_post_types = apply_filters( 's2_post_types', array() );
@@ -238,20 +238,20 @@
 		}
 
 		echo esc_html__( 'Send Emails for Password Protected Posts', 'subscribe2-for-cp' ) . ': ';
-		echo '<label><input type="radio" name="password" value="yes"' . checked( s2cp()->subscribe2_options['password'], 'yes', false ) . ' /> ';
+		echo '<label><input type="radio" name="password" value="yes"' . checked( s2cp()->subscribe2_options['password'], 'yes', false ) . '> ';
 		echo esc_html__( 'Yes', 'subscribe2-for-cp' ) . '</label>&nbsp;&nbsp;';
-		echo '<label><input type="radio" name="password" value="no"' . checked( s2cp()->subscribe2_options['password'], 'no', false ) . ' /> ';
+		echo '<label><input type="radio" name="password" value="no"' . checked( s2cp()->subscribe2_options['password'], 'no', false ) . '> ';
 		echo esc_html__( 'No', 'subscribe2-for-cp' ) . '</label><br><br>' . "\r\n";
 		echo esc_html__( 'Send Emails for Private Posts', 'subscribe2-for-cp' ) . ': ';
-		echo '<label><input type="radio" name="private" value="yes"' . checked( s2cp()->subscribe2_options['private'], 'yes', false ) . ' /> ';
+		echo '<label><input type="radio" name="private" value="yes"' . checked( s2cp()->subscribe2_options['private'], 'yes', false ) . '> ';
 		echo esc_html__( 'Yes', 'subscribe2-for-cp' ) . '</label>&nbsp;&nbsp;';
-		echo '<label><input type="radio" name="private" value="no"' . checked( s2cp()->subscribe2_options['private'], 'no', false ) . ' /> ';
+		echo '<label><input type="radio" name="private" value="no"' . checked( s2cp()->subscribe2_options['private'], 'no', false ) . '> ';
 		echo esc_html__( 'No', 'subscribe2-for-cp' ) . '</label><br><br>' . "\r\n";
 		if ( 'never' !== s2cp()->subscribe2_options['email_freq'] ) {
 			echo esc_html__( 'Include Sticky Posts at the top of all Digest Notifications', 'subscribe2-for-cp' ) . ': ';
-			echo '<label><input type="radio" name="stickies" value="yes"' . checked( s2cp()->subscribe2_options['stickies'], 'yes', false ) . ' /> ';
+			echo '<label><input type="radio" name="stickies" value="yes"' . checked( s2cp()->subscribe2_options['stickies'], 'yes', false ) . '> ';
 			echo esc_html__( 'Yes', 'subscribe2-for-cp' ) . '</label>&nbsp;&nbsp;';
-			echo '<label><input type="radio" name="stickies" value="no"' . checked( s2cp()->subscribe2_options['stickies'], 'no', false ) . ' /> ';
+			echo '<label><input type="radio" name="stickies" value="no"' . checked( s2cp()->subscribe2_options['stickies'], 'no', false ) . '> ';
 			echo esc_html__( 'No', 'subscribe2-for-cp' ) . '</label><br><br>' . "\r\n";
 		}
 		echo esc_html__( 'Send Email From', 'subscribe2-for-cp' ) . ': ';
@@ -264,13 +264,13 @@
 		}
 		if ( 'never' !== s2cp()->subscribe2_options['email_freq'] ) {
 			echo '<p>' . esc_html__( 'For digest notifications, date order for posts is', 'subscribe2-for-cp' ) . ': ' . "\r\n";
-			echo '<label><input type="radio" name="cron_order" value="desc"' . checked( s2cp()->subscribe2_options['cron_order'], 'desc', false ) . ' /> ';
+			echo '<label><input type="radio" name="cron_order" value="desc"' . checked( s2cp()->subscribe2_options['cron_order'], 'desc', false ) . '> ';
 			echo esc_html__( 'Descending', 'subscribe2-for-cp' ) . '</label>&nbsp;&nbsp;';
-			echo '<label><input type="radio" name="cron_order" value="asc"' . checked( s2cp()->subscribe2_options['cron_order'], 'asc', false ) . ' /> ';
+			echo '<label><input type="radio" name="cron_order" value="asc"' . checked( s2cp()->subscribe2_options['cron_order'], 'asc', false ) . '> ';
 			echo esc_html__( 'Ascending', 'subscribe2-for-cp' ) . '</label></p>' . "\r\n";
 		}
 		echo '<label>' . esc_html__( 'Add Tracking Parameters to the Permalink', 'subscribe2-for-cp' ) . ': ';
-		echo '<input type="text" name="tracking" value="' . esc_attr( s2cp()->subscribe2_options['tracking'] ) . '" size="50" /> ';
+		echo '<input type="text" name="tracking" value="' . esc_attr( s2cp()->subscribe2_options['tracking'] ) . '" size="50"> ';
 		echo '</label><br>' . esc_html__( 'eg. utm_source=subscribe2&amp;utm_medium=email&amp;utm_campaign=postnotify&amp;utm_id={ID}&amp;utm_title={TITLE}', 'subscribe2-for-cp' ) . "\r\n";
 		echo '</p>' . "\r\n";
 		echo '</div>' . "\r\n";
@@ -284,11 +284,11 @@
 		echo '<tr><td style="vertical-align: top; height: 350px; min-height: 350px;">';
 		echo '<h3>' . esc_html__( 'Notification email (must not be empty)', 'subscribe2-for-cp' ) . '</h3>' . "\r\n";
 		echo '<label>' . esc_html__( 'Notification Email Subject Line', 'subscribe2-for-cp' ) . ': ';
-		echo '<input type="text" name="notification_subject" value="' . esc_attr( s2cp()->subscribe2_options['notification_subject'] ) . '" size="45" /></label>';
+		echo '<input type="text" name="notification_subject" value="' . esc_attr( s2cp()->subscribe2_options['notification_subject'] ) . '" size="45"></label>';
 		echo '<br>' . "\r\n";
 		echo '<textarea rows="9" cols="60" name="mailtext" style="width:95%;">' . esc_textarea( stripslashes( s2cp()->subscribe2_options['mailtext'] ) ) . '</textarea>' . "\r\n";
 		echo '</td><td style="vertical-align: top;" rowspan="3">';
-		echo '<p class="submit"><input type="submit" class="button-secondary" name="preview" value="' . esc_html__( 'Send Email Preview', 'subscribe2-for-cp' ) . '" /></p>' . "\r\n";
+		echo '<p class="submit"><input type="submit" class="button-secondary" name="preview" value="' . esc_html__( 'Send Email Preview', 'subscribe2-for-cp' ) . '"></p>' . "\r\n";
 		echo '<h3>' . esc_html__( 'Message substitutions', 'subscribe2-for-cp' ) . '</h3>' . "\r\n";
 		echo '<dl>';
 		echo '<dt><b><em style="color: red">' . esc_html__( 'IF THE FOLLOWING KEYWORDS ARE ALSO IN YOUR POST THEY WILL BE SUBSTITUTED', 'subscribe2-for-cp' ) . '</em></b></dt><dd></dd>' . "\r\n";
@@ -323,12 +323,12 @@
 		echo '</dl></td></tr><tr><td  style="vertical-align: top; height: 350px; min-height: 350px;">';
 		echo '<h3>' . esc_html__( 'Subscribe / Unsubscribe confirmation email', 'subscribe2-for-cp' ) . ':</h3>' . "\r\n";
 		echo '<label>' . esc_html__( 'Confirmation Email Subject Line', 'subscribe2-for-cp' ) . ': ';
-		echo '<input type="text" name="confirm_subject" value="' . esc_attr( s2cp()->subscribe2_options['confirm_subject'] ) . '" size="45" /></label><br>' . "\r\n";
+		echo '<input type="text" name="confirm_subject" value="' . esc_attr( s2cp()->subscribe2_options['confirm_subject'] ) . '" size="45"></label><br>' . "\r\n";
 		echo '<textarea rows="9" cols="60" name="confirm_email" style="width:95%;">' . esc_textarea( stripslashes( s2cp()->subscribe2_options['confirm_email'] ) ) . '</textarea>' . "\r\n";
 		echo '</td></tr><tr><td style="vertical-align: top; height: 350px; min-height: 350px;">';
 		echo '<h3>' . esc_html__( 'Reminder email to Unconfirmed Subscribers', 'subscribe2-for-cp' ) . ':</h3>' . "\r\n";
 		echo '<label>' . esc_html__( 'Reminder Email Subject Line', 'subscribe2-for-cp' ) . ': ';
-		echo '<input type="text" name="remind_subject" value="' . esc_attr( s2cp()->subscribe2_options['remind_subject'] ) . '" size="45" /></label><br>' . "\r\n";
+		echo '<input type="text" name="remind_subject" value="' . esc_attr( s2cp()->subscribe2_options['remind_subject'] ) . '" size="45"></label><br>' . "\r\n";
 		echo '<textarea rows="9" cols="60" name="remind_email" style="width:95%;">' . esc_textarea( stripslashes( s2cp()->subscribe2_options['remind_email'] ) ) . '</textarea><br><br>' . "\r\n";
 		echo '</td></tr></table>' . "\r\n";
 		echo '</div>' . "\r\n";
@@ -341,7 +341,7 @@
 
 		// compulsory categories
 		echo '<div class="s2_admin" id="s2_compulsory_categories">' . "\r\n";
-		echo '<input type="hidden" name="registered_users_tab" value="options" />' . "\r\n";
+		echo '<input type="hidden" name="registered_users_tab" value="options">' . "\r\n";
 		echo '<h3>' . esc_html__( 'Compulsory Categories', 'subscribe2-for-cp' ) . '</h3>' . "\r\n";
 		echo '<p>' . "\r\n";
 		echo '<strong><em style="color: red">' . esc_html__( 'Compulsory categories will be checked by default for Registered Subscribers', 'subscribe2-for-cp' ) . '</em></strong><br>' . "\r\n";
@@ -356,7 +356,7 @@
 		echo '<strong><em style="color: red">' . esc_html__( 'Posts assigned to any Excluded Category do not generate notifications and are not included in digest notifications', 'subscribe2-for-cp' ) . '</em></strong><br>' . "\r\n";
 		echo '</p>';
 		$s2_forms->display_category_form( explode( ',', s2cp()->subscribe2_options['exclude'] ), 1, array(), 'exclude' );
-		echo '<p style="text-align: center;"><label><input type="checkbox" name="reg_override" value="1"' . checked( s2cp()->subscribe2_options['reg_override'], '1', false ) . ' /> ';
+		echo '<p style="text-align: center;"><label><input type="checkbox" name="reg_override" value="1"' . checked( s2cp()->subscribe2_options['reg_override'], '1', false ) . '> ';
 		echo esc_html__( 'Allow registered users to subscribe to excluded categories?', 'subscribe2-for-cp' ) . '</label></p>' . "\r\n";
 		echo '</div>' . "\r\n";
 
