High-severity findings.

Audited release

1.1.4-sebask

Findings

2

Worst severity

high

Content hash

011f55cc6341dab503a2d838… Copy

Findings

• high Contributor+ stored XSS in multi-select results via unsanitized _results meta

  xss_stored

  cmb2_sanitize_post_search_ajax copies $fid.'_results' from CMB2 data_to_save (raw POST) into the field value with no absint/is_numeric/kses. For limit>1, render() concatenates each $val into an admin HTML attribute: value="'.$val.'" plus unescaped $title/$guid. A Contributor who can save a post that includes this field (the bundled example registers it on post with limit 10) can POST fieldid_results[]=1"><script>alert(document.cookie)</script> (or an img onerror). That string is stored in post meta and echoed as real document HTML — not innerHTML — when an Editor/Administrator opens the metabox, so <script> executes in wp-admin (session/nonce theft, actions as the victim). WordPress does not kses post meta; CMB2's Types::input() escaping is bypassed on this manual <li> path. Limit==1 uses CMB2 input() (typically esc_attr) so the same dirty meta is display-escaped in admin but still stored.

  cmb-field-post-search-ajax.php:46-64,105-114

  Recommendation

  In sanitize(), map the saved value through absint (or array_map('absint')) and drop non-positive IDs. In render(), output $val with esc_attr, $guid with esc_url, $title with esc_html, and $field_name with esc_attr. Do the same in js/mag-post-search-ajax.js onSelect (it currently string-concatenates suggestion.value/guid into jQuery.append HTML).

• medium Authenticated AJAX search runs attacker-controlled WP_Query/WP_User_Query with no capability check

  missing_capability

  wp_ajax_cmb_post_search_ajax_get_results is registered for every logged-in user. The only gate is wp_verify_nonce on POST psacheck; there is no current_user_can('edit_posts'), list_users, or read_private_posts. query_args is json_decode(stripslashes(htmlspecialchars_decode($_POST['query_args']))) and passed as the full args array to WP_Query or WP_User_Query; object=user is also client-controlled. mag-post-search-ajax.js sends the data-queryargs attribute, so any caller with a nonce can replace the field's intended query. Core WP_Query only applies author/read_private restrictions when perm=readable/editable is set; an explicit post_status of draft, private, any, or a WooCommerce wc-* status is interpolated without those checks. Observable JSON: each hit's get_the_title()/display_name, ID, and get_edit_post_link()/get_edit_user_link(). A Contributor (or any role that can load a screen that localizes psa.nonce) can enumerate other users' drafts/private posts, shop_order-style CPTs, and the user directory (search_columns=user_email confirms addresses). Not unauthenticated (no nopriv). posts_per_page=-1 is an additional cheap DoS.

  cmb-field-post-search-ajax.php:36,162-201

  Recommendation

  Require current_user_can('edit_posts') (or the capability of the CMB2 object) after the nonce check. Do not trust client query_args: keep allowed WP_Query/WP_User_Query args in a server-side field config (or a signed token) and only apply a sanitized search string. Force perm=readable, cap post_status/post_type to the field's allow-list, reject object=user unless the current user has list_users, and cap posts_per_page.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.