Mirae WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA-

Low-severity findings only.

Audited release

1.0.7

Findings

1

Worst severity

low

Content hash

cbc1a40c04e1b38d5c866722… Copy

Findings

• low Unescaped link URL in shortcode href attribute

  missing_escaping

  miraedisplaydata() assigns $user_link = $link['link'] from the link_data option and interpolates it directly into an href attribute without esc_url(). Button text uses esc_html(), but the URL does not. register_setting('mirae_links','link_data') has no sanitize_callback. Only administrators can save the option via the Mirae admin UI (manage_options), so this is admin-stored missing escaping rather than a Subscriber-reachable stored XSS.

  public/class-mirae-public.php:120-138

  Recommendation

  Sanitize on save (esc_url_raw / allowlist http(s)) and escape on output with esc_url(). Reject javascript: and data: schemes.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.