High-severity findings.

Audited release

1.1.2

Findings

1

Worst severity

high

Content hash

82ade306e3ae91962dab7216… Copy

Findings

• high Stored XSS: unescaped font-family shortcode attribute in inline CSS

  xss_stored

  hyperaudio_shortcode_handler copies atts['font-family'] into $fontfamily without sanitization, then interpolates it verbatim inside an inline <style> block (`font-family: '.$fontfamily.';`). An Author/Editor (or anyone who can publish the shortcode) can supply a value that closes the style element and injects script, e.g. `x;} </style><script>alert(document.domain)</script><style>x{`. Other shortcode sinks (src, dimensions, transcript body) correctly use esc_url/esc_attr/wp_kses_post; this CSS path does not.

  hyperaudio.php:45,179-181

  Recommendation

  Allowlist CSS font-family tokens (letters, spaces, commas, quotes, hyphens) or escape with a CSS-string escaper before interpolation; never allow raw `</style>` or `;` sequences from attributes into style blocks.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.