Critical findings.

Audited release

0.2.1

Findings

3

Worst severity

critical

Content hash

c3e3a382212e4597ba6f9fa6… Copy

Findings

• critical Unauthenticated reflected XSS in XHTML sermon search form

  xss_reflected

  The [gc_sermons_search] shortcode reads $_GET['sermon-search'] via gc__get_arg() with no sanitization and, when the active theme does not support HTML5 search-form (or the search_form_format filter returns xhtml), renders templates/searchform-xhtml.php. That template calls $this->output('search_query') with no escaping callback, so the raw query is printed into the HTML value attribute. The HTML5 twin template correctly uses esc_attr. wp_magic_quotes/addslashes does not stop this: a quote still closes the attribute in HTML, and > is not slashed, so a payload such as "><img src=x onerror=alert(1)> injects a tag. Any unauthenticated visitor who can load a page containing the search shortcode can execute JavaScript in other visitors' browsers by sending them the crafted URL. Fix: always pass 'esc_attr' (and wp_unslash) when outputting search_query, or delete the XHTML template and use the escaped HTML5 form unconditionally.

  templates/searchform-xhtml.php:13-13

  Recommendation

  Echo the search query with esc_attr( wp_unslash( $query ) ) in searchform-xhtml.php (same as searchform.php). Prefer a single escaped template.

• critical Production FTP credentials shipped in gc-sermons.zip

  hardcoded_credentials

  The GitHub-distributed plugin includes gc-sermons.zip. That zip contains gc-sermons/phploy.ini with live FTP credentials for ftp.generationschurch.com (user jt@generationschurch.com, password 8UAynbtCso-d) targeting public_html/wp-content/plugins/gc-sermons and the staging equivalent. phploy.ini is listed in .gitignore so it is absent from the extracted tag tree, but it is inside the committed zip (README also tells users to install from this zip). On a site installed from the GitHub archive, the zip is HTTP-readable at /wp-content/plugins/.../gc-sermons.zip. On a zip install, phploy.ini sits at the plugin root and is likewise web-accessible. Those credentials grant FTP write into a WordPress plugins directory on that host (plugin-file RCE if still valid). They have been public in the repo zip since the 2018 tag; treat as already-disclosed. Remove the ini from the zip, rotate the FTP password, and do not ship deploy secrets in plugin packages.

  gc-sermons.zip:7-34

  Recommendation

  Delete phploy.ini from gc-sermons.zip and from any release artifacts. Rotate the FTP account password and disable password auth if possible. Keep deploy secrets out of plugin zips; they remain downloadable from wp-content/plugins.

• high Stored XSS via sermon_play_button icon_color attribute breakout

  xss_stored

  GCSS_Play_Button_Run::get_inline_styles() builds an inline style attribute by concatenating sanitize_text_field($this->att('icon_color')) between style=" and ". sanitize_text_field does not encode double quotes. templates/play-button-shortcode.php then prints that string with $this->output('style') (no escaping). An Author (publish_posts) or Contributor (pending post later published) can insert [sermon_play_button icon_color='red" onclick="alert(1)'] into any post. When the shortcode renders, the anchor becomes style="color: red" onclick="alert(1);". The default icon_color is #000000 so the style branch always runs. extra_classes is esc_attr'd; icon_color is not. This bypasses wp_kses on post content because the malicious characters live in a shortcode attribute, not in HTML, until the plugin emits the tag. Observable: JS on any frontend page that includes the play-button shortcode.

  includes/shortcodes/shortcodes-play-button/class-run.php:72-90

  Recommendation

  Sanitize icon_color with sanitize_hex_color() (or a strict #RGB/#RRGGBB regex) and emit style via esc_attr. Do not concatenate untrusted text inside a quoted HTML attribute.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.