Bullion Ops Helper WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

0.9.33

Findings

2

Worst severity

medium

Content hash

8a8ed237d3dfa28dc5931b3f… Copy

Findings

• medium Stored XSS via TOC ItemList JSON-LD (JSON_UNESCAPED_SLASHES with decoded heading text)

  xss_stored

  On enrolled contexts (every singular asx_announcement and posts with enrolled slugs) the plugin extracts H2 headings from post_content with DOMDocument and uses textContent, which decodes HTML entities, as the ListItem name. The schema is printed with wp_json_encode() using JSON_UNESCAPED_SLASHES (and without JSON_HEX_TAG), so a heading containing </script><script>alert(document.domain)</script>, which survives kses, is output as a literal </script><script>... sequence that terminates the ld+json block and executes. Any user able to author or edit such content (potentially Contributor/Author depending on the asx_announcement CPT) can run script for visitors and for administrators previewing or viewing the post.

  bullion-ops-helper.php:1806-1834,1922-1934,2052-2086

  Recommendation

  Drop JSON_UNESCAPED_SLASHES (or add JSON_HEX_TAG) for all JSON-LD output so '</' is escaped, and strip tags/limit heading text before encoding.

• low WPCode snippet rewrite via REST gated only by manage_options

  missing_capability

  PATCH /bullion-ops/v1/wpcode/snippet/<id>/search-replace performs str_replace on any WPCode snippet's post_content and saves it with wp_update_post. WPCode restricts PHP snippet editing to users with unfiltered_html; this route only requires manage_options, so on multisite a sub-site administrator could alter executed PHP snippets (code execution).

  bullion-ops-helper.php:94-98,526-566,569-571

  Recommendation

  Require unfiltered_html (or WPCode's wpcode_edit_php_snippets capability) for the WPCode endpoints.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.