Related Ad Patch WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.2.2

Findings

1

Worst severity

high

Content hash

a58dd6ede636cccb74731627… Copy

Findings

• high Unescaped optional_tag meta echoed on front-end (stored XSS)

  xss_stored

  Ad post type related-post-ad stores optional_tag from POST without sanitization (only nonce on save_post) and link_after() echoes the meta raw on related-post front-end output. Default CPT capabilities map to 'post', so Author+ roles who can publish ads can inject script/HTML into public related-post patches (ad/skimmer vector).

  src/Hametuha/RelatedAdPatch/AdPostType.php:186-189

  Recommendation

  Restrict who can edit related-post-ad, sanitize/kses the optional_tag on save (or require unfiltered_html), and escape on output unless intentionally raw for trusted admins only.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.