Method People Grid WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

0.9.2

Findings

1

Worst severity

medium

Content hash

80a850f148616fb745c7f462… Copy

Findings

• medium Reflected XSS via randID in nopriv person modal AJAX

  xss_reflected

  method_people_grid_build_modal is nopriv-reachable and interpolates $_POST['randID'] into an HTML id attribute without escaping. The shortcode consumer inserts the AJAX response with jQuery .html(), which evaluates script/event-handler markup. An unauthenticated attacker can craft randID to break out of the attribute and inject HTML/JS.

  method-people-grid.php:362-412

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.