Medium-severity findings.

Audited release

2.4.0

Findings

1

Worst severity

medium

Content hash

bf69845e6ef3c96bff97b113… Copy

Findings

• medium Verified PayPal IPN parameters stored as HTML payment notes and rendered unescaped in wp-admin

  xss_stored

  On every VERIFIED IPN, rest_api_paypal_ipn() builds a payment note as HTML (`<p>…</p><pre>` plus wp_json_encode of $request->get_params()) and passes it to Payment::add_note() → wp_insert_comment() with comment_type payment_note. wp_insert_comment does not kses. The bundled core admin UI prints notes with comment_text() in views/meta-box-notes.php, which echoes HTML with no esc_html. wp_json_encode does not encode `<`/`>` (only slashes in `</script>`), so IPN fields the payer controls via the unsigned cart (item_nameN, first_name, address_*, etc.) can carry `<img src=x onerror=…>` or similar event-handler markup. That HTML executes in the browser of an administrator (or any user with edit_payments) who opens the payment. Exploitation requires a VERIFIED PayPal IPN, so it is not a free-form unauth stored XSS, but it is reachable by a customer who completes even a $0.01 PayPal payment.

  src/NotificationsController.php:287-295

  Recommendation

  Store the IPN payload as escaped text (esc_html, or wp_json_encode with JSON_HEX_TAG|JSON_HEX_AMP) and render notes with esc_html() instead of comment_text(), or run the note through wp_kses() with a tight admin allowlist before insert.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.