The Events Calendar Extension: Settings Import / Export WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

2.1.0

Findings

1

Worst severity

medium

Content hash

645661b95577cbc73f7e6c09… Copy

Findings

• medium Administrator+ reflected XSS via unsanitized GET msg on the settings page

  xss_reflected

  settings_page() is the Events > Settings Import / Export (and Network Settings equivalent) callback. When $_GET['action'] is non-empty it builds an admin notice and, if $_GET['msg'] is set, appends '<p>' . urldecode($_GET['msg']) . '</p>' then echoes $msg with no esc_html, esc_attr, or wp_kses. WordPress already URL-decodes query args, so the extra urldecode() also accepts double-encoded payloads (%253Cscript%253E…). The page is registered with manage_options, so a Subscriber cannot render it; an unauthenticated attacker who tricks a logged-in administrator into opening a crafted URL executes script in wp-admin (session riding / new admin user / plugin install). The plugin’s own post-import redirects put HTML status text in this same parameter, which is why the sink was left unescaped.

  tribe-ext-settings-import-export.php:159-181

  Recommendation

  Do not echo request data as HTML. Pass status through a transient or tribe_notice/settings_errors instead of a GET msg parameter. If a query arg must remain, escape with esc_html() (or wp_kses_post only for a fixed allow-list of tags the plugin itself generates). Drop urldecode(); WordPress already decodes query strings.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.