Quantity Enabled for Jet Booking WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

1.2.4

Findings

3

Worst severity

high

Content hash

d6a32e258c1f9b22e64d032e… Copy

Findings

• high CSRF on settings AJAX persists unsanitized frontend copy

  csrf

  wp_ajax_jet_abaf_qefjb_save_settings is reachable by any logged-in administrator and updates jet_abaf_qefjb_settings after a current_user_can('manage_options') check, but never calls wp_verify_nonce / check_ajax_referer. assets/js/admin/settings.js POSTs action + settings with no nonce either. parse_str($_POST['settings']) is array_merged onto the existing option with no key whitelist and no sanitization, so a cross-site POST can set arbitrary keys (including no_units_available_date, which is not on the settings form). Those values are later emitted unescaped in product-page JavaScript, turning this CSRF into stored XSS for all visitors. Multisite site admins have manage_options but not unfiltered_html; this handler still lets them persist raw JS.

  quantity-enabled-for-jet-booking.php:324-339

  Recommendation

  Call check_ajax_referer() (and localize a nonce to the settings script). Whitelist keys, sanitize each value (sanitize_text_field / absint), and refuse extra keys. Die with -1 on failed capability instead of returning an empty 200.

• high Stored XSS: settings interpolated into product-page inline script

  xss_stored

  get_blocked_days() hooks wp_head on jet_booking product pages and concatenates jet_abaf_qefjb_settings into a <script> block with PHP short-echo and no esc_js/wp_json_encode. no_units_available_date is always interpolated into a JS single-quoted string (not gated on show_stock); out_of_stock and show_totalstock are likewise raw. Because this is source inside a script tag, innerHTML-does-not-execute-script does not apply: a stored value of </script><script>… or ';alert(document.domain);// executes for every visitor. pages/settings.php also prints the same option keys into HTML attributes without esc_attr. Combined with the nonce-less save_settings writer, an unauthenticated attacker who can CSRF an administrator gets persistent JS on every rental product page (session theft / same-origin payment skimming).

  quantity-enabled-for-jet-booking.php:771-813

  Recommendation

  Pass all option strings through wp_json_encode() or esc_js() before placing them in JavaScript. Escape settings-form attributes with esc_attr(). Sanitize on save. Prefer wp_add_inline_script with wp_json_encode data instead of a raw <script> echo in wp_head.

• medium Unauthenticated add-to-cart AJAX loops unbounded quantity without a nonce

  dos

  jet_booking_add_cart_single_product is registered for both wp_ajax_ and wp_ajax_nopriv_ with no nonce or capability check. quantity is taken from $_REQUEST via wc_stock_amount (intval) and the handler calls WC()->cart->add_to_cart($product_id, 1) once per unit. There is no upper bound, so an unauthenticated POST with a large quantity is a CPU/session DoS (and, if Jet Booking creates on-hold rows during add_to_cart, an inventory-lock). This plugin's own add_to_cart_validation compares requested $quantity to unit count, but the AJAX path always passes 1, so limit_quantity never applies to the bulk loop. quantity-fix.js serializes the product form onto this action with no nonce.

  quantity-enabled-for-jet-booking.php:554-590

  Recommendation

  Verify a WooCommerce/add-to-cart nonce. Cap quantity to the product's max purchase / unit count before looping. Validate availability against the real requested quantity once, not per qty=1 add_to_cart call. Consider a single add_to_cart($id, $quantity) plus Jet Booking's own booking-insert path instead of an unbounded loop.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.