High-severity findings.

Audited release

2.0.1

Findings

2

Worst severity

high

Content hash

333c4f9d998a9ea1c2ddb3b4… Copy

Findings

• high Reflected/cookie XSS in Fewbricks InfoPane admin script injection

  xss_reflected

  When the InfoPane is enabled (filter fewbricks/info_pane/display not false; demo enables it), InfoPane::set_start_height copies unsanitized $_GET['fewbricks-info-pane-height'] or $_COOKIE['fewbricks_info_pane_height'] into InfoPane::$start_height. inject_js() then echoes that value raw into an inline <script> on admin_head: startHeight: ' . InfoPane::$start_height. An attacker who lures an authenticated wp-admin user (Author+) to a crafted admin URL or who can set the cookie can break out of the JS literal and execute arbitrary script in the admin context (session/capability abuse).

  src/InfoPane.php:59-84

  Recommendation

  Cast/sanitize start height to a safe integer or the literal "minimized", and output via wp_json_encode() inside the script rather than raw concatenation. Do not trust GET/cookie for JS literals.

• medium Remote update checker unserializes attacker-influenced HTTP body

  unsafe_unserialize

  WP_AutoUpdate::getRemote() POSTs to https://version.fewbricks2.folbert.com/version-info.php and returns @unserialize($request['body']) without allowed_classes. A compromised update host or TLS-intercepting attacker can return a crafted serialized object graph (POP gadgets from WordPress/ACF/autoload) leading to object injection / potential RCE during admin update checks.

  src/WP_AutoUpdate.php:112-130

  Recommendation

  Parse JSON with json_decode() instead of unserialize, or use unserialize(..., ['allowed_classes' => false]). Prefer WordPress.org / signed updates.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.