@@ -379,69 +379,69 @@
 		echo '<p>' . "\r\n";
 		echo esc_html__( 'Subscribe new users registering with your blog', 'subscribe2-for-cp' ) . ':<br>' . "\r\n";
 		if ( defined( 'S2GDPR' ) && ( ( true === S2GDPR && 'yes' === s2cp()->subscribe2_options['autosub'] ) || ( false === S2GDPR ) ) ) {
-			echo '<label><input type="radio" name="autosub" value="yes"' . checked( s2cp()->subscribe2_options['autosub'], 'yes', false ) . ' /> ';
+			echo '<label><input type="radio" name="autosub" value="yes"' . checked( s2cp()->subscribe2_options['autosub'], 'yes', false ) . '> ';
 			echo esc_html__( 'Automatically', 'subscribe2-for-cp' ) . '</label>&nbsp;&nbsp;';
 		}
-		echo '<label><input type="radio" name="autosub" value="wpreg"' . checked( s2cp()->subscribe2_options['autosub'], 'wpreg', false ) . ' /> ';
+		echo '<label><input type="radio" name="autosub" value="wpreg"' . checked( s2cp()->subscribe2_options['autosub'], 'wpreg', false ) . '> ';
 		echo esc_html__( 'Display option on Registration Form', 'subscribe2-for-cp' ) . '</label>&nbsp;&nbsp;';
-		echo '<label><input type="radio" name="autosub" value="no"' . checked( s2cp()->subscribe2_options['autosub'], 'no', false ) . ' /> ';
+		echo '<label><input type="radio" name="autosub" value="no"' . checked( s2cp()->subscribe2_options['autosub'], 'no', false ) . '> ';
 		echo esc_html__( 'No', 'subscribe2-for-cp' ) . '</label><br><br>' . "\r\n";
 		echo esc_html__( 'Auto-subscribe includes any excluded categories', 'subscribe2-for-cp' ) . ':<br>' . "\r\n";
-		echo '<label><input type="radio" name="newreg_override" value="yes"' . checked( s2cp()->subscribe2_options['newreg_override'], 'yes', false ) . ' /> ';
+		echo '<label><input type="radio" name="newreg_override" value="yes"' . checked( s2cp()->subscribe2_options['newreg_override'], 'yes', false ) . '> ';
 		echo esc_html__( 'Yes', 'subscribe2-for-cp' ) . '</label>&nbsp;&nbsp;';
-		echo '<label><input type="radio" name="newreg_override" value="no"' . checked( s2cp()->subscribe2_options['newreg_override'], 'no', false ) . ' /> ';
+		echo '<label><input type="radio" name="newreg_override" value="no"' . checked( s2cp()->subscribe2_options['newreg_override'], 'no', false ) . '> ';
 		echo esc_html__( 'No', 'subscribe2-for-cp' ) . '</label><br><br>' . "\r\n";
 		if ( defined( 'S2GDPR' ) && ( ( true === S2GDPR && 'yes' === s2cp()->subscribe2_options['wpregdef'] ) || ( false === S2GDPR ) ) ) {
 			echo esc_html__( 'Registration Form option is checked by default', 'subscribe2-for-cp' ) . ':<br>' . "\r\n";
-			echo '<label><input type="radio" name="wpregdef" value="yes"' . checked( s2cp()->subscribe2_options['wpregdef'], 'yes', false ) . ' /> ';
+			echo '<label><input type="radio" name="wpregdef" value="yes"' . checked( s2cp()->subscribe2_options['wpregdef'], 'yes', false ) . '> ';
 			echo esc_html__( 'Yes', 'subscribe2-for-cp' ) . '</label>&nbsp;&nbsp;';
-			echo '<label><input type="radio" name="wpregdef" value="no"' . checked( s2cp()->subscribe2_options['wpregdef'], 'no', false ) . ' /> ';
+			echo '<label><input type="radio" name="wpregdef" value="no"' . checked( s2cp()->subscribe2_options['wpregdef'], 'no', false ) . '> ';
 			echo esc_html__( 'No', 'subscribe2-for-cp' ) . '</label><br><br>' . "\r\n";
 		}
 		echo esc_html__( 'Auto-subscribe users to receive email as', 'subscribe2-for-cp' ) . ': <br>' . "\r\n";
-		echo '<label><input type="radio" name="autoformat" value="html"' . checked( s2cp()->subscribe2_options['autoformat'], 'html', false ) . ' /> ';
+		echo '<label><input type="radio" name="autoformat" value="html"' . checked( s2cp()->subscribe2_options['autoformat'], 'html', false ) . '> ';
 		echo esc_html__( 'HTML - Full', 'subscribe2-for-cp' ) . '</label>&nbsp;&nbsp;';
-		echo '<label><input type="radio" name="autoformat" value="html_excerpt"' . checked( s2cp()->subscribe2_options['autoformat'], 'html_excerpt', false ) . ' /> ';
+		echo '<label><input type="radio" name="autoformat" value="html_excerpt"' . checked( s2cp()->subscribe2_options['autoformat'], 'html_excerpt', false ) . '> ';
 		echo esc_html__( 'HTML - Excerpt', 'subscribe2-for-cp' ) . '</label>&nbsp;&nbsp;';
-		echo '<label><input type="radio" name="autoformat" value="post"' . checked( s2cp()->subscribe2_options['autoformat'], 'post', false ) . ' /> ';
+		echo '<label><input type="radio" name="autoformat" value="post"' . checked( s2cp()->subscribe2_options['autoformat'], 'post', false ) . '> ';
 		echo esc_html__( 'Plain Text - Full', 'subscribe2-for-cp' ) . '</label>&nbsp;&nbsp;';
-		echo '<label><input type="radio" name="autoformat" value="excerpt"' . checked( s2cp()->subscribe2_options['autoformat'], 'excerpt', false ) . ' /> ';
+		echo '<label><input type="radio" name="autoformat" value="excerpt"' . checked( s2cp()->subscribe2_options['autoformat'], 'excerpt', false ) . '> ';
 		echo esc_html__( 'Plain Text - Excerpt', 'subscribe2-for-cp' ) . '</label><br><br>';
 		echo esc_html__( 'Registered Users have the option to auto-subscribe to new categories', 'subscribe2-for-cp' ) . ': <br>' . "\r\n";
-		echo '<label><input type="radio" name="show_autosub" value="yes"' . checked( s2cp()->subscribe2_options['show_autosub'], 'yes', false ) . ' /> ';
+		echo '<label><input type="radio" name="show_autosub" value="yes"' . checked( s2cp()->subscribe2_options['show_autosub'], 'yes', false ) . '> ';
 		echo esc_html__( 'Yes', 'subscribe2-for-cp' ) . '</label>&nbsp;&nbsp;';
-		echo '<label><input type="radio" name="show_autosub" value="no"' . checked( s2cp()->subscribe2_options['show_autosub'], 'no', false ) . ' /> ';
+		echo '<label><input type="radio" name="show_autosub" value="no"' . checked( s2cp()->subscribe2_options['show_autosub'], 'no', false ) . '> ';
 		echo esc_html__( 'No', 'subscribe2-for-cp' ) . '</label>&nbsp;&nbsp;';
-		echo '<label><input type="radio" name="show_autosub" value="exclude"' . checked( s2cp()->subscribe2_options['show_autosub'], 'exclude', false ) . ' /> ';
+		echo '<label><input type="radio" name="show_autosub" value="exclude"' . checked( s2cp()->subscribe2_options['show_autosub'], 'exclude', false ) . '> ';
 		echo esc_html__( 'New categories are immediately excluded', 'subscribe2-for-cp' ) . '</label><br><br>';
 		if ( defined( 'S2GDPR' ) && ( ( true === S2GDPR && 'yes' === s2cp()->subscribe2_options['autosub_def'] ) || ( false === S2GDPR ) ) ) {
 			echo esc_html__( 'Option for Registered Users to auto-subscribe to new categories is checked by default', 'subscribe2-for-cp' ) . ': <br>' . "\r\n";
-			echo '<label><input type="radio" name="autosub_def" value="yes"' . checked( s2cp()->subscribe2_options['autosub_def'], 'yes', false ) . ' /> ';
+			echo '<label><input type="radio" name="autosub_def" value="yes"' . checked( s2cp()->subscribe2_options['autosub_def'], 'yes', false ) . '> ';
 			echo esc_html__( 'Yes', 'subscribe2-for-cp' ) . '</label>&nbsp;&nbsp;';
-			echo '<label><input type="radio" name="autosub_def" value="no"' . checked( s2cp()->subscribe2_options['autosub_def'], 'no', false ) . ' /> ';
+			echo '<label><input type="radio" name="autosub_def" value="no"' . checked( s2cp()->subscribe2_options['autosub_def'], 'no', false ) . '> ';
 			echo esc_html__( 'No', 'subscribe2-for-cp' ) . '</label><br><br>';
 		}
 		// Hide these options if using Jetpack Comments
 		if ( ! class_exists( 'Jetpack_Comments' ) ) {
 			echo esc_html__( 'Display checkbox to allow subscriptions from the comment form', 'subscribe2-for-cp' ) . ': <br>' . "\r\n";
-			echo '<label><input type="radio" name="comment_subs" value="before"' . checked( s2cp()->subscribe2_options['comment_subs'], 'before', false ) . ' /> ';
+			echo '<label><input type="radio" name="comment_subs" value="before"' . checked( s2cp()->subscribe2_options['comment_subs'], 'before', false ) . '> ';
 			echo esc_html__( 'Before the Comment Submit button', 'subscribe2-for-cp' ) . '</label>&nbsp;&nbsp;';
-			echo '<label><input type="radio" name="comment_subs" value="after"' . checked( s2cp()->subscribe2_options['comment_subs'], 'after', false ) . ' /> ';
+			echo '<label><input type="radio" name="comment_subs" value="after"' . checked( s2cp()->subscribe2_options['comment_subs'], 'after', false ) . '> ';
 			echo esc_html__( 'After the Comment Submit button', 'subscribe2-for-cp' ) . '</label>&nbsp;&nbsp;';
-			echo '<label><input type="radio" name="comment_subs" value="no"' . checked( s2cp()->subscribe2_options['comment_subs'], 'no', false ) . ' /> ';
+			echo '<label><input type="radio" name="comment_subs" value="no"' . checked( s2cp()->subscribe2_options['comment_subs'], 'no', false ) . '> ';
 			echo esc_html__( 'No', 'subscribe2-for-cp' ) . '</label><br><br>';
 			if ( defined( 'S2GDPR' ) && ( ( true === S2GDPR && 'yes' === s2cp()->subscribe2_options['comment_def'] ) || ( false === S2GDPR ) ) ) {
 				echo esc_html__( 'Comment form checkbox is checked by default', 'subscribe2-for-cp' ) . ': <br>' . "\r\n";
-				echo '<label><input type="radio" name="comment_def" value="yes"' . checked( s2cp()->subscribe2_options['comment_def'], 'yes', false ) . ' /> ';
+				echo '<label><input type="radio" name="comment_def" value="yes"' . checked( s2cp()->subscribe2_options['comment_def'], 'yes', false ) . '> ';
 				echo esc_html__( 'Yes', 'subscribe2-for-cp' ) . '</label>&nbsp;&nbsp;';
-				echo '<label><input type="radio" name="comment_def" value="no"' . checked( s2cp()->subscribe2_options['comment_def'], 'no', false ) . ' /> ';
+				echo '<label><input type="radio" name="comment_def" value="no"' . checked( s2cp()->subscribe2_options['comment_def'], 'no', false ) . '> ';
 				echo esc_html__( 'No', 'subscribe2-for-cp' ) . '</label><br><br>' . "\r\n";
 			}
 		}
 		echo esc_html__( 'Show one-click subscription on profile page', 'subscribe2-for-cp' ) . ':<br>' . "\r\n";
-		echo '<label><input type="radio" name="one_click_profile" value="yes"' . checked( s2cp()->subscribe2_options['one_click_profile'], 'yes', false ) . ' /> ';
+		echo '<label><input type="radio" name="one_click_profile" value="yes"' . checked( s2cp()->subscribe2_options['one_click_profile'], 'yes', false ) . '> ';
 		echo esc_html__( 'Yes', 'subscribe2-for-cp' ) . '</label>&nbsp;&nbsp;';
-		echo '<label><input type="radio" name="one_click_profile" value="no"' . checked( s2cp()->subscribe2_options['one_click_profile'], 'no', false ) . ' /> ';
+		echo '<label><input type="radio" name="one_click_profile" value="no"' . checked( s2cp()->subscribe2_options['one_click_profile'], 'no', false ) . '> ';
 		echo esc_html__( 'No', 'subscribe2-for-cp' ) . '</label>' . "\r\n";
 		echo '</p></div>' . "\r\n";
 		break;
@@ -457,31 +457,31 @@
 		s2cp()->pages_dropdown( s2cp()->subscribe2_options['s2page'] );
 
 		// show link to Page in meta
-		echo '<br><br><label><input type="checkbox" name="show_meta" value="1"' . checked( s2cp()->subscribe2_options['show_meta'], '1', false ) . ' /> ';
+		echo '<br><br><label><input type="checkbox" name="show_meta" value="1"' . checked( s2cp()->subscribe2_options['show_meta'], '1', false ) . '> ';
 		echo esc_html__( 'Show a link to your subscription page in "meta"?', 'subscribe2-for-cp' ) . '</label><br><br>' . "\r\n";
 
 		// show QuickTag button
-		echo '<label><input type="checkbox" name="show_button" value="1"' . checked( s2cp()->subscribe2_options['show_button'], '1', false ) . ' /> ';
+		echo '<label><input type="checkbox" name="show_button" value="1"' . checked( s2cp()->subscribe2_options['show_button'], '1', false ) . '> ';
 		echo esc_html__( 'Show the Subscribe2 button on the Write toolbar?', 'subscribe2-for-cp' ) . '</label><br><br>' . "\r\n";
 
 		// enable popup style form
-		echo '<label><input type="checkbox" name="ajax" value="1"' . checked( s2cp()->subscribe2_options['ajax'], '1', false ) . ' /> ';
+		echo '<label><input type="checkbox" name="ajax" value="1"' . checked( s2cp()->subscribe2_options['ajax'], '1', false ) . '> ';
 		echo esc_html__( 'Enable popup style subscription form?', 'subscribe2-for-cp' ) . '</label><br><br>' . "\r\n";
 
 		// show Widget
-		echo '<label><input type="checkbox" name="widget" value="1"' . checked( s2cp()->subscribe2_options['widget'], '1', false ) . ' /> ';
+		echo '<label><input type="checkbox" name="widget" value="1"' . checked( s2cp()->subscribe2_options['widget'], '1', false ) . '> ';
 		echo esc_html__( 'Enable Subscribe2 Widget?', 'subscribe2-for-cp' ) . '</label><br><br>' . "\r\n";
 
 		// show Counter Widget
-		echo '<label><input type="checkbox" name="counterwidget" value="1"' . checked( s2cp()->subscribe2_options['counterwidget'], '1', false ) . ' /> ';
+		echo '<label><input type="checkbox" name="counterwidget" value="1"' . checked( s2cp()->subscribe2_options['counterwidget'], '1', false ) . '> ';
 		echo esc_html__( 'Enable Subscribe2 Counter Widget?', 'subscribe2-for-cp' ) . '</label><br><br>' . "\r\n";
 
 		// s2_meta checked by default
-		echo '<label><input type="checkbox" name="s2meta_default" value="1"' . checked( s2cp()->subscribe2_options['s2meta_default'], '1', false ) . ' /> ';
+		echo '<label><input type="checkbox" name="s2meta_default" value="1"' . checked( s2cp()->subscribe2_options['s2meta_default'], '1', false ) . '> ';
 		echo esc_html__( 'Disable email notifications is checked by default on authoring pages?', 'subscribe2-for-cp' ) . '</label><br><br>' . "\r\n";
 
 		// Subscription form for Registered Users on Frontend
-		echo '<label><input type="checkbox" name="js_ip_updater" value="1"' . checked( s2cp()->subscribe2_options['js_ip_updater'], '1', false ) . ' /> ';
+		echo '<label><input type="checkbox" name="js_ip_updater" value="1"' . checked( s2cp()->subscribe2_options['js_ip_updater'], '1', false ) . '> ';
 		echo esc_html__( 'Use javascript to update IP address in Subscribe2 HTML form data? (useful if caching is enabled)', 'subscribe2-for-cp' ) . '</label>' . "\r\n";
 		echo '</p>';
 		echo '</div>' . "\r\n";
diff --git a/admin/subscribers.php b/admin/subscribers.php
index e349d0c..b1f9417 100644
--- a/admin/subscribers.php
+++ b/admin/subscribers.php
@@ -5,9 +5,6 @@
 
 global $subscribers, $what, $current_tab;
 
-// detect or define which tab we are in
-$current_tab = isset( $_GET['tab'] ) ? esc_attr( $_GET['tab'] ) : 'public';
-
 // Access function to allow display for form elements
 require_once S2PATH . 'classes/class-s2-forms.php';
 $s2_forms = new s2_forms();
@@ -21,9 +18,16 @@
 	$s2_list_table = new S2_List_Table();
 }
 
+// detect or define which tab we are in
+if ( isset( $_GET['_wpnonce'] ) && false !== wp_verify_nonce( $_GET['_wpnonce'], 's2_subscriber_tab' ) ) {
+	$current_tab = isset( $_GET['tab'] ) ? esc_attr( $_GET['tab'] ) : 'public';
+} else {
+	$current_tab = 'public';
+}
+
 // was anything POSTed ?
 if ( isset( $_POST['s2_admin'] ) ) {
-	if ( false === wp_verify_nonce( $_REQUEST['_wpnonce'], 'bulk-' . $s2_list_table->_args['plural'] ) ) {
+	if ( false === wp_verify_nonce( $_POST['_wpnonce'], 'bulk-' . $s2_list_table->_args['plural'] ) ) {
 		die( '<p>' . esc_html__( 'Security error! Your request cannot be completed.', 'subscribe2-for-cp' ) . '</p>' );
 	}
 
