Rotaract Appointments WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

5.0.1

Findings

2

Worst severity

high

Content hash

bda54d4d6aa1f85d6e8ceff7… Copy

Findings

• high Stored XSS via [rotaract-appointments] days and style attributes

  xss_stored

  appointments_shortcode() copies user-supplied shortcode attributes through shortcode_atts() with no allowlist. Two sinks then emit them into the public page without a safe JS/HTML context. (1) public/partials/shortcode.php prints esc_js($shortcode_atts['days']) as a bare calendarInit() argument — esc_js only addslashes quotes/backslashes and HTML-encodes <>; it does not wrap the value as a JavaScript string or coerce it to int/null. Default 'null' is deliberately emitted unquoted so it becomes the JS null keyword; therefore [rotaract-appointments days=alert(document.domain)] or days="1);alert(1);//" is valid JS, runs on DOMContentLoaded, and contains no HTML tags so wp_kses_post does not strip it from Author/Contributor content. (2) the shortcode return concatenates style into a class attribute with no esc_attr, so style='foo" onclick="alert(1)' breaks out of class. Author can publish this without review; Contributor needs an editor to approve the post. Subscriber cannot. Views/init are quoted and esc_js'd and are not this bug.

  public/partials/shortcode.php:33-38

  Recommendation

  Pass days through wp_json_encode() (or absint, with JSON null when unset) so it is a JS literal, not an expression. Escape style with esc_attr() and restrict it to an allowlist (e.g. normal, short). Keep views/init inside quotes only after wp_json_encode, not esc_js.

• medium Calendar event title, location, and markdown description inserted via innerHTML without sanitization

  xss_stored

  List-view eventDidMount does elem.innerHTML = createEventContent(info.event); dayGrid mounts a tippy popup with allowHTML:true and the same HTML string. createEventContent concatenates eventInfo.title and eventInfo.source.id into HTML, interpolates eventInfo.title into an unescaped title="..." attribute on auto-linked locations, and runs marked.parse() on extendedProps.description with no DOMPurify / sanitizer option (marked 17 passes raw HTML through by default). innerHTML and tippy allowHTML execute event-handler payloads such as <img src=x onerror=...>. Write path is not a WP user: FullCalendar loads aurora {type}/{slug}/events.json (owners saved by manage_options) or the public ICS proxy. Anyone who can create a public aurora event for an owner this site displays, or who can add an event on a subscribed ICS calendar, XSSes every visitor of the shortcode page when the event is rendered (list view runs eventDidMount immediately). Admin-only configuration of the feed is a precondition, not a gate on the event fields. Subscriber cannot write those fields through WordPress.

  public/js/public.js:39-68,137-156

  Recommendation

  Treat remote calendar fields as untrusted. Escape title, owner, location, and source id with a text-node or HTML escaper before concatenation. Parse markdown with a sanitizer (e.g. DOMPurify after marked) and do not assign the result to innerHTML / allowHTML unless the sanitizer output is guaranteed safe. Prefer textContent for titles.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.