Shark AI WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.12

Findings

1

Worst severity

high

Content hash

bf319ccdd47f24d496dc149e… Copy

Findings

• high Stored XSS: _ai_schema_markup echoed unescaped in JSON-LD script

  xss_stored

  Post meta _ai_schema_markup is REST-writable for any user with edit_posts. wp_head prints wp_unslash($schema) inside a script tag without json encoding or kses, allowing </script><script> payload execution for all visitors.

  shark-ai.php:60-71

  Recommendation

  json_encode decoded structure or wp_json_encode; reject non-JSON; require manage_options to edit schema meta; escape script context.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.