@@ -79,20 +83,24 @@
 	} elseif ( isset( $_POST['remind'] ) ) {
 		s2cp()->remind( $_POST['reminderemails'] );
 		echo '<div id="message" class="updated fade"><p><strong>' . esc_html__( 'Reminder Email(s) Sent!', 'subscribe2-for-cp' ) . '</strong></p></div>';
-	} elseif ( isset( $_POST['sub_categories'] ) && 'subscribe' === $_POST['manage'] ) {
-		if ( isset( $_REQUEST['subscriber'] ) ) {
-			s2cp()->subscribe_registered_users( implode( ",\r\n", $_REQUEST['subscriber'] ), $_POST['category'] );
-		} else {
-			s2cp()->subscribe_registered_users( $_POST['exportcsv'], $_POST['category'] );
-		}
-		echo '<div id="message" class="updated fade"><p><strong>' . esc_html__( 'Registered Users Subscribed!', 'subscribe2-for-cp' ) . '</strong></p></div>';
-	} elseif ( isset( $_POST['sub_categories'] ) && 'unsubscribe' === $_POST['manage'] ) {
-		if ( isset( $_REQUEST['subscriber'] ) ) {
-			s2cp()->unsubscribe_registered_users( implode( ",\r\n", $_REQUEST['subscriber'] ), $_POST['category'] );
+	} elseif ( isset( $_POST['sub_categories'] ) ) {
+		if ( isset( $_POST['manage'] ) && 'subscribe' === $_POST['manage'] ) {
+			if ( isset( $_REQUEST['subscriber'] ) ) {
+				s2cp()->subscribe_registered_users( implode( ",\r\n", $_REQUEST['subscriber'] ), $_POST['category'] );
+			} else {
+				s2cp()->subscribe_registered_users( $_POST['exportcsv'], $_POST['category'] );
+			}
+			echo '<div id="message" class="updated fade"><p><strong>' . esc_html__( 'Registered Users Subscribed!', 'subscribe2-for-cp' ) . '</strong></p></div>';
+		} elseif ( isset( $_POST['manage'] ) && 'unsubscribe' === $_POST['manage'] ) {
+			if ( isset( $_REQUEST['subscriber'] ) ) {
+				s2cp()->unsubscribe_registered_users( implode( ",\r\n", $_REQUEST['subscriber'] ), $_POST['category'] );
+			} else {
+				s2cp()->unsubscribe_registered_users( $_POST['exportcsv'], $_POST['category'] );
+			}
+			echo '<div id="message" class="updated fade"><p><strong>' . esc_html__( 'Registered Users Unsubscribed!', 'subscribe2-for-cp' ) . '</strong></p></div>';
 		} else {
-			s2cp()->unsubscribe_registered_users( $_POST['exportcsv'], $_POST['category'] );
+			echo '<div id="message" class="error fade"><p><strong>' . esc_html__( 'Please select an action to perform!', 'subscribe2-for-cp' ) . '</strong></p></div>';
 		}
-		echo '<div id="message" class="updated fade"><p><strong>' . esc_html__( 'Registered Users Unsubscribed!', 'subscribe2-for-cp' ) . '</strong></p></div>';
 	} elseif ( isset( $_POST['sub_format'] ) ) {
 		if ( isset( $_REQUEST['subscriber'] ) ) {
 			s2cp()->format_change( implode( ",\r\n", $_REQUEST['subscriber'] ), $_POST['format'] );
@@ -203,21 +211,21 @@
 echo '<h2 class="nav-tab-wrapper">';
 foreach ( $s2tabs as $tab_key => $tab_caption ) {
 	$active = ( $current_tab === $tab_key ) ? 'nav-tab-active' : '';
-	echo '<a class="nav-tab ' . esc_attr( $active ) . '" href="' . esc_url( '?page=s2_tools&amp;tab=' . $tab_key ) . '">' . esc_html( $tab_caption ) . '</a>';
+	echo '<a class="nav-tab ' . esc_attr( $active ) . '" href="' . esc_url( wp_nonce_url( '?page=s2_tools&amp;tab=' . $tab_key, 's2_subscriber_tab' ) ) . '">' . esc_html( $tab_caption ) . '</a>';
 }
 echo '</h2>';
 echo '<form method="post">' . "\r\n";
 
-echo '<input type="hidden" name="s2_admin" />' . "\r\n";
+echo '<input type="hidden" name="s2_admin">' . "\r\n";
 switch ( $current_tab ) {
 	case 'public':
-		echo '<input type="hidden" id="s2_location" name="s2_location" value="public" />' . "\r\n";
+		echo '<input type="hidden" id="s2_location" name="s2_location" value="public">' . "\r\n";
 		echo '<div class="s2_admin" id="s2_add_subscribers">' . "\r\n";
 		echo '<h2>' . esc_html__( 'Add/Remove Subscribers', 'subscribe2-for-cp' ) . '</h2>' . "\r\n";
 		echo '<p><label>' . esc_html__( 'Enter addresses, one per line or comma-separated', 'subscribe2-for-cp' ) . '<br>' . "\r\n";
 		echo '<textarea rows="2" cols="80" name="addresses"></textarea></label></p>' . "\r\n";
-		echo '<p class="submit" style="border-top: none;"><input type="submit" class="button-primary" name="subscribe" value="' . esc_attr( __( 'Subscribe', 'subscribe2-for-cp' ) ) . '" />';
-		echo '&nbsp;<input type="submit" class="button-primary" name="unsubscribe" value="' . esc_attr( __( 'Unsubscribe', 'subscribe2-for-cp' ) ) . '" /></p>' . "\r\n";
+		echo '<p class="submit" style="border-top: none;"><input type="submit" class="button-primary" name="subscribe" value="' . esc_attr( __( 'Subscribe', 'subscribe2-for-cp' ) ) . '">';
+		echo '&nbsp;<input type="submit" class="button-primary" name="unsubscribe" value="' . esc_attr( __( 'Unsubscribe', 'subscribe2-for-cp' ) ) . '"></p>' . "\r\n";
 		echo '</div>' . "\r\n";
 
 		// subscriber lists
@@ -233,7 +241,7 @@
 		break;
 
 	case 'registered':
-		echo '<input type="hidden" id="s2_location" name="s2_location" value="registered" />' . "\r\n";
+		echo '<input type="hidden" id="s2_location" name="s2_location" value="registered">' . "\r\n";
 		echo '<div class="s2_admin" id="s2_add_subscribers">' . "\r\n";
 		echo '<h2>' . esc_html__( 'Add/Remove Subscribers', 'subscribe2-for-cp' ) . '</h2>' . "\r\n";
 		echo '<p class="submit" style="border-top: none;"><a class="button-primary" href="' . esc_url( admin_url( 'user-new.php' ) ) . '">' . esc_html__( 'Add Registered User', 'subscribe2-for-cp' ) . '</a></p>' . "\r\n";
@@ -254,8 +262,8 @@
 s2cp()->display_subscriber_dropdown( $what, __( 'Filter', 'subscribe2-for-cp' ), $exclude );
 echo '</td>' . "\r\n";
 if ( $reminderform ) {
-	echo '<td style="width: 25%; text-align: right;"><input type="hidden" name="reminderemails" value="' . esc_attr( $reminderemails ) . '" />' . "\r\n";
-	echo '<input type="submit" class="button-secondary" name="remind" value="' . esc_attr( __( 'Send Reminder Email', 'subscribe2-for-cp' ) ) . '" /></td>' . "\r\n";
+	echo '<td style="width: 25%; text-align: right;"><input type="hidden" name="reminderemails" value="' . esc_attr( $reminderemails ) . '">' . "\r\n";
+	echo '<input type="submit" class="button-secondary" name="remind" value="' . esc_attr( __( 'Send Reminder Email', 'subscribe2-for-cp' ) ) . '"></td>' . "\r\n";
 } else {
 	echo '<td style="width: 25%;"></td>';
 }
@@ -268,8 +276,9 @@
 			( '' === $exportcsv ) ? $exportcsv = $subscriber['user_email'] : $exportcsv .= ",\r\n" . $subscriber['user_email'];
 		}
 	}
-	echo '<td style="width: 25%; text-align: right;"><input type="hidden" name="exportcsv" value="' . esc_attr( $exportcsv ) . '" />' . "\r\n";
-	echo '<input type="submit" class="button-secondary" name="csv" value="' . esc_attr( __( 'Save Emails to CSV File', 'subscribe2-for-cp' ) ) . '" /></td>' . "\r\n";
+	echo '<td style="width: 25%; text-align: right;"><input type="hidden" name="exportcsv" value="' . esc_attr( $exportcsv ) . '">' . "\r\n";
+	wp_nonce_field( 's2_export_csv', '_s2_export_csv' );
+	echo '<input type="submit" class="button-secondary" name="csv" value="' . esc_attr( __( 'Save Emails to CSV File', 'subscribe2' ) ) . '"></td>' . "\r\n";
 } else {
 	echo '<td style="width: 25%;"></td>';
 }
diff --git a/classes/class-s2-admin.php b/classes/class-s2-admin.php
index b427da1..0b5d561 100644
--- a/classes/class-s2-admin.php
+++ b/classes/class-s2-admin.php
@@ -60,7 +60,7 @@ public function admin_hooks() {
 		register_uninstall_hook( S2PLUGIN, array( 'S2_Admin', 's2_uninstall' ) );
 
 		// capture CSV export
-		if ( isset( $_POST['s2_admin'] ) && isset( $_POST['csv'] ) ) {
+		if ( isset( $_POST['s2_admin'] ) && isset( $_POST['csv'] ) && false !== wp_verify_nonce( $_POST['_s2_export_csv'], 's2_export_csv' ) ) {
 			$date = gmdate( 'Y-m-d' );
 			header( 'Content-Description: File Transfer' );
 			header( 'Content-type: application/octet-stream' );
@@ -265,7 +265,9 @@ public function user_admin_css() {
 	public function option_form_js() {
 		wp_register_script( 's2_edit', S2URL . 'include/s2-edit' . $this->script_debug . '.js', array( 'jquery' ), '1.3', true );
 		wp_enqueue_script( 's2_edit' );
-		if ( 'never' !== $this->subscribe2_options['email_freq'] || ( isset( $_POST['email_freq'] ) && 'never' !== $_POST['email_freq'] ) ) {
+		if ( 'never' !== $this->subscribe2_options['email_freq'] ||
+			( isset( $_POST['email_freq'] ) && 'never' !== $_POST['email_freq'] && false !== wp_verify_nonce( $_REQUEST['_wpnonce'], 'subscribe2-options_subscribers' . S2VERSION ) )
+			) {
 			wp_enqueue_script( 'jquery-ui-datepicker' );
 			wp_enqueue_style( 'jquery-style', 'https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/themes/smoothness/jquery-ui.css', array(), '1.12.1' );
 			wp_register_script( 's2_date_time', S2URL . 'include/s2-date-time' . $this->script_debug . '.js', array( 'jquery-ui-datepicker' ), '1.1', true );
@@ -455,13 +457,13 @@ public function s2_meta_init( $post_type, $post ) {
 	public function s2_override_meta() {
 		global $post_ID;
 		$s2mail = get_post_meta( $post_ID, '_s2mail', true );
-		echo '<input type="hidden" name="s2meta_nonce" id="s2meta_nonce" value="' . esc_attr( wp_create_nonce( wp_hash( plugin_basename( __FILE__ ) ) ) ) . '" />';
+		echo '<input type="hidden" name="s2meta_nonce" id="s2meta_nonce" value="' . esc_attr( wp_create_nonce( wp_hash( plugin_basename( __FILE__ ) ) ) ) . '">';
 		echo esc_html__( 'Check here to disable sending of an email notification for this post/page', 'subscribe2-for-cp' );
 		echo '&nbsp;&nbsp;<input type="checkbox" name="s2_meta_field" value="no"';
 		if ( 'no' === $s2mail || ( '1' === $this->subscribe2_options['s2meta_default'] && '' === $s2mail ) ) {
 			echo ' checked="checked"';
 		}
-		echo ' />';
+		echo '>';
 	}
 
 	/**
@@ -494,22 +496,19 @@ public function s2_meta_handler( $post_id ) {
 	 */
 	public function s2_preview_meta() {
 		echo '<p>' . esc_html__( 'Send preview email of this post to currently logged in user:', 'subscribe2-for-cp' ) . '</p>' . "\r\n";
-		echo '<input class="button" name="s2_preview" type="submit" value="' . esc_attr( __( 'Send Preview', 'subscribe2-for-cp' ) ) . '" />' . "\r\n";
+		echo '<input class="button" name="s2_preview" type="submit" value="' . esc_attr( __( 'Send Preview', 'subscribe2-for-cp' ) ) . '">' . "\r\n";
 	}
 
 	/**
 	 * Meta preview box handler
 	 */
 	public function s2_preview_handler() {
-		if ( isset( $_POST['s2_preview'] ) ) {
-			if ( defined( 'DOING_CRON' ) && DOING_CRON ) {
-				return;
-			}
+		if ( isset( $_POST['s2_preview'] ) && false !== check_admin_referer( 'update-post_' . (int) $_POST['post_ID'] ) ) {
 			global $post, $current_user;
-			if ( 'never' !== $this->subscribe2_options['email_freq'] ) {
-				$this->subscribe2_cron( $current_user->user_email );
+			if ( 'never' !== s2cp()->subscribe2_options['email_freq'] ) {
+				s2cp()->subscribe2_cron( $current_user->user_email );
 			} else {
-				$this->publish( $post, $current_user->user_email );
+				s2cp()->publish( $post, $current_user->user_email );
 			}
 			add_filter( 'redirect_post_location', array( $this, 's2_preview_redirect' ) );
 		}
@@ -527,19 +526,16 @@ public function s2_preview_redirect( $location ) {
 	 */
 	public function s2_resend_meta() {
 		echo '<p>' . esc_html__( 'Resend the notification email of this post to current subscribers:', 'subscribe2-for-cp' ) . '</p>' . "\r\n";
-		echo '<input class="button" name="s2_resend" type="submit" value="' . esc_attr( __( 'Resend Notification', 'subscribe2-for-cp' ) ) . '" />' . "\r\n";
+		echo '<input class="button" name="s2_resend" type="submit" value="' . esc_attr( __( 'Resend Notification', 'subscribe2-for-cp' ) ) . '">' . "\r\n";
 	}
 
