High-severity findings.

Audited release

1.0.1

Findings

2

Worst severity

high

Content hash

5243a5be43162f9aa00b7aec… Copy

Findings

• high Stored XSS via unique id values interpolated into the Accessibility Review innerHTML overlay

  xss_stored

  On post preview for anyone with edit_post, campus-a11y.js scans [id] nodes and, when an id is duplicated, stores the raw id string as unique_ids message data. getMessageString/expand substitutes that value into the localized unique_ids title (placeholder ###id###). getMsgsMarkup then assigns the result to m.innerHTML. innerHTML will execute event-handler markup such as <img src=x onerror=...>, and render() auto-opens the first issue popup ~100ms after parse. WordPress kses allows the id attribute on post tags for Contributor (no unfiltered_html); the attribute value is not executable in the post body, but this overlay promotes it into HTML. A Contributor (or Author on multisite) can plant two elements with a crafted duplicate id, then induce an Editor/Admin to click Accessibility Review — script runs in that privileged session. Contrast fg/bg interpolations are hex from getComputedStyle and are not this bug.

  assets/src/js/preview/render.js:93-107

  Recommendation

  HTML-escape all interpolated issue data (id, and any future placeholders) before innerHTML, or build the dialog with textContent/DOM APIs. Treat unique_ids as text, not markup. Do not auto-open a popup whose body includes unsanitized DOM-derived strings.

• medium CSRF on alt, decorative-flag, and ignore AJAX (capability checked, nonce absent)

  csrf

  wp_ajax_campus_a11y_ignore, campus_a11y_update_alt, campus_a11y_update_decorative, and campus_a11y_update_decorative_url all read stripslashes_deep($_POST), gate only on current_user_can('edit_post', $post_id), and then update_post_meta (_wp_attachment_image_alt, _campus_a11y_decorative_image, or campus_a11y_ignores). No check_ajax_referer/wp_verify_nonce. wp_localize_script data for campus_a11y_insights includes ajax URL and post.id but no nonce; assets/src/js/request.js and assets/src/js/admin.js POST action/post_id/alt without one. An Author/Editor/Admin who can edit the target can be CSRF'd into changing site-wide image alts (editors/admins), marking attachments decorative, or rewriting ignore maps. Alt is sanitize_text_field so this is not XSS; consumer is core attachment alt plus optional the_content replacement. Settings save is a separate path and does verify Nonce::ACTION_SETTINGS under manage_options.

  src/Campus/A11y/Controller/class-ajax.php:16-143

  Recommendation

  Create a nonce in Assets::get_data(), send it from request.js and admin.js, and call check_ajax_referer in every Ajax method before any update_post_meta. Keep the edit_post checks.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.