Custom Untappd Feeds WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

2019.01-alpha

Findings

1

Worst severity

high

Content hash

8d0e0b6700d0a3d3b19bb608… Copy

Findings

• high Stored XSS via unescaped Untappd API fields in shortcode HTML

  xss_stored

  Custom_Untappd_Feeds_Shortcodes builds frontend markup by concatenating Untappd API JSON into HTML with no escaping. user_info/user_activity/user_badges/user_overview call get_body('/user/info|checkins|badges/' . $this->atts['user']) and then interpolate user_avatar, first_name, last_name, location, checkin_comment, beer_name, beer_label, brewery.contact.url, brewery_name, and badge image/title directly into <img src>, <a href>, and text nodes. Shortcodes are expanded on the_content after kses, so a user without unfiltered_html can still plant [custom-untappd-feeds view='user-info' user='ATTACKER'] (or user-activity / user-overview). An Author can publish that post; a Contributor can put it in a pending post that an administrator previews. The attacker controls the Untappd account named in user (profile name, location, check-in comments, and URLs the API returns). Because the shortcode return value is printed as page HTML, a <script> payload or attribute breakout (src/href quote escape, javascript: brewery URL, onerror on img) executes in every visitor session and in the previewing admin session. The user attribute is also concatenated unsanitized into the API path (query/path injection against api.untappd.com using the site's Client ID/Secret) but the observable XSS sink is the unescaped response body, not the attribute itself.

  includes/class-custom-untappd-feeds-shortcodes.php:164-168, 379-390

  Recommendation

  Treat every Untappd field as untrusted. Escape text with esc_html(), URLs with esc_url(), and attribute context with esc_attr() in shortcode_header, shortcode_footer, user_activity, user_badges, user_info, and user_overview. Sanitize the user shortcode attribute (sanitize_title / preg_replace to [A-Za-z0-9_-]) before concatenating it into the API path, and pass limit/activity-limit/badge-limit through absint with a cap. Reject view values outside the known switch cases (already done) and do not add a raw user echo.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.