Medium-severity findings.

Audited release

3.10.7

Findings

2

Worst severity

medium

Content hash

c52a70e52b93f9c44a164872… Copy

Findings

• medium Stored XSS via unsanitized UnivIS directory fields on public contact cards

  xss_stored

  When a person post has a UnivIS ID and 'UnivIS-Daten verwenden' enabled, get_fields() copies remote XML into the same array used for frontend cards. jobTitle is concatenated into HTML with no esc_html. Office-hour comment and office strings from UnivIS are passed through officehours_repeat() and then printed as HTML (create_OpeningHours documents that HTML is allowed). Website URLs use FILTER_SANITIZE_URL rather than esc_url, so a javascript: URL survives into href. The directory endpoint is hardcoded as http://univis.uni-erlangen.de/prg (plaintext). A poisoned UnivIS profile or an HTTP MITM therefore becomes stored XSS for every visitor of [kontakt], single-person templates, and the Kontakt widget. Local CMB2 text fields are sanitized on save; this sink is the remote merge. Social-media hrefs are also unescaped (local text_url, https-only).

  includes/Data.php:568-569

  Recommendation

  Fetch UnivIS over HTTPS. Treat every remote field as untrusted: esc_html() for job titles and office-hour comments, esc_url() for website/social hrefs. Keep plugin-generated markup (e.g. weekday <abbr>) separate from UnivIS comment/office strings. Do not pass UnivIS values into CMB2 placeholder attributes without esc_attr.

• low Plugin is in code freeze and no longer developed

  unmaintained

  README.md states the plugin is no longer developed and is being replaced by a FAUdir-based rewrite, with no compatibility guarantee. GitHub release v3.10 is labeled 'Code Freeze Version'. Remaining issues (including the UnivIS XSS sink) are unlikely to receive feature-level fixes; sites should plan migration.

  README.md:11-15

  Recommendation

  Migrate to the FAUdir-based successor when available. Until then, disable UnivIS sync or restrict contact editing to trusted roles, and prefer HTTPS-only outbound fetches.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.