Medium-severity findings.

Audited release

3.3.7

Findings

1

Worst severity

medium

Content hash

dece73b6b85954ec58d6fd69… Copy

Findings

• medium Reflected XSS in admin-bar profiler tooltips via unsanitized SQL and HTTP URLs

  xss_reflected

  Laps builds timeline event descriptions from unsanitized data and then renders them as HTML in Bootstrap tooltips. With SAVEQUERIES enabled, Sql_Collector concatenates the raw SQL string (which includes request-controlled values such as the public search parameter s) with HTML markers. Http_Collector uses the outbound request URL as the event name; Stopwatch_Record interpolates that name next to <hr> markup. Toolbar_Manager feeds those descriptions through the Mustache template into title="{{description}}". The bundled tooltip (public/js/source.js, copied into laps.js) is initialized with html:true and no sanitizer; Tooltip.setContent() assigns the decoded title via jQuery.html(). An unauthenticated attacker who tricks a manage_options user into opening a URL whose queries or HTTP calls contain HTML (for example /?s=<img src=x onerror=…> while SAVEQUERIES is on) can execute JavaScript in that administrator's session when they hover a Laps timeline bar. The output is not shown to roles below manage_options on a default install (laps_can_see). Mitigations: SAVEQUERIES is required for the SQL path; the HTTP path does not need it but does need the admin's request to call an attacker-influenced URL.

  public/js/source.js:4-10

  Recommendation

  Keep intentional markup (<br>, <hr>) separate from untrusted text. HTML-escape SQL, HTTP URLs, and backtrace strings (esc_html / htmlspecialchars) before concatenation. Prefer tooltip html:false, or sanitize with a whitelist that allows only br/hr. Do not pass raw query text or URLs into jQuery.html().

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.