Pressbooks Shared Network WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+ #7 in Multisite & Networks

High-severity findings.

Audited release

1.10.2

Findings

3

Worst severity

high

Content hash

d8cf6a52804c1586ecbb0b26… Copy

Findings

• high Reflected XSS in network-admin Institutions list via 's' parameter

  xss_reflected

  InstitutionsController::index() passes raw $_REQUEST['s'] as params.searchQuery to institutions/index.blade.php, which prints it with the unescaped Blade {!! !!} directive. wp_magic_quotes only backslash-escapes quotes, so payloads such as <img src=x onerror=alert(document.domain)> survive. A super admin who follows a crafted link to network/admin.php?page=pb_multi_institutions&s=... executes attacker script in network admin, allowing creation of super admins or network plugin installation.

  src/Controllers/InstitutionsController.php:41-45

  Recommendation

  Use {{ }} / esc_html() when echoing the search term and sanitize_text_field(wp_unslash($_REQUEST['s'])) at input.

• high Reflected XSS in network-admin Assign Books page via 's' parameter

  xss_reflected

  AssignBooksController::index() builds params from raw $_REQUEST[$key] (unlike AssignUsersController, which applies sanitize_text_field), and assign/index.blade.php line 24 prints $params['s'] with {!! !!}. A crafted link to network/admin.php?page=pb_assign_books&s=<payload> runs script in a super admin's session.

  src/Controllers/AssignBooksController.php:23-41

  Recommendation

  Escape with {{ }} in the template and sanitize request params (sanitize_text_field(wp_unslash())).

• high Assign Users bulk action lacks nonce (CSRF) and can remove institutional-manager scoping

  csrf

  AssignUsersController::processBulkActions() acts on $_REQUEST['action'] and $_REQUEST['ID'] without check_admin_referer (the sibling Institutions and Assign Books handlers do verify nonces). Any page a super admin visits can trigger GET network/admin.php?page=pb_assign_users&action=0&ID[]=<user> to delete wp_institutions_users rows, or action=<institution id> to move arbitrary users between institutions. Deleting an institutional manager's row makes get_institution_by_manager() return 0 so PermissionsManager::handlePagesPermissions() no longer restricts that user, who still holds the super admin granted by syncRestrictedUsers().

  src/Controllers/AssignUsersController.php:47-89

  Recommendation

  Add check_admin_referer('bulk-assign-users') (or the table's bulk nonce) and current_user_can('manage_network') before processing; revoke super admin when a manager row is removed.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.