COMET VolcanoDB WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

0.0.2

Findings

2

Worst severity

high

Content hash

2bc50230ce44907b2d57b544… Copy

Findings

• high CSRF on VolcanoDB settings enables site-wide HTML injection via reverse proxy

  csrf

  comet_volcanodb_settings_submit runs on load of the settings page and updates comet_volcanodb_base_path, comet_volcanodb_remote_site, and ssl_verify from $_REQUEST with no nonce or explicit capability re-check. An attacker can CSRF a manage_options user to point remote_site at an attacker-controlled host. Unauthenticated visitors requesting /{base_path}/... then receive that host's response body via echo in comet_volcanodb_include_content — enabling stored/reflected script injection for all site visitors (skimmer-class).

  comet_volcanodb.php:85-110

  Recommendation

  Require check_admin_referer / wp_nonce_field on the settings form, re-check current_user_can('manage_options'), and sanitize remote_site with esc_url_raw plus an allowlist of expected hosts if possible.

• medium Unauthenticated reverse proxy echoes remote HTML without sanitization

  xss_stored

  On init, matching REQUEST_URI paths are proxied to get_option('comet_volcanodb_remote_site') and the raw response body is echoed and exit. By design for embedding, but any compromise or CSRF of remote_site becomes immediate full-page XSS for visitors. Also forwards the visitor 'session' cookie to the remote host.

  comet_volcanodb.php:136-280

  Recommendation

  Treat remote HTML as untrusted: constrain remote_site, strip scripts/event handlers if embedding is required, and avoid forwarding session cookies unless strictly necessary.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.