Taro Custom Style WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.1.19

Findings

1

Worst severity

high

Content hash

92dae98bdd2fc3051b7eaf28… Copy

Findings

• high Contributor+ stored XSS via unsanitized custom CSS echoed in frontend style tags

  xss_stored

  tcs_display_style() prints attacker-controlled CSS with echo $style inside a <style> element on every matching frontend request (wp_head priority 100 for posts/terms, 9999 for style-groups). There is no esc_html, wp_strip_all_tags, or Wikimedia StylesheetSanitizer call; the leftover comment says 'Output sanitized style' but sanitization was removed in 98fcd5e and tcs_sanitize_css() is never invoked. Write paths (all nonce-gated, none of which sanitize): (1) save_post stores filter_input(INPUT_POST,'tcs-css') into post meta _css and _css_preview for any user who can save a supported post (Contributor on their drafts; Author who can publish); (2) edited_terms stores the same field as term meta _css on supported taxonomies; (3) wp_ajax_tcs_term_preview stores $_POST['css'] as _css_preview after edit_term; (4) style-group edit_terms stores tcs_style. Authors/Contributors lack unfiltered_html, so kses would strip <script> from post_content, but update_post_meta does not kses. A payload such as </style><script>alert(document.domain)</script><style> closes the style element and runs as HTML for every visitor of that post or taxonomy archive. Admin must have enabled the post type/taxonomy under Appearance → Custom CSS (the plugin's normal setup). Wikimedia css-sanitizer remains in vendor/ unused.

  includes/functions.php:117-150

  Recommendation

  Restore Wikimedia\CSS\Sanitizer\StylesheetSanitizer (already required in composer.json) inside tcs_display_style before echo, or at minimum reject '</style', HTML tags, and expression()/url(javascript:) while keeping vendor-prefix CSS. Alternatively restrict the metabox and term fields to unfiltered_html or edit_css. Do not store unsanitized POST into _css/_css_preview/tcs_style.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.