 	/**
 	 * Meta resend box handler
 	 */
 	public function s2_resend_handler() {
-		if ( isset( $_POST['s2_resend'] ) ) {
-			if ( defined( 'DOING_CRON' ) && DOING_CRON ) {
-				return;
-			}
+		if ( isset( $_POST['s2_resend'] ) && false !== check_admin_referer( 'update-post_' . (int) $_POST['post_ID'] ) ) {
 			global $post;
-			$this->publish( $post );
+			s2cp()->publish( $post );
 			add_filter( 'redirect_post_location', array( $this, 's2_resend_redirect' ) );
 		}
 	}
@@ -555,16 +551,18 @@ public function s2_resend_redirect( $location ) {
 	 * Admin notice after resend called
 	 */
 	public function s2_meta_notices() {
+		// phpcs:disable WordPress.Security.NonceVerification
 		if ( isset( $_GET['s2'] ) && 'resend' === $_GET['s2'] ) {
 			$class   = 'notice notice-success is-dismissible';
-			$message = __( 'Attempt made to resend email notification.', 'subscribe2-for-cp' );
+			$message = __( 'Attempt made to resend email notification.', 'subscribe2' );
 			echo '<div class="' . esc_attr( $class ) . '"><p>' . esc_html( $message ) . '</p></div>';
 		}
 		if ( isset( $_GET['s2'] ) && 'preview' === $_GET['s2'] ) {
 			$class   = 'notice notice-success is-dismissible';
-			$message = __( 'Attempt made to send email preview.', 'subscribe2-for-cp' );
+			$message = __( 'Attempt made to send email preview.', 'subscribe2' );
 			echo '<div class="' . esc_attr( $class ) . '"><p>' . esc_html( $message ) . '</p></div>';
 		}
+		// phpcs:enable WordPress.Security.NonceVerification
 	}
 
 	/* ===== WordPress menu helper functions ===== */
@@ -690,7 +688,7 @@ public function display_format_form( $formats, $selected = array() ) {
 			$colspan = 1;
 		}
 		echo '<tr><td style="text-align: left;" colspan="' . esc_attr( $colspan ) . '">' . "\r\n";
-		echo '<label><input type="checkbox" name="checkall" value="checkall_format" /> ' . esc_html__( 'Select / Unselect All', 'subscribe2-for-cp' ) . '</label>' . "\r\n";
+		echo '<label><input type="checkbox" name="checkall" value="checkall_format"> ' . esc_html__( 'Select / Unselect All', 'subscribe2-for-cp' ) . '</label>' . "\r\n";
 		echo '</td></tr>' . "\r\n";
 		echo '<tr style="vertical-align: top;"><td style="width: 50%; text-align: left">' . "\r\n";
 		foreach ( $formats[0] as $format ) {
@@ -704,13 +702,13 @@ public function display_format_form( $formats, $selected = array() ) {
 				if ( in_array( $format, $selected, true ) ) {
 						echo ' checked="checked"';
 				}
-				echo ' /> ' . esc_html( ucwords( $format ) ) . '</label><br>' . "\r\n";
+				echo '> ' . esc_html( ucwords( $format ) ) . '</label><br>' . "\r\n";
 			} else {
 				echo '<label><input class="checkall_format" type="checkbox" name="format[]" value="' . esc_attr( $format ) . '"';
 				if ( in_array( $format, $selected, true ) ) {
 							echo ' checked="checked"';
 				}
-				echo ' /> ' . esc_html( ucwords( $format ) ) . '</label><br>' . "\r\n";
+				echo '> ' . esc_html( ucwords( $format ) ) . '</label><br>' . "\r\n";
 			}
 			$i++;
 		}
@@ -827,7 +825,7 @@ public function display_subscriber_dropdown( $selected = 'registered', $submit =
 
 		echo '</select>';
 		if ( false !== $submit ) {
-			echo '&nbsp;<input type="submit" class="button-secondary" value="' . esc_attr( $submit ) . '" />' . "\r\n";
+			echo '&nbsp;<input type="submit" class="button-secondary" value="' . esc_attr( $submit ) . '">' . "\r\n";
 		}
 	}
 
@@ -923,7 +921,7 @@ public function display_digest_choices() {
 			$schedule_sorted[ $key ] = $schedule[ $key ];
 		}
 		foreach ( $schedule_sorted as $key => $value ) {
-			echo '<label><input type="radio" name="email_freq" value="' . esc_attr( $key ) . '"' . checked( $this->subscribe2_options['email_freq'], $key, false ) . ' />';
+			echo '<label><input type="radio" name="email_freq" value="' . esc_attr( $key ) . '"' . checked( $this->subscribe2_options['email_freq'], $key, false ) . '>';
 			echo ' ' . esc_html( $value['display'] ) . '</label><br>' . "\r\n";
 		}
 		if ( $scheduled_time ) {
@@ -934,8 +932,8 @@ public function display_digest_choices() {
 			echo '<p>' . esc_html__( 'Current blog time is', 'subscribe2-for-cp' ) . ': ' . "\r\n";
 			echo '<strong>' . esc_html( date_i18n( $date_format . ' @ ' . $time_format ) ) . '</strong></p>' . "\r\n";
 			echo '<p>' . esc_html__( 'Next email notification will be sent when your blog time is after', 'subscribe2-for-cp' ) . ': ' . "\r\n";
-			echo '<input type="hidden" id="jscrondate" value="' . esc_attr( date_i18n( $date_format, $scheduled_time + $offset ) ) . '" />';
-			echo '<input type="hidden" id="jscrontime" value="' . esc_attr( date_i18n( $time_format, $scheduled_time + $offset ) ) . '" />';
+			echo '<input type="hidden" id="jscrondate" value="' . esc_attr( date_i18n( $date_format, $scheduled_time + $offset ) ) . '">';
+			echo '<input type="hidden" id="jscrontime" value="' . esc_attr( date_i18n( $time_format, $scheduled_time + $offset ) ) . '">';
 			echo '<span id="s2cron_1"><span id="s2crondate" style="background-color: #FFFBCC">' . esc_html( date_i18n( $date_format, $scheduled_time + $offset ) ) . '</span>';
 			echo ' @ <span id="s2crontime" style="background-color: #FFFBCC">' . esc_html( date_i18n( $time_format, $scheduled_time + $offset ) ) . '</span> ';
 			echo '<a href="#" onclick="s2Show(\'cron\'); return false;">' . esc_html__( 'Edit', 'subscribe2-for-cp' ) . '</a></span>' . "\r\n";
@@ -956,7 +954,7 @@ public function display_digest_choices() {
 			echo '<a href="#" onclick="s2CronRevert(\'cron\'); return false;">' . esc_html__( 'Revert', 'subscribe2-for-cp' ) . '</a></span>' . "\r\n";
 			if ( ! empty( $this->subscribe2_options['last_s2cron'] ) ) {
 				echo '<p>' . esc_html__( 'Attempt to resend the last Digest Notification email', 'subscribe2-for-cp' ) . ': ';
-				echo '<input type="submit" class="button-secondary" name="resend" value="' . esc_attr( __( 'Resend Digest', 'subscribe2-for-cp' ) ) . '" /></p>' . "\r\n";
+				echo '<input type="submit" class="button-secondary" name="resend" value="' . esc_attr( __( 'Resend Digest', 'subscribe2-for-cp' ) ) . '"></p>' . "\r\n";
 			}
 		} else {
 			echo '<br>';
@@ -1255,7 +1253,7 @@ public function one_click_profile_form( $user ) {
 		echo '<h3>' . esc_html__( 'Email subscription', 'subscribe2-for-cp' ) . '</h3>' . "\r\n";
 		echo '<table class="form-table">' . "\r\n";
 		echo '<tr><th scope="row">' . esc_html__( 'Subscribe / Unsubscribe', 'subscribe2-for-cp' ) . '</th>' . "\r\n";
-		echo '<td><label><input type="checkbox" name="sub2-one-click-subscribe" value="1" ' . checked( ! get_user_meta( $user->ID, $this->get_usermeta_keyname( 's2_subscribed' ), true ), false, false ) . ' /> ' . esc_html__( 'Receive notifications', 'subscribe2-for-cp' ) . '</label><br>' . "\r\n";
+		echo '<td><label><input type="checkbox" name="sub2-one-click-subscribe" value="1" ' . checked( ! get_user_meta( $user->ID, $this->get_usermeta_keyname( 's2_subscribed' ), true ), false, false ) . '> ' . esc_html__( 'Receive notifications', 'subscribe2-for-cp' ) . '</label><br>' . "\r\n";
 		echo '<span class="description">' . esc_html__( 'Check if you want to receive email notification when new posts are published', 'subscribe2-for-cp' ) . '</span>' . "\r\n";
 		echo '</td></tr></table>' . "\r\n";
 	}
@@ -1264,7 +1262,7 @@ public function one_click_profile_form( $user ) {
 	 * Handle submission from profile one-click subscription
 	 */
 	public function one_click_profile_form_save( $user_id ) {
-		if ( current_user_can( 'edit_user', $user_id ) ) {
+		if ( current_user_can( 'edit_user', $user_id ) && false !== wp_verify_nonce( $_POST['_s2_one_click_profile'], 's2_one_click_profile' ) ) {
 			if ( isset( $_POST['sub2-one-click-subscribe'] ) && 1 === (int) $_POST['sub2-one-click-subscribe'] ) {
 				$this->one_click_handler( $user_id, 'subscribe' );
 			} else {
diff --git a/classes/class-s2-ajax.php b/classes/class-s2-ajax.php
index 6effc21..6eca5c0 100755
--- a/classes/class-s2-ajax.php
+++ b/classes/class-s2-ajax.php
@@ -52,8 +52,10 @@ public function add_ajax() {
 	public function s2_ajax_form_handler() {
 		require_once ABSPATH . '/wp-includes/shortcodes.php';
 
+		// phpcs:disable WordPress.Security.NonceVerification
 		$response = str_replace( ':', '&', $_POST['data'] );
 		$response = str_replace( '-', '=', $response );
+		// phpcs:enable WordPress.Security.NonceVerification
 
 		$atts = array();
 		wp_parse_str( $response, $atts );
diff --git a/classes/class-s2-core.php b/classes/class-s2-core.php
index 1983112..8fff6c1 100644
--- a/classes/class-s2-core.php
+++ b/classes/class-s2-core.php
@@ -68,7 +68,7 @@ public function mail( $recipients = array(), $subject = '', $message = '', $type
 			remove_all_filters( 'wp_mail_content_type' );
 			add_filter( 'wp_mail_content_type', array( $this, 'html_email' ) );
 			if ( 'yes' === $this->subscribe2_options['stylesheet'] ) {
-				$mailtext = (string) apply_filters( 's2_html_email', '<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title>' . $subject . '</title><link rel="stylesheet" href="' . get_stylesheet_directory_uri() . (string) apply_filters( 's2_stylesheet_name', '/style.css' ) . '" type="text/css" media="screen" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body>' . $message . '</body></html>', $subject, $message ); // phpcs:ignore WordPress.WP.EnqueuedResources
+				$mailtext = (string) apply_filters( 's2_html_email', '<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title>' . $subject . '</title><link rel="stylesheet" href="' . get_stylesheet_directory_uri() . (string) apply_filters( 's2_stylesheet_name', '/style.css' ) . '" type="text/css" media="screen"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body>' . $message . '</body></html>', $subject, $message ); // phpcs:ignore WordPress.WP.EnqueuedResources
 			} else {
 				$mailtext = (string) apply_filters( 's2_html_email', '<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title>' . $subject . '</title></head><body>' . $message . '</body></html>', $subject, $message );
 			}
@@ -276,7 +276,10 @@ public function publish( $post, $preview = '' ) {
 		if ( '' === $preview ) {
 			// we aren't sending a Preview to the current user so carry out checks
 			$s2mail = get_post_meta( $post->ID, '_s2mail', true );
-			if ( ( isset( $_POST['s2_meta_field'] ) && 'no' === $_POST['s2_meta_field'] ) || 'no' === strtolower( trim( $s2mail ) ) ) {
+
+			if ( 'no' === strtolower( trim( $s2mail ) ) ||
+				( isset( $_POST['s2_meta_field'] ) && 'no' === $_POST['s2_meta_field'] && false !== wp_verify_nonce( $_POST['_s2meta_nonce'], 's2meta_nonce' ) )
+			) {
 				return $post;
 			}
 
@@ -1247,7 +1250,7 @@ public function register_form() {
 		}
 		if ( 'wpreg' === $this->subscribe2_options['autosub'] ) {
 			echo '<p><label>';
-			echo '<input type="checkbox" name="reg_subscribe"' . checked( $this->subscribe2_options['wpregdef'], 'yes', false ) . ' /> ';
+			echo '<input type="checkbox" name="reg_subscribe"' . checked( $this->subscribe2_options['wpregdef'], 'yes', false ) . '> ';
 			echo esc_html__( 'Check here to Subscribe to email notifications for new posts', 'subscribe2-for-cp' ) . "\r\n";
 			echo '</label></p>' . "\r\n";
 		} elseif ( 'yes' === $this->subscribe2_options['autosub'] ) {
@@ -1264,7 +1267,10 @@ public function register_post( $user_ID = 0 ) {
 		if ( 0 === $user_ID ) {
 			return;
 		}
-		if ( 'yes' === $this->subscribe2_options['autosub'] || ( isset( $_POST['reg_subscribe'] ) && 'on' === $_POST['reg_subscribe'] && 'wpreg' === $this->subscribe2_options['autosub'] ) ) {
+
+		if ( 'yes' === $this->subscribe2_options['autosub'] ||
+			( isset( $_POST['reg_subscribe'] ) && 'on' === $_POST['reg_subscribe'] && 'wpreg' === $this->subscribe2_options['autosub'] && false !== wp_verify_nonce( $_POST['_s2_register'], 's2_register' ) )
+		) {
 			$this->register( $user_ID, true );
 		} else {
 			$this->register( $user_ID, false );
@@ -1279,7 +1285,7 @@ public function s2_comment_meta_form( $submit_field ) {
 		if ( is_user_logged_in() ) {
 			$comment_meta_form = $this->profile;
 		} else {
-			$comment_meta_form = '<p style="width: auto;"><label><input type="checkbox" name="s2_comment_request" value="1" ' . checked( $this->subscribe2_options['comment_def'], 'yes', false ) . '/> ' . __( 'Check here to Subscribe to notifications for new posts', 'subscribe2-for-cp' ) . '</label></p>';
+			$comment_meta_form = '<p style="width: auto;"><label><input type="checkbox" name="s2_comment_request" value="1" ' . checked( $this->subscribe2_options['comment_def'], 'yes', false ) . '> ' . __( 'Check here to Subscribe to notifications for new posts', 'subscribe2-for-cp' ) . '</label></p>';
 		}
 		if ( 'before' === $this->subscribe2_options['comment_subs'] ) {
 			return $comment_meta_form . $submit_field;
@@ -1293,6 +1299,7 @@ public function s2_comment_meta_form( $submit_field ) {
 	 */
 	public function s2_comment_meta( $comment_id, $approved = 0 ) {
 		// return if email is empty - can happen if setting to require name and email for comments is disabled
+		// phpcs:disable WordPress.Security.NonceVerification
 		if ( isset( $_POST['email'] ) && empty( $_POST['email'] ) ) {
 			return;
 		}
@@ -1318,6 +1325,7 @@ public function s2_comment_meta( $comment_id, $approved = 0 ) {
 					break;
 			}
 		}
+		// phpcs:enable WordPress.Security.NonceVerification
 	}
 
