Mermaid Blocks WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.1.0

Findings

2

Worst severity

high

Content hash

7a0b932925cb854d41f4e5b6… Copy

Findings

• high Stored XSS via bundled Mermaid 11.4.1 sequence-diagram KaTeX labels (CVE-2025-54881)

  xss_stored

  The plugin ships MermaidJS 11.4.1 (assets/mermaid.js, assets/mermaid.min.js; version pin in mermaid-blocks.php) and, on every page that contains the block, build/view.js calls mermaid.initialize({startOnLoad:false}) then mermaid.run({querySelector:'.wp-block-mermaid-blocks-diagram'}). mermaid.run reads the <pre> innerHTML, entity-decodes it, and renders it. In 11.4.1, sequence-diagram actor/message labels that contain $$...$$ match hasKatex() and are passed to calculateMathMLDimensions(), which assigns the full unsanitized string to a temporary div via innerHTML and inserts that div into document.body (assets/mermaid.js). That path is independent of securityLevel (default strict) and of the editor-only htmlLabels:false flag. Gutenberg save() puts `code` as text children of <pre>, so React stores < as < and kses does not strip the onerror attribute; mermaid then entity-decodes it back. A Contributor or Author without unfiltered_html can therefore store a sequence diagram that executes JavaScript for anyone who opens the post in the editor (admin review) or views the published page. Public PoC (GHSA-7rqq-prvp-x9jh): participant A as Alice<img src="x" onerror="document.write(`xss on ${document.domain}`)">$$\\text{Alice}$$. Patched upstream in mermaid 11.10.0 (this plugin still pins 11.4.1).

  assets/mermaid.js:21716-21728

  Recommendation

  Replace assets/mermaid.js and assets/mermaid.min.js with mermaid >= 11.15.0 (11.10.0 fixes CVE-2025-54881; 11.15.0 also fixes the CSS/HTML injection advisories). Update the $mermaid_version pin. On initialize(), set securityLevel: 'sandbox' (or at least keep strict and add fontFamily, themeCSS, altFontFamily, themeVariables to the secure[] list) in both build/view.js and the editor bootstrap in build/index.js. Do not rely on htmlLabels:false alone.

• medium Front-end mermaid.initialize omits sandbox/secure keys, allowing CSS and HTML injection from diagram source

  missing_escaping

  build/view.js initializes Mermaid with only {startOnLoad:false}. Mermaid 11.4.1 defaults securityLevel to strict and secure[] to [secure, securityLevel, startOnLoad, maxTextSize, suppressErrorRendering, maxEdges] — fontFamily, themeCSS, altFontFamily, and themeVariables remain diagram-overridable via %%{init:...}%%. GHSA-87f9-hvmw-gh4p / CVE-2026-41159: a flowchart such as %%{init: {"fontFamily": "x;a{b} :not(&){background:green !important} c{d}"}}%% flowchart LR / A --> B injects CSS that escapes #mermaid-* scoping via stylis :not(&) and can restyle the whole page or exfiltrate attributes. CVE-2026-41149: stateDiagram-v2 classDef values can break out of the SVG <style> and inject overlay HTML (script tags are stripped, so this is defacement/phishing rather than JS XSS). Both are reachable by Contributor/Author-controlled block `code` on published posts. The editor bootstrap sets htmlLabels:false but the public view script does not, and neither path sets securityLevel sandbox. Same library pin as finding 1; separate because the observable is page-wide CSS/HTML injection, not script execution.

  build/view.js:1

  Recommendation

  Upgrade Mermaid to >= 11.15.0 and call mermaid.initialize({startOnLoad:false, securityLevel:'sandbox', htmlLabels:false, flowchart:{htmlLabels:false}, secure:['secure','securityLevel','startOnLoad','maxTextSize','suppressErrorRendering','maxEdges','fontFamily','themeCSS','altFontFamily','themeVariables']}) in both view.js and the editor. Treat diagram source as untrusted even for Author-role users.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.