Coolapk strickers for Argon WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

1.1

Findings

2

Worst severity

medium

Content hash

94472d39f84f7d0fcebdef29… Copy

Findings

• medium CSRF on Coolapk sticker CDN settings (no nonce)

  csrf

  cas_options() updates cas_options_cdn from $_POST without wp_verify_nonce or check_admin_referer. Page is manage_options-gated, so impact is admin CSRF. Attacker can set an arbitrary CDN base used in front-end sticker src URLs and echoed unescaped into the settings form value attribute.

  coolapk-strickers-for-argon.php:27-41

  Recommendation

  Add check_admin_referer, sanitize URL with esc_url_raw, and escape output with esc_attr/esc_url.

• low Unescaped CDN option in admin form attribute

  missing_escaping

  cas_options_cdn is concatenated into an HTML value attribute without esc_attr, enabling stored XSS in wp-admin if the option is poisoned (e.g. via CSRF).

  coolapk-strickers-for-argon.php:39

  Recommendation

  Use esc_attr() when echoing option values into attributes.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.