 	/**
@@ -1848,6 +1856,7 @@ public function s2hooks() {
 			require_once S2PATH . 'classes/class-s2-multisite.php';
 			global $s2class_multisite;
 			$s2class_multisite = new S2_Multisite();
+			// phpcs:ignore WordPress.Security.NonceVerification
 			if ( isset( $_GET['s2mu_subscribe'] ) || isset( $_GET['s2mu_unsubscribe'] ) ) {
 				add_action( 'init', array( &$s2class_multisite, 'wpmu_subscribe' ) );
 			}
diff --git a/classes/class-s2-counter-widget.php b/classes/class-s2-counter-widget.php
index 2d992fe..b7d2e8e 100755
--- a/classes/class-s2-counter-widget.php
+++ b/classes/class-s2-counter-widget.php
@@ -92,27 +92,27 @@ public function form( $instance ) {
 		$s2w_font   = htmlspecialchars( $instance['s2w_font'], ENT_QUOTES );
 		echo '<div>' . "\r\n";
 		echo '<fieldset><legend><label for="' . esc_attr( $this->get_field_id( 'title' ) ) . '">' . esc_html__( 'Widget Title', 'subscribe2-for-cp' ) . '</label></legend>' . "\r\n";
-		echo '<input type="text" name="' . esc_attr( $this->get_field_name( 'title' ) ) . '" id="' . esc_attr( $this->get_field_id( 'title' ) ) . '" value="' . esc_attr( $s2w_title ) . '" />' . "\r\n";
+		echo '<input type="text" name="' . esc_attr( $this->get_field_name( 'title' ) ) . '" id="' . esc_attr( $this->get_field_id( 'title' ) ) . '" value="' . esc_attr( $s2w_title ) . '">' . "\r\n";
 		echo '</fieldset>' . "\r\n";
 
 		echo '<fieldset>' . "\r\n";
 		echo '<legend>' . esc_html__( 'Color Scheme', 'subscribe2-for-cp' ) . '</legend>' . "\r\n";
 		echo '<table style="border:0; padding:0; margin:0 0 12px 0; border-collapse:collapse;" align="center">' . "\r\n";
 		echo '<tr><td><label for="' . esc_attr( $this->get_field_id( 's2w_bg' ) ) . '">' . esc_html__( 'Body', 'subscribe2-for-cp' ) . '</label></td>' . "\r\n";
-		echo '<td><input type="text" name="' . esc_attr( $this->get_field_name( 's2w_bg' ) ) . '" id="' . esc_attr( $this->get_field_id( 's2w_bg' ) ) . '" maxlength="6" value="' . esc_attr( $s2w_bg ) . '" class="colorpickerField" style="width:60px;" /></td></tr>' . "\r\n";
+		echo '<td><input type="text" name="' . esc_attr( $this->get_field_name( 's2w_bg' ) ) . '" id="' . esc_attr( $this->get_field_id( 's2w_bg' ) ) . '" maxlength="6" value="' . esc_attr( $s2w_bg ) . '" class="colorpickerField" style="width:60px;"></td></tr>' . "\r\n";
 		echo '<tr><td><label for="' . esc_attr( $this->get_field_id( 's2w_fg' ) ) . '">' . esc_html__( 'Text', 'subscribe2-for-cp' ) . '</label></td>' . "\r\n";
-		echo '<td><input type="text" name="' . esc_attr( $this->get_field_name( 's2w_fg' ) ) . '" id="' . esc_attr( $this->get_field_id( 's2w_fg' ) ) . '" maxlength="6" value="' . esc_attr( $s2w_fg ) . '" class="colorpickerField" style="width:60px;" /></td></tr>' . "\r\n";
+		echo '<td><input type="text" name="' . esc_attr( $this->get_field_name( 's2w_fg' ) ) . '" id="' . esc_attr( $this->get_field_id( 's2w_fg' ) ) . '" maxlength="6" value="' . esc_attr( $s2w_fg ) . '" class="colorpickerField" style="width:60px;"></td></tr>' . "\r\n";
 		echo '</table></fieldset>';
 
 		echo '<fieldset>' . "\r\n";
 		echo '<legend>' . esc_html__( 'Width, Height and Font Size', 'subscribe2-for-cp' ) . '</legend>' . "\r\n";
 		echo '<table style="border:0; padding:0; margin:0 0 12px 0; border-collapse:collapse;" align="center">' . "\r\n";
 		echo '<tr><td><label for="' . esc_attr( $this->get_field_id( 's2w_width' ) ) . '">' . esc_html__( 'Width', 'subscribe2-for-cp' ) . '</label></td>' . "\r\n";
-		echo '<td><input type="text" name="' . esc_attr( $this->get_field_name( 's2w_width' ) ) . '" id="' . esc_attr( $this->get_field_id( 's2w_width' ) ) . '" value="' . esc_attr( $s2w_width ) . '" /></td></tr>' . "\r\n";
+		echo '<td><input type="text" name="' . esc_attr( $this->get_field_name( 's2w_width' ) ) . '" id="' . esc_attr( $this->get_field_id( 's2w_width' ) ) . '" value="' . esc_attr( $s2w_width ) . '"></td></tr>' . "\r\n";
 		echo '<tr><td><label for="' . esc_attr( $this->get_field_id( 's2w_height' ) ) . '">' . esc_html__( 'Height', 'subscribe2-for-cp' ) . '</label></td>' . "\r\n";
-		echo '<td><input type="text" name="' . esc_attr( $this->get_field_name( 's2w_height' ) ) . '" id="' . esc_attr( $this->get_field_id( 's2w_height' ) ) . '" value="' . esc_attr( $s2w_height ) . '" /></td></tr>' . "\r\n";
+		echo '<td><input type="text" name="' . esc_attr( $this->get_field_name( 's2w_height' ) ) . '" id="' . esc_attr( $this->get_field_id( 's2w_height' ) ) . '" value="' . esc_attr( $s2w_height ) . '"></td></tr>' . "\r\n";
 		echo '<tr><td><label for="' . esc_attr( $this->get_field_id( 's2w_font' ) ) . '">' . esc_html__( 'Font', 'subscribe2-for-cp' ) . '</label></td>' . "\r\n";
-		echo '<td><input type="text" name="' . esc_attr( $this->get_field_name( 's2w_font' ) ) . '" id="' . esc_attr( $this->get_field_id( 's2w_font' ) ) . '" value="' . esc_attr( $s2w_font ) . '" /></td></tr>' . "\r\n";
+		echo '<td><input type="text" name="' . esc_attr( $this->get_field_name( 's2w_font' ) ) . '" id="' . esc_attr( $this->get_field_id( 's2w_font' ) ) . '" value="' . esc_attr( $s2w_font ) . '"></td></tr>' . "\r\n";
 		echo '</table></fieldset></div>' . "\r\n";
 	}
 }
diff --git a/classes/class-s2-form-widget.php b/classes/class-s2-form-widget.php
index b89f131..2b00689 100755
--- a/classes/class-s2-form-widget.php
+++ b/classes/class-s2-form-widget.php
@@ -138,21 +138,21 @@ public function form( $instance ) {
 
 		echo '<div>' . "\r\n";
 		echo '<p><label for="' . esc_attr( $this->get_field_id( 'title' ) ) . '">' . esc_html__( 'Title', 'subscribe2-for-cp' ) . ':' . "\r\n";
-		echo '<input class="widefat" id="' . esc_attr( $this->get_field_id( 'title' ) ) . '" name="' . esc_attr( $this->get_field_name( 'title' ) ) . '" type="text" value="' . esc_attr( $title ) . '" /></label></p>' . "\r\n";
+		echo '<input class="widefat" id="' . esc_attr( $this->get_field_id( 'title' ) ) . '" name="' . esc_attr( $this->get_field_name( 'title' ) ) . '" type="text" value="' . esc_attr( $title ) . '"></label></p>' . "\r\n";
 		echo '<p><label for="' . esc_attr( $this->get_field_id( 'div' ) ) . '">' . esc_html__( 'Div class name', 'subscribe2-for-cp' ) . ':' . "\r\n";
-		echo '<input class="widefat" id="' . esc_attr( $this->get_field_id( 'div' ) ) . '" name="' . esc_attr( $this->get_field_name( 'div' ) ) . '" type="text" value="' . esc_attr( $div ) . '" /></label></p>' . "\r\n";
+		echo '<input class="widefat" id="' . esc_attr( $this->get_field_id( 'div' ) ) . '" name="' . esc_attr( $this->get_field_name( 'div' ) ) . '" type="text" value="' . esc_attr( $div ) . '"></label></p>' . "\r\n";
 		echo '<p><label for="' . esc_attr( $this->get_field_id( 'widgetprecontent' ) ) . '">' . esc_html__( 'Pre-Content', 'subscribe2-for-cp' ) . ':' . "\r\n";
 		echo '<textarea class="widefat" id="' . esc_attr( $this->get_field_id( 'widgetprecontent' ) ) . '" name="' . esc_attr( $this->get_field_name( 'widgetprecontent' ) ) . '" rows="2" cols="25">' . esc_attr( $widgetprecontent ) . '</textarea></label></p>' . "\r\n";
 		echo '<p><label for="' . esc_attr( $this->get_field_id( 'widgetpostcontent' ) ) . '">' . esc_html__( 'Post-Content', 'subscribe2-for-cp' ) . ':' . "\r\n";
 		echo '<textarea class="widefat" id="' . esc_attr( $this->get_field_id( 'widgetpostcontent' ) ) . '" name="' . esc_attr( $this->get_field_name( 'widgetpostcontent' ) ) . '" rows="2" cols="25">' . esc_attr( $widgetpostcontent ) . '</textarea></label></p>' . "\r\n";
 		echo '<p><label for="' . esc_attr( $this->get_field_id( 'size' ) ) . '">' . esc_html__( 'Text Box Size', 'subscribe2-for-cp' ) . ':' . "\r\n";
-		echo '<input class="widefat" id="' . esc_attr( $this->get_field_id( 'size' ) ) . '" name="' . esc_attr( $this->get_field_name( 'size' ) ) . '" type="text" value="' . esc_attr( $size ) . '" /></label></p>' . "\r\n";
+		echo '<input class="widefat" id="' . esc_attr( $this->get_field_id( 'size' ) ) . '" name="' . esc_attr( $this->get_field_name( 'size' ) ) . '" type="text" value="' . esc_attr( $size ) . '"></label></p>' . "\r\n";
 		echo '<p>' . esc_html__( 'Display options', 'subscribe2-for-cp' ) . ':<br>' . "\r\n";
-		echo '<label for="' . esc_attr( $this->get_field_id( 'hidebutton' ) ) . 'complete"><input id="' . esc_attr( $this->get_field_id( 'hidebutton' ) ) . 'complete" name="' . esc_attr( $this->get_field_name( 'hidebutton' ) ) . '" type="radio" value="none"' . checked( 'none', $hidebutton, false ) . '/> ' . esc_html__( 'Show complete form', 'subscribe2-for-cp' ) . '</label>' . "\r\n";
-		echo '<br><label for="' . esc_attr( $this->get_field_id( 'hidebutton' ) ) . 'subscribe"><input id="' . esc_attr( $this->get_field_id( 'hidebutton' ) ) . 'subscribe" name="' . esc_attr( $this->get_field_name( 'hidebutton' ) ) . '" type="radio" value="subscribe"' . checked( 'subscribe', $hidebutton, false ) . '/> ' . esc_html__( 'Hide Subscribe button', 'subscribe2-for-cp' ) . '</label>' . "\r\n";
-		echo '<br><label for="' . esc_attr( $this->get_field_id( 'hidebutton' ) ) . 'unsubscribe"><input id="' . esc_attr( $this->get_field_id( 'hidebutton' ) ) . 'unsubscribe" name="' . esc_attr( $this->get_field_name( 'hidebutton' ) ) . '" type="radio" value="unsubscribe"' . checked( 'unsubscribe', $hidebutton, false ) . '/> ' . esc_html__( 'Hide Unsubscribe button', 'subscribe2-for-cp' ) . '</label>' . "\r\n";
+		echo '<label for="' . esc_attr( $this->get_field_id( 'hidebutton' ) ) . 'complete"><input id="' . esc_attr( $this->get_field_id( 'hidebutton' ) ) . 'complete" name="' . esc_attr( $this->get_field_name( 'hidebutton' ) ) . '" type="radio" value="none"' . checked( 'none', $hidebutton, false ) . '> ' . esc_html__( 'Show complete form', 'subscribe2-for-cp' ) . '</label>' . "\r\n";
+		echo '<br><label for="' . esc_attr( $this->get_field_id( 'hidebutton' ) ) . 'subscribe"><input id="' . esc_attr( $this->get_field_id( 'hidebutton' ) ) . 'subscribe" name="' . esc_attr( $this->get_field_name( 'hidebutton' ) ) . '" type="radio" value="subscribe"' . checked( 'subscribe', $hidebutton, false ) . '> ' . esc_html__( 'Hide Subscribe button', 'subscribe2-for-cp' ) . '</label>' . "\r\n";
+		echo '<br><label for="' . esc_attr( $this->get_field_id( 'hidebutton' ) ) . 'unsubscribe"><input id="' . esc_attr( $this->get_field_id( 'hidebutton' ) ) . 'unsubscribe" name="' . esc_attr( $this->get_field_name( 'hidebutton' ) ) . '" type="radio" value="unsubscribe"' . checked( 'unsubscribe', $hidebutton, false ) . '> ' . esc_html__( 'Hide Unsubscribe button', 'subscribe2-for-cp' ) . '</label>' . "\r\n";
 		if ( '1' === s2cp()->subscribe2_options['ajax'] ) {
-			echo '<br><label for="' . esc_attr( $this->get_field_id( 'hidebutton' ) ) . 'ajax"><input id="' . esc_attr( $this->get_field_id( 'hidebutton' ) ) . 'ajax" name="' . esc_attr( $this->get_field_name( 'hidebutton' ) ) . '" type="radio" value="link"' . checked( 'link', $hidebutton, false ) . '/> ' . esc_html__( 'Show as link', 'subscribe2-for-cp' ) . '</label>' . "\r\n";
+			echo '<br><label for="' . esc_attr( $this->get_field_id( 'hidebutton' ) ) . 'ajax"><input id="' . esc_attr( $this->get_field_id( 'hidebutton' ) ) . 'ajax" name="' . esc_attr( $this->get_field_name( 'hidebutton' ) ) . '" type="radio" value="link"' . checked( 'link', $hidebutton, false ) . '> ' . esc_html__( 'Show as link', 'subscribe2-for-cp' ) . '</label>' . "\r\n";
 		}
 		echo '</p>' . "\r\n";
 		echo '<p><label for="' . esc_attr( $this->get_field_id( 'postto' ) ) . '">' . esc_html__( 'Post form content to page', 'subscribe2-for-cp' ) . ':' . "\r\n";
@@ -171,13 +171,13 @@ public function form( $instance ) {
 		s2cp()->pages_dropdown( $postto, true );
 		echo '</select></label></p>' . "\r\n";
 		echo '<p><label for="' . esc_attr( $this->get_field_id( 'js' ) ) . '">' . esc_html__( 'Disable JavaScript', 'subscribe2-for-cp' ) . ':' . "\r\n";
-		echo '<input id="' . esc_attr( $this->get_field_id( 'js' ) ) . '" name ="' . esc_attr( $this->get_field_name( 'js' ) ) . '" value="true" type="checkbox"' . checked( 'true', $js, false ) . '/>';
+		echo '<input id="' . esc_attr( $this->get_field_id( 'js' ) ) . '" name ="' . esc_attr( $this->get_field_name( 'js' ) ) . '" value="true" type="checkbox"' . checked( 'true', $js, false ) . '>';
 		echo '</label></p>' . "\r\n";
 		echo '<p><label for="' . esc_attr( $this->get_field_id( 'noantispam' ) ) . '">' . esc_html__( 'Disable Anti-spam measures', 'subscribe2-for-cp' ) . ':' . "\r\n";
-		echo '<input id="' . esc_attr( $this->get_field_id( 'noantispam' ) ) . '" name ="' . esc_attr( $this->get_field_name( 'noantispam' ) ) . '" value="true" type="checkbox"' . checked( 'true', $noantispam, false ) . '/>';
+		echo '<input id="' . esc_attr( $this->get_field_id( 'noantispam' ) ) . '" name ="' . esc_attr( $this->get_field_name( 'noantispam' ) ) . '" value="true" type="checkbox"' . checked( 'true', $noantispam, false ) . '>';
 		echo '</label></p>' . "\r\n";
 		echo '<p><label for="' . esc_attr( $this->get_field_id( 'nowrap' ) ) . '">' . esc_html__( 'Disable wrapping of form buttons', 'subscribe2-for-cp' ) . ':' . "\r\n";
-		echo '<input id="' . esc_attr( $this->get_field_id( 'nowrap' ) ) . '" name ="' . esc_attr( $this->get_field_name( 'nowrap' ) ) . '" value="true" type="checkbox"' . checked( 'true', $nowrap, false ) . '/>';
+		echo '<input id="' . esc_attr( $this->get_field_id( 'nowrap' ) ) . '" name ="' . esc_attr( $this->get_field_name( 'nowrap' ) ) . '" value="true" type="checkbox"' . checked( 'true', $nowrap, false ) . '>';
 		echo '</label></p>' . "\r\n";
 		echo '</div>' . "\r\n";
 	}
diff --git a/classes/class-s2-forms.php b/classes/class-s2-forms.php
index 7e065f2..a109ae8 100755
--- a/classes/class-s2-forms.php
+++ b/classes/class-s2-forms.php
@@ -12,6 +12,10 @@ public function init() {
 	 * Return appropriate user ID if user can edit other users subscriptions
 	 */
 	public function get_userid() {
+		if ( isset( $_GET['_wpnonce'] ) && false === wp_verify_nonce( $_GET['_wpnonce'], '_s2_edit_registered' ) ) {
+			die( '<p>' . esc_html__( 'Security error! Your request cannot be completed.', 'subscribe2' ) . '</p>' );
+		}
+
 		if ( isset( $_GET['id'] ) ) {
 			if ( ! current_user_can( (string) apply_filters( 's2_capability', 'manage_options', 'manage' ) ) ) {
 				die( '<p>' . esc_html__( 'Permission error! Your request cannot be completed.', 'subscribe2-for-cp' ) . '</p>' );
@@ -40,23 +44,23 @@ public function s2_your_subscription_form( $userid ) {
 			return false;
 		}
 
