Taro Geo Taxonomy WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

nightly

Findings

1

Worst severity

high

Content hash

adcaa389de01f6742d1123cd… Copy

Findings

• high Contributor+ stored XSS via address meta in JSON-LD script tag

  xss_stored

  MetaBox::save_post stores $_POST zip/street/building via update_post_meta with no sanitize_text_field/kses. Any user who can save a supported post (Contributor on their own drafts, Author on posts they can publish) can submit those fields together with nonce action taro_geo_save. SeoMeta::add_json_ld then prints the values as JSON-LD on the public singular: json_encode($json, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) inside <script type="application/ld+json">. JSON_UNESCAPED_SLASHES disables PHP's default \/ escaping, so a stored payload such as </script><script>alert(document.domain)</script> in _street/_building/_zip appears as a literal </script> and the HTML parser exits the ld+json element and executes the following script for every visitor. This bypasses unfiltered_html (authors/contributors cannot put script tags in post_content). The same array is pushed into Yoast's wpseo_schema_graph when Yoast is present. Address::the_address() echoes the concatenated address with no escaping if a theme calls it. Subscriber cannot write the meta on default post types.

  src/Taro/GeoTaxonomy/Controllers/SeoMeta.php:41-76

  Recommendation

  Sanitize zip/street/building with sanitize_text_field on save. Encode JSON-LD with wp_json_encode( $json, JSON_HEX_TAG | JSON_HEX_AMP | JSON_UNESCAPED_UNICODE ) or wp_print_inline_script_tag() so </script> cannot break out of the script element. Escape Address::the_address() with esc_html. Keep the existing nonce; also check current_user_can('edit_post', $post_id) in save_post.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.