High-severity findings.

Audited release

1.1.0.2

Findings

1

Worst severity

high

Content hash

8723681ec7c4044e49f62a34… Copy

Findings

• high CSRF on settings form leads to stored XSS in admin settings page

  csrf

  option.php processes $_POST['update_pluginoptions'] and writes raw $_POST values to live2d_main_color, live2d_text_color and live2d_model. It checks no nonce (no wp_nonce_field or check_admin_referer) and does no sanitization. The same page echoes get_option('live2d_main_color') and get_option('live2d_text_color') into HTML attributes without esc_attr, and echoes the model name without escaping. An attacker can lure a logged-in administrator to a page that auto-submits a form to options-general.php?page=librelive2d with main-color="><script>…</script>. The payload persists and runs every time an admin loads the settings page.

  option.php:4-7,37-38,59-66

  Recommendation

  Add wp_nonce_field()/check_admin_referer() and a current_user_can('manage_options') check. Sanitize with sanitize_hex_color_no_hash() and sanitize_file_name() (validating the model against the scanned list), and escape all output with esc_attr()/esc_html().

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.