Core Blocks Enhancer WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

1.9.0

Findings

2

Worst severity

medium

Content hash

8225047578cdab4f843ad80a… Copy

Findings

• medium Stored XSS via core/button alt attribute interpolation

  xss_stored

  render_core_button reads $attrs['alt'] and injects it into an aria-label via preg_replace without esc_attr. A Contributor who can insert a core/button block can supply alt containing " onfocus=... or break out of the attribute, executing script for anyone viewing the rendered content.

  lib/render.php:150-153

  Recommendation

  Escape with esc_attr($alt) (and similarly escape icon URL/color before CSS interpolation).

• medium Stored XSS / unsafe URL via core/embed YouTube placeholder

  xss_stored

  render_core_embed builds an <a href="{$link}"> from $block['attrs']['url'] without esc_url. A crafted javascript: or data: URL in the embed block attribute is emitted into front-end HTML for viewers.

  lib/render.php:218-224

  Recommendation

  Use esc_url($link) and restrict to https:// hosts on youtube/youtu.be.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.