Mqtt Cogs WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

0.1

Findings

2

Worst severity

high

Content hash

f678340f506f79bcddc6c137… Copy

Findings

• high Contributor stored XSS via shortcode script= attribute (post meta executed with new Function)

  xss_stored

  The drawHTML/drawGoogle/drawLeaflet/drawDataTable shortcodes accept a script attribute naming a post meta key; the meta value is localized into the page and executed client-side with new Function(). Contributors (no unfiltered_html) can add arbitrary custom fields to their own posts and embed the shortcode, so their JS runs for any editor/admin who previews or views the post.

  MqttCogs_Plugin.php:1590-1658

  Recommendation

  Only honour script= when the post author has unfiltered_html (author_can($post, 'unfiltered_html')), or require a protected (underscore-prefixed) meta key editable only by admins.

• medium Unauthenticated JSONP callback reflection in doGetTopN (tqx responseHandler)

  xss_reflected

  The responseHandler value parsed from $_GET['tqx'] is echoed unescaped as the JS function prefix of the response with Content-type application/javascript. Any visitor can make the site serve arbitrary attacker-chosen JavaScript from its own origin (usable as a <script src> gadget to bypass CSP script-src 'self' when combined with any HTML injection).

  MqttCogs_Plugin.php:985-1016

  Recommendation

  Validate responseHandler against /^[A-Za-z_$][\w.$]*$/ (or drop JSONP and use wp_send_json), and send X-Content-Type-Options: nosniff.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.