Alley Logger WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

2.6.4

Findings

1

Worst severity

medium

Content hash

28fa087bf018f7a6029d2617… Copy

Findings

• medium Unauthenticated stored XSS via JS logger args and unescaped admin JSON

  xss_stored

  JavaScript logging is off by default (apply_filters('ai_logger_enable_js_logging', false)). When a site enables it, AI_Logger_JS registers wp_ajax_ and wp_ajax_nopriv_ ai_logger_insert and localizes a nonce on every front-end, admin, and login request. log() runs sanitize_text_field over POST args into $clean_args, then ignores that array: $level comes from the raw decoded JSON and $logger->$level($message, $args) persists the unsanitized structure (WordPress sanitize_text_field returns '' for arrays, so nested objects survive). method_exists() is used instead of a PSR-level allowlist, so level=error/alert is accepted and production Post_Handler will insert (info/debug are filtered out unless WP_DEBUG). Data_Structures renders _logger_record in wp-admin; ai_logger_render_table() esc_html's scalars but echo's wp_json_encode() for arrays/objects with no HTML encoding, which is a script-executing sink in a <pre>. An unauthenticated visitor POSTs a unique error-level message with nested context such as {"level":"error","evil":{"x":"</pre><script>alert(1)</script>"}}; an administrator with create_users who opens Logs → that entry executes the script in wp-admin. The same unescaped json_encode is used in template-parts/object-log-display.php for post/term log meta boxes.

  inc/class-ai-logger-js.php:22-90

  Recommendation

  Log recursively sanitized $clean_args (or wp_kses/sanitize_text_field walking nested arrays), not the raw JSON. Whitelist PSR-3 levels instead of method_exists() + dynamic $logger->$level(). Escape JSON in log-display.php and object-log-display.php with esc_html() or wp_json_encode(..., JSON_HEX_TAG|JSON_HEX_AMP|JSON_HEX_APOS|JSON_HEX_QUOT). Keep JS logging off by default; if it stays public, rate-limit inserts and do not allow ALERT+ from unauthenticated callers.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.