ARU EMOTICONS for Argon WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

1.2

Findings

2

Worst severity

medium

Content hash

95decd9a816a9db366c24096… Copy

Findings

• medium CDN settings save lacks nonce (admin CSRF)

  csrf

  aru_options() updates aru_options_cdn from $_POST without wp_verify_nonce. The submenu requires manage_options, so only administrators can load the page, but a CSRF request from an admin session can point sticker CDN URLs at an attacker-controlled host. Those URLs are embedded as sticker image src values via the argon_emotion_list filter.

  aru-emoticons-for-argon.php:27-41

  Recommendation

  Verify a nonce and capability (manage_options) before update_option; escape CDN URLs on output.

• low CDN option echoed into sticker URLs without URL sanitization

  missing_escaping

  Custom CDN values from aru_options_cdn are concatenated into sticker src attributes without esc_url. Combined with CSRF or a compromised admin, this can load remote scripts/images from arbitrary origins in theme emotion UI.

  aru-emoticons-for-argon.php:54-100

  Recommendation

  Sanitize with esc_url_raw on save and esc_url on output; restrict to http(s) allowlist.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.