High-severity findings.

Audited release

1.1.0

Findings

1

Worst severity

high

Content hash

910bc096b534155bef6a1f85… Copy

Findings

• high Stored XSS: meeting titles echoed unescaped on group records after DT entity-decode

  xss_stored

  dt_add_meeting_submit() on dt_details_additional_section renders the Past Meetings list for every non-meetings post type that has the disciple_tools_meetings tile (groups). DT_Posts::get_post() fills $this_post['meetings'] via filter_wp_post_object_fields(), which sets post_title to wp_specialchars_decode($post['post_title']) and permalink to get_permalink(). The plugin then concatenates both into HTML with no esc_html()/esc_url() and with an unquoted href. Write path: a user who has create_meetings (this plugin copies that cap onto every DT role that already has access_groups — multiplier/dispatcher, not manage_options) creates a meeting whose name/title is attacker-controlled, via the tile's window.API.create_post('meetings', meetingFields) or POST /wp-json/dt-posts/v2/meetings. WordPress kses_init() only runs wp_filter_kses on title_save_pre for users without unfiltered_html, and that filter does not strip HTML-entity payloads such as <img src=x onerror=alert(1)>; DT's decode turns them back into a live tag. The group details page is a DT frontend template, so a <script> or onerror payload runs as whoever opens the group (including administrators): cookie/nonce theft and theme REST as that user. A second sink in the same function insertAdjacentHTML's `${newMeeting.permalink}` and `${newMeeting.name}` from the create_post JSON (name is also wp_specialchars_decode'd). Attendee names in the same file are lodash.escape'd, so the authors knew to escape — they skipped it for the meeting list. Note: the PHP foreach is inside a short-open `<?` tag; if short_open_tag is Off the PHP list does not render, but the insertAdjacentHTML sink still fires on create and the unescaped echo remains the intended path on hosts where short tags are enabled. Not unauth/customer, so high rather than critical.

  tile/custom-tile.php:118-121,257-258

  Recommendation

  Replace the short-open tag with `<?php`. Echo with esc_url( $meeting['permalink'] ) inside quoted href and esc_html( $meeting['post_title'] ) as link text. In JS, use lodash.escape (already used for attendee names in this file) or textContent/createElement instead of insertAdjacentHTML with interpolated name/permalink.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.