-		echo '<input type="hidden" name="s2_admin" value="user" />';
+		echo '<input type="hidden" name="s2_admin" value="user">';
 		if ( 'never' === s2cp()->subscribe2_options['email_freq'] ) {
 			echo esc_html__( 'Receive email as', 'subscribe2-for-cp' ) . ': &nbsp;&nbsp;';
-			echo '<label><input type="radio" name="s2_format" value="html"' . checked( get_user_meta( $userid, s2cp()->get_usermeta_keyname( 's2_format' ), true ), 'html', false ) . ' />';
+			echo '<label><input type="radio" name="s2_format" value="html"' . checked( get_user_meta( $userid, s2cp()->get_usermeta_keyname( 's2_format' ), true ), 'html', false ) . '>';
 			echo ' ' . esc_html__( 'HTML - Full', 'subscribe2-for-cp' ) . '</label>&nbsp;&nbsp;';
-			echo '<label><input type="radio" name="s2_format" value="html_excerpt"' . checked( get_user_meta( $userid, s2cp()->get_usermeta_keyname( 's2_format' ), true ), 'html_excerpt', false ) . ' />';
+			echo '<label><input type="radio" name="s2_format" value="html_excerpt"' . checked( get_user_meta( $userid, s2cp()->get_usermeta_keyname( 's2_format' ), true ), 'html_excerpt', false ) . '>';
 			echo ' ' . esc_html__( 'HTML - Excerpt', 'subscribe2-for-cp' ) . '</label>&nbsp;&nbsp;';
-			echo '<label><input type="radio" name="s2_format" value="post"' . checked( get_user_meta( $userid, s2cp()->get_usermeta_keyname( 's2_format' ), true ), 'post', false ) . ' />';
+			echo '<label><input type="radio" name="s2_format" value="post"' . checked( get_user_meta( $userid, s2cp()->get_usermeta_keyname( 's2_format' ), true ), 'post', false ) . '>';
 			echo ' ' . esc_html__( 'Plain Text - Full', 'subscribe2-for-cp' ) . '</label>&nbsp;&nbsp;';
-			echo '<label><input type="radio" name="s2_format" value="excerpt"' . checked( get_user_meta( $userid, s2cp()->get_usermeta_keyname( 's2_format' ), true ), 'excerpt', false ) . ' />';
+			echo '<label><input type="radio" name="s2_format" value="excerpt"' . checked( get_user_meta( $userid, s2cp()->get_usermeta_keyname( 's2_format' ), true ), 'excerpt', false ) . '>';
 			echo ' ' . esc_html__( 'Plain Text - Excerpt', 'subscribe2-for-cp' ) . '</label><br><br>' . "\r\n";
 
 			if ( 'yes' === s2cp()->subscribe2_options['show_autosub'] ) {
 				echo esc_html__( 'Automatically subscribe me to newly created categories', 'subscribe2-for-cp' ) . ': &nbsp;&nbsp;';
-				echo '<label><input type="radio" name="new_category" value="yes"' . checked( get_user_meta( $userid, s2cp()->get_usermeta_keyname( 's2_autosub' ), true ), 'yes', false ) . ' />';
+				echo '<label><input type="radio" name="new_category" value="yes"' . checked( get_user_meta( $userid, s2cp()->get_usermeta_keyname( 's2_autosub' ), true ), 'yes', false ) . '>';
 				echo ' ' . esc_html__( 'Yes', 'subscribe2-for-cp' ) . '</label>&nbsp;&nbsp;';
-				echo '<label><input type="radio" name="new_category" value="no"' . checked( get_user_meta( $userid, s2cp()->get_usermeta_keyname( 's2_autosub' ), true ), 'no', false ) . ' />';
+				echo '<label><input type="radio" name="new_category" value="no"' . checked( get_user_meta( $userid, s2cp()->get_usermeta_keyname( 's2_autosub' ), true ), 'no', false ) . '>';
 				echo ' ' . esc_html__( 'No', 'subscribe2-for-cp' ) . '</label>';
 				echo '</p>';
 			}
@@ -64,8 +68,8 @@ public function s2_your_subscription_form( $userid ) {
 			if ( 'yes' === s2cp()->subscribe2_options['one_click_profile'] ) {
 				// One-click subscribe and unsubscribe buttons
 				echo '<h2>' . esc_html__( 'One Click Subscription / Unsubscription', 'subscribe2-for-cp' ) . "</h2>\r\n";
-				echo '<p class="submit"><input type="submit" class="button-primary" name="subscribe" value="' . esc_html__( 'Subscribe to All', 'subscribe2-for-cp' ) . '" />&nbsp;&nbsp;';
-				echo '<input type="submit" class="button-primary" name="unsubscribe" value="' . esc_html__( 'Unsubscribe from All', 'subscribe2-for-cp' ) . '" /></p>';
+				echo '<p class="submit"><input type="submit" class="button-primary" name="subscribe" value="' . esc_html__( 'Subscribe to All', 'subscribe2-for-cp' ) . '">&nbsp;&nbsp;';
+				echo '<input type="submit" class="button-primary" name="unsubscribe" value="' . esc_html__( 'Unsubscribe from All', 'subscribe2-for-cp' ) . '"></p>';
 			}
 
 			// subscribed categories
@@ -96,11 +100,11 @@ public function s2_your_subscription_form( $userid ) {
 			if ( get_user_meta( $userid, s2cp()->get_usermeta_keyname( 's2_subscribed' ), true ) ) {
 				echo ' checked="checked"';
 			}
-			echo ' /> ' . esc_html__( 'Yes', 'subscribe2-for-cp' ) . '</label> <label><input type="radio" name="category" value="-1" ';
+			echo '> ' . esc_html__( 'Yes', 'subscribe2-for-cp' ) . '</label> <label><input type="radio" name="category" value="-1" ';
 			if ( ! get_user_meta( $userid, s2cp()->get_usermeta_keyname( 's2_subscribed' ), true ) ) {
 				echo ' checked="checked"';
 			}
-			echo ' /> ' . esc_html__( 'No', 'subscribe2-for-cp' );
+			echo '> ' . esc_html__( 'No', 'subscribe2-for-cp' );
 			echo '</label></p>';
 		}
 
@@ -112,6 +116,7 @@ public function s2_your_subscription_form( $userid ) {
 		}
 
 		// list of subscribed blogs on Multisite installs
+		// phpcs:ignore WordPress.Security.NonceVerification
 		if ( s2cp()->s2_mu && ! isset( $_GET['email'] ) ) {
 			global $s2class_multisite;
 			$s2blog_id    = $blog_id;
@@ -208,6 +213,10 @@ public function s2_your_subscription_form( $userid ) {
 	public function s2_your_subscription_submit() {
 		$userid = $this->get_userid();
 
+		if ( false === wp_verify_nonce( $_REQUEST['_wpnonce'], 'subscribe2-user_subscribers' . S2VERSION ) ) {
+			die( '<p>' . esc_html__( 'Security error! Your request cannot be completed.', 'subscribe2' ) . '</p>' );
+		}
+
 		if ( isset( $_POST['submit'] ) ) {
 			if ( isset( $_POST['s2_format'] ) ) {
 				update_user_meta( $userid, s2cp()->get_usermeta_keyname( 's2_format' ), $_POST['s2_format'] );
@@ -303,7 +312,7 @@ public function display_category_form( $selected = array(), $override = 1, $comp
 			$colspan = 1;
 		}
 		echo '<tr><td style="text-align: left;" colspan="' . esc_attr( $colspan ) . '">' . "\r\n";
-		echo '<label><input type="checkbox" name="checkall" value="checkall_' . esc_attr( $name ) . '" /> ' . esc_html__( 'Select / Unselect All', 'subscribe2-for-cp' ) . '</label>' . "\r\n";
+		echo '<label><input type="checkbox" name="checkall" value="checkall_' . esc_attr( $name ) . '"> ' . esc_html__( 'Select / Unselect All', 'subscribe2-for-cp' ) . '</label>' . "\r\n";
 		echo '</td></tr>' . "\r\n";
 		foreach ( $all_cats as $cat ) {
 			$cat_name = '';
@@ -324,7 +333,7 @@ public function display_category_form( $selected = array(), $override = 1, $comp
 				if ( in_array( (string) $cat->term_id, $compulsory, true ) && 'category' === $name ) {
 					echo ' DISABLED';
 				}
-				echo ' /> <abbr title="' . esc_attr( $cat->slug ) . '">' . esc_html( $cat_name ) . '</abbr></label></td>' . "\r\n";
+				echo '> <abbr title="' . esc_attr( $cat->slug ) . '">' . esc_html( $cat_name ) . '</abbr></label></td>' . "\r\n";
 				$col++;
 			} else {
 				echo '<td style="width: 50%"><label><input class="checkall_' . esc_attr( $name ) . '" type="checkbox" name="' . esc_attr( $name ) . '[]" value="' . esc_attr( $cat->term_id ) . '"';
@@ -334,7 +343,7 @@ public function display_category_form( $selected = array(), $override = 1, $comp
 				if ( in_array( (string) $cat->term_id, $compulsory, true ) && 'category' === $name ) {
 					echo ' DISABLED';
 				}
-				echo ' /> <abbr title="' . esc_attr( $cat->slug ) . '">' . esc_html( $cat_name ) . '</abbr></label></td></tr>' . "\r\n";
+				echo '> <abbr title="' . esc_attr( $cat->slug ) . '">' . esc_html( $cat_name ) . '</abbr></label></td></tr>' . "\r\n";
 				$col = 1;
 			}
 		}
@@ -367,7 +376,7 @@ public function display_author_form( $selected = array() ) {
 			$colspan = 1;
 		}
 		echo '<tr><td style="text-align: left;" colspan="' . esc_attr( $colspan ) . '">' . "\r\n";
-		echo '<label><input type="checkbox" name="checkall" value="checkall_author" /> ' . esc_html__( 'Select / Unselect All', 'subscribe2-for-cp' ) . '</label>' . "\r\n";
+		echo '<label><input type="checkbox" name="checkall" value="checkall_author"> ' . esc_html__( 'Select / Unselect All', 'subscribe2-for-cp' ) . '</label>' . "\r\n";
 		echo '</td></tr>' . "\r\n";
 		echo '<tr style="vertical-align: top;"><td style="width: 50%; text-align: left;">' . "\r\n";
 		foreach ( $all_authors as $author ) {
@@ -380,13 +389,13 @@ public function display_author_form( $selected = array() ) {
 				if ( in_array( $author->ID, $selected, true ) ) {
 						echo ' checked="checked"';
 				}
-				echo ' /> ' . esc_html( $author->display_name ) . '</label>' . "\r\n";
+				echo '> ' . esc_html( $author->display_name ) . '</label>' . "\r\n";
 			} else {
 				echo '<label><input class="checkall_author" type="checkbox" name="author[]" value="' . esc_attr( $author->ID ) . '"';
 				if ( in_array( $author->ID, $selected, true ) ) {
 					echo ' checked="checked"';
 				}
-				echo ' /> ' . esc_html( $author->display_name ) . '</label>' . "\r\n";
+				echo '> ' . esc_html( $author->display_name ) . '</label>' . "\r\n";
 			}
 		}
 		echo '</td></tr>' . "\r\n";
diff --git a/classes/class-s2-frontend.php b/classes/class-s2-frontend.php
index 9d2aafa..49a1551 100644
--- a/classes/class-s2-frontend.php
+++ b/classes/class-s2-frontend.php
@@ -12,6 +12,8 @@ public function frontend_hooks() {
 		// load strings later on frontend for polylang plugin compatibility
 		add_action( 'wp', array( &$this, 'load_strings' ) );
 
