High-severity findings.

Audited release

4.5.0

Findings

1

Worst severity

high

Content hash

584e7897e710943f53656141… Copy

Findings

• high Author/Contributor stored XSS via unescaped [wpd] and [wpc] shortcode attributes

  xss_stored

  add_shortcode('wpd') and add_shortcode('wpc') pass attacker-controlled shortcode atts straight into HTML. list_shortcode() explode()s types and forwards $style to render_template(); list_collection() forwards type/start/end/status/style to render_collection(). Neither sanitizes. render_collection() concatenates all five values into data-status/data-type/data-start/data-end/data-style double-quoted attributes. render_template() concatenates $style into the db--list class name and, when types has a single value, interpolates $include_types[0] into data-type='...'. WordPress kses does not inspect shortcode attribute text, so users without unfiltered_html (Author on single-site; Author/Editor/Contributor on multisite) can persist payloads that become real markup on the_content. Concrete path: an Author publishes [wpd style='"><img src=x onerror=alert(document.domain)>'] producing <div class="db--list db--list__"><img src=x onerror=alert(document.domain)>">, or [wpc type='"><script>alert(document.domain)</script>'] producing a data-type=" breakout that inserts a live <script>. Both execute in the site origin for every visitor of that post (and for an administrator who previews a Contributor draft). Nav labels for allowlisted types are esc_attr/esc_html, but the $only/$style paths and the entire [wpc] renderer were not included in the 4.5.0 admin hotfix.

  src/functions.php:50-79,146-191

  Recommendation

  Escape every shortcode attribute at output: esc_attr() on type/status/style/start/end and on $include_types[0]. Allowlist types to movie|music|book|game|drama and style to a known class suffix (e.g. card) before concatenation. Do not use extract(). Optionally reject unknown atts. assets/js/db.js should also stop assigning REST name/link/poster/remark to innerHTML (use textContent or a sanitized template) so poisoned catalog rows cannot DOM-XSS the same pages.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.