High-severity findings.

Audited release

1.2.1

Findings

2

Worst severity

high

Content hash

c36ea481e0250b9e49e0d81e… Copy

Findings

• high Reflected XSS via search query parameter

  xss_reflected

  $_GET['search'] is concatenated into an HTML attribute and $_REQUEST['search'] is interpolated into visible HTML via sprintf without escaping. An unauthenticated attacker can craft a URL that executes script in victims who open the BizPress blogs page.

  blogs.php:111-111

  Recommendation

  Escape with esc_attr() for attributes and esc_html() for body text; never echo raw $_GET/$_REQUEST.

• high Reflected XSS via blogpage query parameter

  xss_reflected

  $_GET['blogpage'] is echoed into the data-page attribute without sanitization/escaping, allowing attribute breakout and script execution for unauthenticated visitors.

  blogs.php:119-119

  Recommendation

  Cast with absint() and/or escape with esc_attr().

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.