QPlayer WP Registry grade D. High-severity findings · 5 findingsWP RegistryHigh-severity findings · 5 findingsOpen the reportD

High-severity findings.

Audited release

1.3.4.2

Findings

5

Worst severity

high

Content hash

5e7d21dedaab21d5f1a94835… Copy

Findings

• high CSRF on QPlayer settings allows storing arbitrary JavaScript echoed site-wide

  csrf

  QPlayer_page() checks manage_options then saves $_POST including 'js' and 'css' via update_option without any wp_verify_nonce/check_admin_referer. footer() later echoes get_option('js') raw inside a <script> tag and get_option('css') inside <style> on every public page. An attacker who tricks an administrator into submitting a crafted form can inject persistent JavaScript (session theft, admin takeover).

  option.php:155-166

  Recommendation

  Add a nonce field to the settings form and verify with check_admin_referer before updating options. Prefer not storing arbitrary JS; if custom JS is required, restrict to administrators and document the risk. Escape CSS appropriately; never echo unsanitized JS from options without intentional trusted-admin design plus CSRF protection.

• high CSRF on QPlayer settings allows storing arbitrary JavaScript echoed site-wide

  csrf

  QPlayer_page() checks manage_options then saves $_POST including 'js' and 'css' via update_option without wp_verify_nonce/check_admin_referer. footer() later echoes get_option('js') raw inside a <script> tag and get_option('css') inside <style> on every public page. sanitize_text_field does not stop script-body payloads (no HTML tags required). An attacker who tricks an administrator into submitting a crafted form injects persistent JavaScript (session theft, admin takeover).

  option.php:154-181

  Recommendation

  Add check_admin_referer()/wp_nonce_field on the settings form; store JS/CSS only after capability+nonce; prefer not echoing free-form JS, or restrict to a safe subset and escape for the script/style context.

• high Stored XSS via unsanitized js/css/musicList options in wp_footer

  xss_stored

  footer() concatenates get_option('js') into a live <script> block, get_option('css') into <style>, get_option('color') into CSS, and get_option('musicList') into a JS array literal without escaping. Combined with the CSRF-writable settings path, this yields site-wide stored XSS. Even without CSRF, any admin compromised or option-write elsewhere becomes a full front-end RCE-equivalent in the browser.

  QPlayer.php:74-98

  Recommendation

  Do not echo free-form admin JS into the footer; if customization is required, use wp_add_inline_script with strict allowlists, and escape CSS values for style context.

• low Unmaintained plugin (last update ~2016) with privileged stored-script feature

  unmaintained

  Plugin header and file mtimes indicate abandonment since 2016 while still exposing a custom JS option rendered on the front end. Increases likelihood that CSRF and other issues remain unpatched.

  QPlayer.php:1-14

  Recommendation

  Replace with a maintained player plugin or fork and patch CSRF/escaping before continued use.

• low Unmaintained plugin with privileged stored-script feature

  unmaintained

  Plugin version 1.3.4.2 with Netease HTTP API calls and admin-supplied JS echoed site-wide; upstream appears stale (~2016-era), increasing risk that CSRF/XSS issues remain unpatched.

  QPlayer.php:1-25

  Recommendation

  Replace with a maintained player plugin or fork and harden settings (nonce + remove free-form JS).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.