Media Copyright Scanner WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.0.1

Findings

1

Worst severity

high

Content hash

e7bec7a34b184bd7512d34d9… Copy

Findings

• high Author+ stored XSS in scanner results via unescaped jQuery.append()

  xss_stored

  mcs_scan_media and mcs_get_safe_images return attachment filename, get_the_title(), alt meta, post_content, and wp_get_attachment_url() in JSON with no HTML encoding (correct for an API). The admin UI then builds table rows with a template literal and $tbody.append(...), which jQuery parses as HTML. An Author (upload_files; no manage_options) can set the attachment title to a payload such as gettyimages<img src=x onerror=alert(document.cookie)> — post_title is not kses'd on save, and /gettyimages/i is one of the default scan patterns, so the row is returned on Start Scan. Event handlers run in the administrator origin; jQuery.DOMManip will also globalEval <script> nodes. Show Safe Images uses the same appendResults() sink without a pattern check, so a later title edit on a flagged attachment also fires. media_url is interpolated into href unescaped as well. Subscriber cannot plant (no upload_files); the AJAX handlers themselves remain manage_options+nonce gated.

  assets/js/scan-script.js:17-33

  Recommendation

  Do not concatenate attachment fields into HTML. Build rows with jQuery/DOM APIs and .text()/.attr(), or escape every interpolation (text with a HTML-escape helper; href with a URL allowlist). On the PHP side, still keep JSON raw, but consider returning a pre-sanitized display object (esc_html-equivalent for text, esc_url for media_url). Restrict mcs_flag_safe to attachment IDs.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.