HRV - MLA Plugin WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

2.3.100

Findings

2

Worst severity

high

Content hash

64245ca55ead15c6169edd07… Copy

Findings

• high Reflected XSS via $_REQUEST in public searchform value attributes

  xss_reflected

  public/partials/searchform.php echoes $_REQUEST['resort'], date_checkin, date_checkout, bedrooms into HTML value attributes and class strings without esc_attr. Public booking search UI. Attribute-breakout XSS for unauthenticated visitors.

  public/partials/searchform.php:236-280

• high Reflected XSS via $_REQUEST interpolated into inline JavaScript strings

  xss_reflected

  class-hrv_mla-public.php embeds $_REQUEST bedrooms/resort/dates into JS string literals without js escaping — script-context XSS.

  public/class-hrv_mla-public.php:1205-1300

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.