High-severity findings.

Audited release

0.1

Findings

2

Worst severity

high

Content hash

8b41e44b613432b7b3ebb32a… Copy

Findings

• high Iframe shortcode urldecodes attacker HTML and renders it with Twig |raw

  xss_stored

  Iframe_Controller::prepare_data() urldecodes the shortcode 'content' attribute (Shortcake stores it encoded) and iframe.twig prints {{ content|raw }}, which bypasses Timber autoescape and wp_kses. shortcode_ui_register_shortcodes() registers shortcake_iframe globally with no current_user_can in the render callback; P4EABKS_ALLOWED_PAGETYPE only hides the Shortcake UI, it does not stop the shortcode in posts. Users without unfiltered_html (Author on single-site; Author/Editor on typical Planet4 multisite) cannot paste <script> into post_content because kses strips it, but they can save [shortcake_iframe content="%3Cscript%3E…%3C/script%3E"] which contains no HTML tags. After do_shortcode the script runs for every frontend visitor. The field label ('Please make sure the script is safe') shows this is eval-by-design for trusted editors, but there is no capability gate, so it is stored XSS for any role that can publish/submit content with shortcodes. The same raw sink is reused by prepare_admin_preview when $_GET[content] is copied unsanitized.

  includes/blocks/iframe.twig:9-11

  Recommendation

  Restrict shortcake_iframe rendering to users with unfiltered_html (or a dedicated capability) and/or allowlist iframe/src/sandbox markup via wp_kses with an explicit iframe+script policy. Do not |raw urldecoded shortcode attributes. Keep the Shortcake UI on pages only if you also refuse the shortcode in other post types.

• low Plugin header version stays 0.1 while the distributed git tag is v0.3.8.3

  version_mismatch

  planet4-gpea-blocks.php and readme.txt still declare Version 0.1 / 0.1.0 (Tested up to 4.8.1) even though this archive is GitHub tag v0.3.8.3 (the donate_amt and iframe modules were added in that tag). Update checkers and vulnerability scanners that key on the plugin header will mis-identify the installed build.

  planet4-gpea-blocks.php:3-6

  Recommendation

  Bump the plugin header, readme.txt stable tag, and any packaged version to the real git tag (0.3.8.3) on every release.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.