NextGenSim WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

1.0.0

Findings

3

Worst severity

high

Content hash

d3359fcb2692bf134e951d04… Copy

Findings

• high Stored XSS via unescaped character meta echoed on frontend after password auth

  xss_stored

  After a correct character or admin password, the shortcode concatenates character-title, profile, goal, and insider-info post meta into HTML with no escaping. Those fields are written from new_character.php via raw $_POST into update_post_meta. An administrator (or CSRF against admin — see related finding) who saves HTML/JS in profile fields causes script execution for every frontend user who unlocks that character. Consumer is the public shortcode output.

  nextgensim_live_page.php:71-83

  Recommendation

  Escape on output (esc_html / wp_kses_post). Sanitize on save.

• medium Admin Add Year / Add Character forms lack CSRF nonces

  csrf

  add_year.php and new_character.php process POSTs that insert/update year and character CPTs and password meta whenever the admin page loads with POST data. Menus require manage_options and nextgensim_verify_credentials runs, but there is no wp_nonce_field / check_admin_referer. A CSRF page visited by an administrator creates years/characters or overwrites passwords and insider-info. Observable: forged POST to admin.php?page=nextgensim-add-character updates character meta.

  new_character.php:14-88

  Recommendation

  Add wp_nonce_field to forms and check_admin_referer before any write.

• medium Character and year passwords stored and compared as plaintext post meta

  insecure_config

  Character passwords and year admin-password/secret-password are stored with add_post_meta/update_post_meta as raw strings and compared with === to $_POST on the frontend. Anyone with read access to postmeta (DB dump, compromised low-priv plugin with meta read, backups) obtains all simulation passwords. Not hashed.

  new_character.php:85-87

  Recommendation

  Store password_hash() digests and verify with password_verify(); never echo passwords into HTML.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.