+		// Frontend check and hook functions
+		// phpcs:ignore WordPress.Security.NonceVerification
 		if ( isset( $_REQUEST['s2'] ) ) {
 			// someone is confirming a request
 			add_filter( 'request', array( &$this, 'query_filter' ) );
@@ -23,6 +25,10 @@ public function frontend_hooks() {
 		add_shortcode( 'subscribe2', array( &$this, 'shortcode' ) );
 		add_filter( 'the_content', array( &$this, 'filter' ), 10 );
 
+		// amended kses allowed tags so form displays
+		add_filter( 'wp_kses_allowed_html', array( $this, 'extend_allowed_tags' ), 10, 2 );
+		add_filter( 'safe_style_css', array( $this, 'extend_allowed_styles' ) );
+
 		// add frontend actions for comment subscribers
 		if ( 'no' !== $this->subscribe2_options['comment_subs'] ) {
 			add_filter( 'comment_form_submit_field', array( &$this, 's2_comment_meta_form' ) );
@@ -128,12 +134,12 @@ public function shortcode( $atts ) {
 		// if a button is hidden, show only other
 		$hide = strtolower( $args['hide'] );
 		if ( 'subscribe' === $hide ) {
-			$this->input_form_action = '<input type="submit" name="unsubscribe" value="' . esc_attr( $unsubscribe_button_value ) . '" />';
+			$this->input_form_action = '<input type="submit" name="unsubscribe" value="' . esc_attr( $unsubscribe_button_value ) . '">';
 		} elseif ( 'unsubscribe' === $hide ) {
-			$this->input_form_action = '<input type="submit" name="subscribe" value="' . esc_attr( $subscribe_button_value ) . '" />';
+			$this->input_form_action = '<input type="submit" name="subscribe" value="' . esc_attr( $subscribe_button_value ) . '">';
 		} else {
 			// both form input actions
-			$this->input_form_action = '<input type="submit" name="subscribe" value="' . esc_attr( $subscribe_button_value ) . '" />&nbsp;<input type="submit" name="unsubscribe" value="' . esc_attr( $unsubscribe_button_value ) . '" />';
+			$this->input_form_action = '<input type="submit" name="subscribe" value="' . esc_attr( $subscribe_button_value ) . '">&nbsp;<input type="submit" name="unsubscribe" value="' . esc_attr( $unsubscribe_button_value ) . '">';
 		}
 
 		// if ID is provided, get permalink
@@ -154,17 +160,21 @@ public function shortcode( $atts ) {
 			$action = ' action="' . get_permalink( $this->subscribe2_options['s2page'] ) . '"';
 		}
 
-		// allow remote setting of email in form
+		$value = __( 'Enter email address...', 'subscribe2' );
+
+		if ( 'true' === strtolower( $args['nojs'] ) ) {
+			$value = '';
+		}
+
+		// allow remote setting of email in frontend form
+		// phpcs:disable WordPress.Security.NonceVerification
 		if ( isset( $_REQUEST['email'] ) ) {
 			$email = $this->sanitize_email( $_REQUEST['email'] );
+			if ( false !== $this->validate_email( $email ) ) {
+				$value = $email;
+			}
 		}
-		if ( isset( $_REQUEST['email'] ) && false !== $this->validate_email( $email ) ) {
-			$value = $email;
-		} elseif ( 'true' === strtolower( $args['nojs'] ) ) {
-			$value = '';
-		} else {
-			$value = __( 'Enter email address...', 'subscribe2-for-cp' );
-		}
+		// phpcs:enable WordPress.Security.NonceVerification
 
 		// if wrap is true add paragraph html tags
 		$wrap_text = '';
@@ -176,9 +186,9 @@ public function shortcode( $atts ) {
 		$antispam_text = '';
 		if ( 'true' !== strtolower( $args['noantispam'] ) ) {
 			$antispam_text  = '<span style="display:none !important">';
-			$antispam_text .= '<label for="firstname">Leave This Blank:</label><input type="text" id="firstname" name="firstname" />';
-			$antispam_text .= '<label for="lastname">Leave This Blank Too:</label><input type="text" id="lastname" name="lastname" />';
-			$antispam_text .= '<label for="uri">Do Not Change This:</label><input type="text" id="uri" name="uri" value="http://" />';
+			$antispam_text .= '<label for="firstname">Leave This Blank:</label><input type="text" id="firstname" name="firstname">';
+			$antispam_text .= '<label for="lastname">Leave This Blank Too:</label><input type="text" id="lastname" name="lastname">';
+			$antispam_text .= '<label for="uri">Do Not Change This:</label><input type="text" id="uri" name="uri" value="http://">';
 			$antispam_text .= '</span>';
 		}
 
@@ -192,13 +202,15 @@ public function shortcode( $atts ) {
 			$form_name = 's2form';
 		}
 
+		$s2_form_nonce = wp_nonce_field( 's2_form', '_wpnonce', true, false );
+
 		// build default form
 		if ( 'true' === strtolower( $args['nojs'] ) ) {
-			$this->form = '<form name="' . $form_name . '" method="post"' . $action . '><input type="hidden" name="ip" value="' . esc_attr( $remote_ip ) . '" />' . $antispam_text . '<p><label for="s2email">' . __( 'Your email:', 'subscribe2-for-cp' ) . '</label><br><input type="email" name="email" id="s2email" value="' . $value . '" size="' . $args['size'] . '" required />' . $wrap_text . $this->input_form_action . '</p></form>';
+			$this->form = '<form name="' . $form_name . '" method="post"' . $action . '>' . $s2_form_nonce . '<input type="hidden" name="ip" value="' . esc_attr( $remote_ip ) . '">' . $antispam_text . '<p><label for="s2email">' . __( 'Your email:', 'subscribe2' ) . '</label><br><input type="email" name="email" id="s2email" value="' . $value . '" size="' . $args['size'] . '" required>' . $wrap_text . $this->input_form_action . '</p></form>';
 		} else {
-			$this->form = '<form name="' . $form_name . '" method="post"' . $action . '><input type="hidden" name="ip" value="' . esc_attr( $remote_ip ) . '" />' . $antispam_text . '<p><label for="s2email">' . __( 'Your email:', 'subscribe2-for-cp' ) . '</label><br><input type="email" name="email" id="s2email" value="' . $value . '" size="' . $args['size'] . '" onfocus="if (this.value === \'' . $value . '\') {this.value = \'\';}" onblur="if (this.value === \'\') {this.value = \'' . $value . '\';}" required />' . $wrap_text . $this->input_form_action . '</p></form>' . "\r\n";
+			$this->form = '<form name="' . $form_name . '" method="post"' . $action . '>' . $s2_form_nonce . '<input type="hidden" name="ip" value="' . esc_attr( $remote_ip ) . '">' . $antispam_text . '<p><label for="s2email">' . __( 'Your email:', 'subscribe2' ) . '</label><br><input type="email" name="email" id="s2email" value="' . $value . '" size="' . $args['size'] . '" onfocus="if (this.value === \'' . $value . '\') {this.value = \'\';}" onblur="if (this.value === \'\') {this.value = \'' . $value . '\';}" required>' . $wrap_text . $this->input_form_action . '</p></form>' . "\r\n";
 		}
-		$this->s2form = apply_filters( 's2_form', $this->form, $args );
+		$this->s2form = (string) apply_filters( 's2_form', $this->form, $args );
 
 		global $user_ID;
 		if ( 0 !== $user_ID ) {
@@ -206,6 +218,10 @@ public function shortcode( $atts ) {
 		}
 
 		if ( isset( $_POST['subscribe'] ) || isset( $_POST['unsubscribe'] ) ) {
+			if ( false === wp_verify_nonce( $_POST['_wpnonce'], 's2_form' ) ) {
+				return '<p class="s2_error">' . esc_html__( 'Security error! Your request cannot be completed.', 'subscribe2' ) . '</p>';
+			}
+
 			// anti spam sign up measure
 			if ( ( isset( $_POST['firstname'] ) && '' !== $_POST['firstname'] ) || ( isset( $_POST['lastname'] ) && '' !== $_POST['lastname'] ) || ( isset( $_POST['uri'] ) && 'http://' !== $_POST['uri'] ) ) {
 				// looks like some invisible-to-user fields were changed; falsely report success
@@ -276,6 +292,7 @@ public function shortcode( $atts ) {
 				}
 			}
 		}
+
 		return $this->s2form;
 	}
 
@@ -332,6 +349,7 @@ public function query_filter() {
 	 */
 	public function title_filter( $title ) {
 		if ( in_the_loop() ) {
+			// phpcs:ignore WordPress.Security.NonceVerification
 			$code   = $_GET['s2'];
 			$action = intval( substr( $code, 0, 1 ) );
 			if ( 1 === $action ) {
@@ -354,6 +372,7 @@ public function confirm( $content = '' ) {
 			return $content;
 		}
 
+		// phpcs:disable WordPress.Security.NonceVerification
 		$code   = $_GET['s2'];
 		$action = substr( $code, 0, 1 );
 		$hash   = substr( $code, 1, 32 );
@@ -393,6 +412,7 @@ public function confirm( $content = '' ) {
 		if ( '' !== $this->message ) {
 			return $this->message;
 		}
+		// phpcs:enable WordPress.Security.NonceVerification
 	}
 
 	/**
@@ -577,6 +597,46 @@ public function tag_replace_ampersand( $tag ) {
 		return $tag;
 	}
 
+		/**
+	 * Extend core html tags allow in wp_kses_post()
+	 */
+	public function extend_allowed_tags( $allowedtags, $context ) {
+		if ( 'post' === $context ) {
+			$form_tags = array(
+				'form'  => array(
+					'action' => true,
+					'method' => true,
+					'name'   => true,
+				),
+				'input' => array(
+					'id'       => true,
+					'name'     => true,
+					'onblur'   => true,
+					'onfocus'  => true,
+					'required' => true,
+					'size'     => true,
+					'type'     => true,
+					'value'    => true,
+				),
+				'label' => array(
+					'for' => true,
+				),
+			);
+
+			$allowedtags = array_merge( $allowedtags, $form_tags );
+		}
+
+		return $allowedtags;
+	}
+
+	/**
+	 * Extend allowed CSS in wp_kses_post()
+	 */
+	public function extend_allowed_styles( $styles ) {
+		$styles[] = 'display';
+		return $styles;
+	}
+
 	/* ===== define some variables ===== */
 	public $profile = '';
 }
diff --git a/classes/class-s2-list-table.php b/classes/class-s2-list-table.php
index 44d8969..f99d118 100644
--- a/classes/class-s2-list-table.php
+++ b/classes/class-s2-list-table.php
@@ -29,8 +29,9 @@ public function column_default( $item, $column_name ) {
 	public function column_email( $item ) {
 		global $current_tab;
 		if ( 'registered' === $current_tab ) {
+			$url     = wp_nonce_url( sprintf( '?page=s2&amp;id=%d', rawurlencode( $item['id'] ) ), '_s2_edit_registered' );
 			$actions = array(
-				'edit' => sprintf( '<a href="?page=%s&amp;id=%d">%s</a>', 's2', rawurlencode( $item['id'] ), __( 'Edit', 'subscribe2-for-cp' ) ),
+				'edit' => sprintf( '<a href="%s">%s</a>', $url, __( 'Edit', 'subscribe2' ) ),
 			);
 			return sprintf( '%1$s %2$s', $item['email'], $this->row_actions( $actions ) );
 		} else {
@@ -54,13 +55,13 @@ public function column_date( $item ) {
 	}
 
 	public function column_cb( $item ) {
-		$column = '<label><span class="screen-reader-text">' . __( 'Checkbox for:', 'subscribe2-for-cp' ) . ' %1$s</span><input type="checkbox" name="%2$s[]" value="%3$s" /></label>';
+		$column = '<label><span class="screen-reader-text">' . __( 'Checkbox for:', 'subscribe2-for-cp' ) . ' %1$s</span><input type="checkbox" name="%2$s[]" value="%3$s"></label>';
 		return sprintf( $column, $item['email'], $this->_args['singular'], $item['email'] );
 	}
 
 	public function get_columns() {
 		$columns = array(
-			'cb'    => '<input type="checkbox" />',
+			'cb'    => '<input type="checkbox">',
 			'email' => _x( 'Email', 'column name', 'subscribe2-for-cp' ),
 			'date'  => _x( 'Date', 'column name', 'subscribe2-for-cp' ),
 		);
@@ -78,9 +79,14 @@ public function get_sortable_columns() {
 	public function print_column_headers( $with_id = true ) {
 		list( $columns, $hidden, $sortable, $primary ) = $this->get_column_info();
 
