Bible for Wordpress WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

3.1

Findings

2

Worst severity

high

Content hash

82bd65727e0a1ea1030c4530… Copy

Findings

• high Stored XSS via unquoted [bible] href; tabs/newlines survive space stripping

  xss_stored

  bible_generate_links (the_content, priority 10) splits on literal [bible] / [/bible], maps the inner text to an OSIS-style reference, and prints an anchor with an unquoted href: '<a target="_blank" href=' . $scripture_link . '>'. $scripture_link is 'https://www.bible.com/bible/' . $translation_id . '/' . str_replace(' ', '', $reference_link). Only U+0020 is removed; tab, LF, CR, and FF remain and are HTML5 attribute separators, so a payload such as [bible]John 3:16\tonmouseover=alert(document.domain)[/bible] becomes href=https://www.bible.com/bible/{id}/JHN.3.16 then a real onmouseover handler on that <a>. wp_kses on save does not treat that string as a tag, so Contributor/Author (no unfiltered_html) can store it. Author can publish; Contributor plants it in a pending post and XSS fires when an editor/admin uses frontend preview (the_content) or after publish. $translation_id also comes from unsanitized option BIBLE_TRANSLATION_OPTion (CSRF finding) and is interpolated the same way — a value with spaces breaks out of href on every bible tag. Link text ($row_exploded[0]) and, when bible_display_option==scripture, verses[0][content] from events.bible.com are likewise unescaped. Simulated output for the tab payload contains 0x09 immediately before onmouseover=; for a poisoned option, href=https://www.bible.com/bible/1 onmouseover=alert(1) x=/JHN.3.16.

  bible_for_wordpress.php:60-96,290

  Recommendation

  Quote and escape the URL with esc_url() (or build via add_query_arg and printf with %s). Escape link text with esc_html(). Allowlist translation IDs as digits (or the API abbreviation list) and strip all Unicode/HTML whitespace from the reference, not only ASCII spaces. Prefer add_shortcode('bible', …) over raw the_content explosion. Run API verse HTML through wp_kses_post() before echoing. Sanitize BIBLE_TRANSLATION_OPTion with absint/sanitize_text_field on save.

• high CSRF on Bible settings writes unsanitized translation ID used in frontend href

  csrf

  bible_config() is the manage_options submenu callback. At the top of the function, isset($_POST[BIBLE_TRANSLATION_OPTion]) / isset($_POST[bible_display_option]) immediately update_option/add_option the raw POST values with no check_admin_referer, wp_verify_nonce, or sanitize_*. The settings <form action="" method="post"> has no nonce field. WordPress will run this callback for any administrator who can load options-general.php?page=bible-for-wordpress, so a cross-site POST (or same-site CSRF) sets BIBLE_TRANSLATION_OPTion to an arbitrary string such as '1 onmouseover=alert(1) x='. That option is later concatenated into the unquoted front-end href in bible_generate_links (finding 1), turning every existing [bible] tag into stored XSS for all visitors. bible_display_option is only compared to 'scripture' (limited blast by itself) but is written on the same request. Capability is the menu cap only; there is no current_user_can inside the POST branch.

  bible_for_wordpress.php:133-144,162-207,282-286

  Recommendation

  Switch to the Settings API (register_setting + options.php) or call check_admin_referer() and current_user_can('manage_options') before any update_option. Add wp_nonce_field to the form. Save translation as absint (bible.com version id) and display type as an allowlist of link|scripture. Do not persist raw $_POST into options that the_content later concatenates into HTML.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.