User Locations WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.5.1

Findings

1

Worst severity

high

Content hash

021870831454a9380b00e412… Copy

Findings

• high Stored XSS via unsanitized Google Analytics tracking ID

  xss_stored

  ul_get_ga_code interpolates ACF field ga_tracking_id into an inline script without escaping. Location users who can edit parent location pages can supply a value that breaks out of the JS string and runs arbitrary script for all visitors.

  includes/functions-display.php:586-599

  Recommendation

  Strictly validate tracking IDs (e.g. /^G-[A-Z0-9]+$/ or /^UA-\d+-\d+$/) and escape for JS context; prefer wp_enqueue_script with localized data.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.