+		// phpcs:ignore WordPress.Security.NonceVerification
 		$current_url = set_url_scheme( 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );
 		$current_url = remove_query_arg( 'paged', $current_url );
 
+		if ( isset( $_GET['_wpnonce'] ) && false === wp_verify_nonce( $_GET['_wpnonce'], 's2_subscriber_tab' ) ) {
+			die( '<p>' . esc_html__( 'Security error! Your request cannot be completed.', 'subscribe2' ) . '</p>' );
+		}
+
 		if ( isset( $_REQUEST['what'] ) ) {
 			$current_url = add_query_arg(
 				array(
@@ -105,7 +111,7 @@ public function print_column_headers( $with_id = true ) {
 		if ( ! empty( $columns['cb'] ) ) {
 			static $cb_counter = 1;
 			$columns['cb']     = '<label class="screen-reader-text" for="cb-select-all-' . $cb_counter . '">' . __( 'Select All', 'subscribe2-for-cp' ) . '</label>'
-				. '<input id="cb-select-all-' . $cb_counter . '" type="checkbox" />';
+				. '<input id="cb-select-all-' . $cb_counter . '" type="checkbox">';
 			$cb_counter++;
 		}
 
@@ -148,7 +154,7 @@ public function print_column_headers( $with_id = true ) {
 				$class = "class='" . join( ' ', $class ) . "'";
 			}
 
-			echo "<$tag $scope $id $class>$column_display_name</$tag>"; // phpcs:ignore WordPress.Security.EscapeOutput
+			echo wp_kses_post( "<$tag $scope $id $class>$column_display_name</$tag>" );
 		}
 	}
 
@@ -173,6 +179,11 @@ public function get_bulk_actions() {
 
 	public function process_bulk_action() {
 		global $current_user, $subscribers;
+
+		if ( isset( $_GET['_wpnonce'] ) && false === wp_verify_nonce( $_GET['_wpnonce'], 's2_subscriber_tab' ) ) {
+			die( '<p>' . esc_html__( 'Security error! Your request cannot be completed.', 'subscribe2' ) . '</p>' );
+		}
+
 		if ( in_array( $this->current_action(), array( 'delete', 'toggle' ), true ) ) {
 			if ( ! isset( $_REQUEST['subscriber'] ) ) {
 				echo '<div id="message" class="error"><p><strong>' . esc_html__( 'No users were selected.', 'subscribe2-for-cp' ) . '</strong></p></div>';
@@ -241,14 +252,16 @@ public function pagination( $which ) {
 		// Translators: Pagination
 		$output = '<span class="displaying-num">' . sprintf( _n( '%s item', '%s items', $total_items, 'subscribe2-for-cp' ), number_format_i18n( $total_items ) ) . '</span>';
 
-		if ( isset( $_POST['what'] ) ) {
-			if ( isset( $_POST['paged'] ) ) {
-				$current = intval( $_POST['paged'] );
-			} else {
-				$current = 1;
+		$current = intval( $this->get_pagenum() );
+
+		if ( isset( $_POST['_wpnonce'] ) && false !== wp_verify_nonce( $_POST['_wpnonce'], 'bulk-' . $this->_args['plural'] ) ) {
+			if ( isset( $_POST['what'] ) ) {
+				if ( isset( $_POST['paged'] ) ) {
+					$current = intval( $_POST['paged'] );
+				} else {
+					$current = 1;
+				}
 			}
-		} else {
-			$current = intval( $this->get_pagenum() );
 		}
 
 		$current_url = set_url_scheme( 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );
@@ -325,7 +338,7 @@ public function pagination( $which ) {
 			$total_pages_before = '<span class="screen-reader-text">' . __( 'Current Page', 'subscribe2-for-cp' ) . '</span><span id="table-paging" class="paging-input">';
 		} else {
 			$html_current_page = sprintf(
-				"%s<input class='current-page' id='current-page-selector' type='text' name='paged' value='%s' size='%d' aria-describedby='table-paging' />",
+				"%s<input class='current-page' id='current-page-selector' type='text' name='paged' value='%s' size='%d' aria-describedby='table-paging'>",
 				'<label for="current-page-selector" class="screen-reader-text">' . __( 'Current Page', 'subscribe2-for-cp' ) . '</label>',
 				$current,
 				strlen( $total_pages )
@@ -415,22 +428,33 @@ public function prepare_items() {
 		}
 
 		function usort_reorder( $a, $b ) {
-			$orderby = ( ! empty( $_REQUEST['orderby'] ) ) ? $_REQUEST['orderby'] : 'email';
-			$order   = ( ! empty( $_REQUEST['order'] ) ) ? $_REQUEST['order'] : 'asc';
-			$result  = strcasecmp( $a[ $orderby ], $b[ $orderby ] );
+			$orderby = 'email';
+			$order   = 'asc';
+
+			if ( isset( $_GET['_s2_order_nonce'] ) && false !== wp_verify_nonce( $_GET['_s2_order_nonce'], 's2_subscriber_order' ) ) {
+				$orderby = ( ! empty( $_REQUEST['orderby'] ) ) ? $_REQUEST['orderby'] : $orderby;
+				$order   = ( ! empty( $_REQUEST['order'] ) ) ? $_REQUEST['order'] : $order;
+			}
+
+			$result = strcasecmp( $a[ $orderby ], $b[ $orderby ] );
+
 			return ( 'asc' === $order ) ? $result : -$result;
 		}
+
 		usort( $data, 'usort_reorder' );
 
-		if ( isset( $_POST['what'] ) ) {
-			if ( isset( $_POST['paged'] ) ) {
-				$current_page = intval( $_POST['paged'] );
-			} else {
-				$current_page = 1;
+		$current_page = (int) $this->get_pagenum();
+
+		if ( isset( $_POST['_wpnonce'] ) && false !== wp_verify_nonce( $_POST['_wpnonce'], 'bulk-' . $this->_args['plural'] ) ) {
+			if ( isset( $_POST['what'] ) ) {
+				if ( isset( $_POST['paged'] ) ) {
+					$current_page = intval( $_POST['paged'] );
+				} else {
+					$current_page = 1;
+				}
 			}
-		} else {
-			$current_page = $this->get_pagenum();
 		}
+
 		$total_items = count( $data );
 		$data        = array_slice( $data, ( $current_page - 1 ) * $per_page, $per_page );
 		$this->items = $data;
diff --git a/classes/class-s2-multisite.php b/classes/class-s2-multisite.php
index fbd0517..4a85bc7 100644
--- a/classes/class-s2-multisite.php
+++ b/classes/class-s2-multisite.php
@@ -6,7 +6,7 @@ class S2_Multisite {
 	 */
 	public function wpmu_subscribe() {
 		// subscribe to new blog
-		if ( ! empty( $_GET['s2mu_subscribe'] ) ) {
+		if ( ! empty( $_GET['s2mu_subscribe'] ) && false !== wp_verify_nonce( $_GET['_s2mu_subscribe'], 's2mu_subscribe' ) ) {
 			$sub_id = intval( $_GET['s2mu_subscribe'] );
 			if ( $sub_id >= 0 ) {
 				switch_to_blog( $sub_id );
@@ -39,7 +39,7 @@ public function wpmu_subscribe() {
 					update_user_meta( $user_ID, s2cp()->get_usermeta_keyname( 's2_subscribed' ), $cats_string );
 				}
 			}
-		} elseif ( ! empty( $_GET['s2mu_unsubscribe'] ) ) {
+		} elseif ( ! empty( $_GET['s2mu_unsubscribe'] ) && false !== wp_verify_nonce( $_GET['_s2mu_unsubscribe'], 's2mu_unsubscribe' ) ) {
 			// unsubscribe from a blog
 			$unsub_id = intval( $_GET['s2mu_unsubscribe'] );
 			if ( $unsub_id >= 0 ) {
diff --git a/include/s2-colorpicker.js b/include/s2-colorpicker.js
index 145899e..9ef9523 100755
--- a/include/s2-colorpicker.js
+++ b/include/s2-colorpicker.js
@@ -7,12 +7,12 @@
 ( function( jQuery ){
 	function initColorPicker( widget ) {
 		widget.find( '.colorpickerField' ).not( '[id*="__i__"]' ).wpColorPicker( {
-			change: function( e, ui ) {
-				jQuery( e.target ).val( ui.color.toString() );
-				jQuery( e.target ).trigger( 'change' );
+			change: function( event, ui ) {
+				jQuery( event.target ).val( ui.color.toString() );
+				jQuery( event.target ).trigger( 'change' );
 			},
-			clear: function( e ) {
-				jQuery( e.target ).trigger( 'change' );
+			clear: function( event ) {
+				jQuery( event.target ).trigger( 'change' );
 			}
 		} );
 	}
diff --git a/include/s2-dismiss.js b/include/s2-dismiss.js
index 8f12fcf..9581d58 100755
--- a/include/s2-dismiss.js
+++ b/include/s2-dismiss.js
@@ -10,7 +10,6 @@ jQuery( document ).on(
 		var data    = {
 			'action': 's2_dismiss_notice',
 			'nonce': s2DismissScriptStrings.nonce
-
 		};
 		jQuery.post( ajaxurl, data );
 	}
diff --git a/include/s2-user-admin.css b/include/s2-user-admin.css
index 83842c6..d6b33dc 100755
--- a/include/s2-user-admin.css
+++ b/include/s2-user-admin.css
@@ -1,92 +1,83 @@
-ul.s2_blogs
-{
-    float: left;
+ul.s2_blogs {
+	float: left;
 
-    width: 99%;
+	width: 99%;
 }
 
-ul.s2_blogs li
-{
-    position: relative;
+ul.s2_blogs li {
+	position: relative;
 
-    display: block;
-    float: left;
+	display: block;
+	float: left;
 
-    width: 47%;
-    margin: 3px;
-    padding: .5em;
+	width: 47%;
+	margin: 3px;
+	padding: .5em;
 
-    white-space: nowrap;
+	white-space: nowrap;
 
-    border: 1px solid #e0e0e0;
-    background-color: #e3e3e3;
+	border: 1px solid #e0e0e0;
+	background-color: #e3e3e3;
 }
 
-ul.s2_blogs li:hover
-{
-    border-color: #666;
+ul.s2_blogs li:hover {
+	border-color: #666;
 }
 
-ul.s2_blogs li .name
-{
-    display: block;
-    float: left;
+ul.s2_blogs li .name {
+	display: block;
+	float: left;
 }
 
-ul.s2_blogs li .buttons
-{
-    font-size: .8em;
+ul.s2_blogs li .buttons {
+	font-size: .8em;
 
-    display: block;
-    float: right;
+	display: block;
+	float: right;
 
-    margin-left: -6px;
+	margin-left: -6px;
 
-    white-space: nowrap;
+	white-space: nowrap;
 }
 
-ul.s2_blogs li .buttons a
-{
-    display: block;
-    float: left;
+ul.s2_blogs li .buttons a {
+	display: block;
+	float: left;
 
-    margin: 0 0 0 1em;
-    padding: .1em .5em;
+	margin: 0 0 0 1em;
+	padding: .1em .5em;
 
-    color: white;
-    background-color: #666;
+	color: white;
+	background-color: #666;
 }
 
-ul.s2_blogs li .buttons a:hover
-{
-    color: #666;
-    background-color: whitesmoke;
+ul.s2_blogs li .buttons a:hover {
+	color: #666;
+	background-color: whitesmoke;
 }
 
-ul.s2_blogs div.additional_info
-{
-    font-style: italic;
+ul.s2_blogs div.additional_info {
+	font-style: italic;
 
-    position: absolute;
-    z-index: 9;
-    bottom: 2.4em;
-    left: -2px;
+	position: absolute;
+	z-index: 9;
+	bottom: 2.4em;
+	left: -2px;
 
-    display: none;
+	display: none;
 
-    width: 75%;
-    margin-bottom: 2px;
-    padding: .5em 1em;
+	width: 75%;
+	margin-bottom: 2px;
+	padding: .5em 1em;
 
-    color: #fff;
-    border: 1px solid white;
-    border-bottom: medium none;
-    -moz-border-radius-topleft: .5em;
-    -moz-border-radius-topright: .5em;
-    background-color: #666;
+	color: #fff;
+	border: 1px solid white;
+	border-bottom: medium none;
+	-moz-border-radius-topleft: .5em;
+	-moz-border-radius-topright: .5em;
+	background-color: #666;
 }
 
-ul.s2_blogs li:hover div.additional_info
-{
-    display: block;
+ul.s2_blogs li:hover div.additional_info {
+	display: block;
 }
diff --git a/subscribe2.php b/subscribe2.php
index 3f29edf..878bfdd 100644
--- a/subscribe2.php
+++ b/subscribe2.php
@@ -6,6 +6,7 @@
 Version: 11.7
 Author: Matthew Robinson
 Author URI: https://subscribe2.wordpress.com/
+Premium URI: https://checkout.freemius.com/mode/dialog/plugin/5502/plan/8921/
 Licence: GPLv3
 Requires at least: 4.4
 Requires CP: 1.0
diff --git a/tinymce/css/content.css b/tinymce/css/content.css
index 24fbe51..174eb8e 100644
--- a/tinymce/css/content.css
+++ b/tinymce/css/content.css
@@ -1,12 +1,11 @@
-.mceSubscribe2
-{
-    display: block;
+.mceSubscribe2 {
+	display: block;
 
-    width: 100%;
-    height: 12px;
-    margin-top: 15px;
+	width: 100%;
+	height: 12px;
+	margin-top: 15px;
 
-    border: 0;
-    border-top: 1px;
-    background: url(../../include/s2-marker.png) center top no-repeat #fff;
+	border: 0;
+	border-top: 1px;
+	background: url(../../include/s2-marker.png) center top no-repeat #fff;
 }
diff --git a/tinymce/editor-plugin4.js b/tinymce/editor-plugin4.js
index b879534..f7e593a 100755
--- a/tinymce/editor-plugin4.js
+++ b/tinymce/editor-plugin4.js
@@ -5,7 +5,7 @@
 		'tinymce.plugins.Subscribe2Plugin',
 		{
 			init: function( ed, url ) {
-				var i      = 0,
+				var i          = 0,
 					pb         = '<p><img src="' + url + '/../include/spacer.gif" class="mceSubscribe2 mceItemNoResize" /></p>',
 					cls        = 'mceSubscribe2',
 					shortcode  = '[subscribe2]',
@@ -105,4 +105,4 @@
 
 	// Register plugin
 	tinymce.PluginManager.add( 'subscribe2', tinymce.plugins.Subscribe2Plugin );
-}() );
+} )();