WP Content Translate WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

2.1.1

Findings

2

Worst severity

medium

Content hash

cbfe4f64d64df950f8eea02f… Copy

Findings

• medium Stored XSS via unsanitized translation_state in admin columns

  xss_stored

  TranslationMetaBox::saveMetaBoxSettings stores $_POST['translation_state'] with no sanitize/whitelist and no nonce. Columns::pll_before_post_column then echoes the meta into an HTML class attribute without escaping. Any user who can edit a translated post can inject attribute-breaking payloads that run when an administrator views the Posts list.

  src/TranslationMetaBox.php:35-45

  Recommendation

  Whitelist allowed states (ready|progress|translated), sanitize_key on save, add a nonce + current_user_can('edit_post'), and esc_attr() on output.

• medium Unescaped translation_state in admin list class attribute

  missing_escaping

  Companion sink for the unsanitized write: get_post_meta(translation_state) is interpolated into class="wptranslate-state-%s" without esc_attr.

  src/Columns.php:27-33

  Recommendation

  Use esc_attr() when emitting meta into HTML attributes.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.