High-severity findings.

Audited release

2.3.0

Findings

5

Worst severity

high

Content hash

5d5b4be61af1c8793a0f4d02… Copy

Findings

• high Default-on SVG uploads are inlined into frontend HTML with a sanitizer that does not strip scripts or event handlers

  xss_stored

  The render-svg extension is enabled on activation (all build/extensions/* slugs default true). It adds image/svg+xml to upload_mimes for every role that can upload (Author+). The prefilter sanitizer only rejects <iframe>, <object>, <embed>, and <link>, and skips even that check when the file contains the string __SVGATOR_PLAYER__. It never looks for <script>, onload/onerror, javascript: URLs, or <foreignObject>. render_style_svg_as_inline() then runs on the_content and on a full-page ob_start buffer: any descendant <img> of an element with class style-svg (additional CSS class on a Group, or renderSVG on site-logo / post-featured-image) is resolved under ABSPATH and imported via DOM importNode. Event-handler XSS in the SVG therefore executes in the site origin for every visitor. SVGs that contain <script> are swapped to <embed type="image/svg+xml" src="…">, which still runs SVG script in a same-origin nested document. An Author uploads a tiny onload SVG, wraps it in a group with class style-svg, and publishes.

  build/extensions/render-svg/block-functions.php:6-44,92-171

  Recommendation

  Do not enable SVG for upload_files users. If SVG is required, restrict the mime to manage_options, sanitize with a real SVG library (strip scripts, event handlers, foreignObject, external refs), and never inline unsanitized SVG into HTML. Do not treat <embed type=image/svg+xml> as a safe fallback for script-bearing files.

• high Contributor stored XSS via dataAttributes re-injected into heading/figure tags after htmlspecialchars_decode

  xss_stored

  The add-data-attributes UI is a free-text 'Data Attributes' field on core/paragraph, heading, post-title, query-title, image, group, and columns. Server-side, mello_render_data_attribute() (and the duplicate path in add-smooth-scroll) takes attrs.dataAttributes, runs htmlspecialchars_decode(esc_attr()), and concatenates the result into the first <h1>-<h6> or <figure> tag. esc_attr is fully undone, so onclick="alert(1)" or a tag-breakout ><script>… is written into the frontend HTML. WordPress kses does not parse JSON inside block comments, so a Contributor who cannot use unfiltered_html can still store the payload in <!-- wp:post-title {"dataAttributes":"onclick=\"alert(1)\""} /-->. When an author publishes, or an admin previews, the script runs in the site origin. extraProps on static blocks also copies arbitrary attribute names into saved HTML; that path is largely kses-gated for low-priv users, but the PHP re-inject on dynamic post-title/query-title/featured-image is not.

  build/extensions/add-data-attributes/block-functions.php:3-16

  Recommendation

  Allowlist attribute names to data-[a-z0-9-]+ only. Escape names and values separately (esc_attr) and do not htmlspecialchars_decode. Never concatenate raw user strings into HTML tags. Apply the same allowlist in the extraProps save filter.

• high Contributor stored XSS via unsanitized Button iconGlyph concatenated into frontend HTML

  xss_stored

  The button-icon-toggle extension adds a free-text Font Awesome Glyph control (iconGlyph) on core/button. On render, if iconType is fa, the plugin trims iconGlyph, optionally rewrites a \\fNNN unicode token, and otherwise concatenates the raw string into a <span>. A payload such as <img src=x onerror=alert(1)> does not match the unicode regex and is echoed into the rebuilt button markup on every frontend view. core/button is available to Contributor+. The value lives in the block-comment JSON (not in kses-visible HTML), so unfiltered_html is not required. Preview or publish executes the handler in the site origin.

  build/extensions/button-icon-toggle/block-functions.php:40-51

  Recommendation

  Treat iconGlyph as text: allow only a unicode codepoint / FA class name and output with esc_html(). Do not accept HTML in the glyph field.

• high Stored XSS in content-modal frontend: selector interpolated into innerHTML and fetched markup scripts re-executed

  xss_stored

  content-in-modal-toggle lets Contributor+ set openInModal and a free-text modalContentSelector on core/post-title, post-featured-image, and read-more. PHP writes the selector to data-content-selector. On click, frontend.js fetch()es the href, querySelector(selector), assigns the fragment via innerHTML, then clones every <script> so it executes. Invalid selectors throw; the catch path sets innerHTML to a template string containing e.message (which includes the raw selector), so '"><img src=x onerror=alert(1)>' executes. The not-found path interpolates the selector the same way. innerHTML assignment also runs event handlers present in the fetched fragment. A visitor (or an admin previewing the post) only has to click the title/image link.

  build/extensions/content-in-modal-toggle/frontend.js:1

  Recommendation

  Never interpolate the selector or error text into innerHTML (use textContent). Do not re-create/execute <script> nodes from fetched HTML. Restrict modalContentSelector to a safe ident/class allowlist. Prefer inserting a same-origin fragment without script execution.

• medium Contributor can force-delete arbitrary comments via Notes handlers that never check comment_type

  missing_capability

  Tools → Notes is registered with cap edit_posts (Contributor+), not moderate_comments. The admin_init handler accepts action=delete&note_id=N with nonce delete-note-N, then calls wp_delete_comment($note_id, true) with no get_comment() type check. A Contributor can mint that nonce themselves and permanently delete any comment ID (blog comments, other users' notes, WooCommerce order_note comments). Bulk delete via bulk-notes is the same. The AJAX inline-save path likewise updates _mello_note_* meta on any comment ID. WordPress Contributors cannot normally moderate comments; this is an IDOR / missing-object-type check on a state-changing admin GET.

  build/extensions/show-notes-in-dashboard/block-functions.php:398-456,503-515

  Recommendation

  Load the comment and require comment_type === 'note' (and optionally comment_post_ID the user can edit) before any update or delete. Use moderate_comments or edit_others_posts for destructive bulk actions. Prefer POST for deletes.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.