High-severity findings.

Audited release

1.1.0

Findings

1

Worst severity

high

Content hash

e1fe837ad5f24e28e50d0cde… Copy

Findings

• high Shop Manager/Editor can inject arbitrary JavaScript on checkout via conversion tags

  xss_stored

  The conversion-tag CPT is registered with capability_type 'page' and show_ui true, so any user with edit_pages — including WooCommerce Shop Manager (no unfiltered_html, no manage_options) and Editor — can create and publish tags. PostType::save_post persists filter_input(INPUT_POST, 'cs-cvtag') into _cs_tag with no wp_kses, no unfiltered_html check, and no current_user_can() of its own (only nonce update_taro_cs). Renderer::render() later echoes that meta unescaped in wp_head/wp_footer, and will wrap it in a <script> tag when _cs_wrap_with_tag is set. Built-in conditions include WooCheckout, WooCart, WooThankyou, WooMyaccount, and AllPages, so the payload runs on the payment flow for every customer. This bypasses the WordPress kses/unfiltered_html model that would otherwise strip script from Shop Manager (and from Editor on Multisite) post_content. Subscriber/Customer cannot reach the writer. Raw echo of admin-authored pixels is the product; the bug is that the writer is keyed off page capabilities rather than manage_options or unfiltered_html.

  src/Tarosky/ConversionSlots/PostType.php:45-90

  Recommendation

  Treat conversion snippets as an unfiltered_html / manage_options capability, not as pages. Set capabilities so only manage_options (or a dedicated cap granted to administrators) can create/edit/publish conversion-tag posts, or refuse to save _cs_tag unless current_user_can('unfiltered_html'). Keep the nonce. Continue to echo stored tags only after that tighter write gate.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.