Tarosky Sitemap WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

2.5.0

Findings

1

Worst severity

high

Content hash

cfdc12cff25fcb4dce682964… Copy

Findings

• high Stored XSS via JSON-LD script break-out (JSON_UNESCAPED_SLASHES, no JSON_HEX_TAG)

  xss_stored

  StructuredDataGenerator is always hooked on wp_head. render_head() emits each JSON-LD graph inside a <script type="application/ld+json"> tag using json_encode($json, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT) with no JSON_HEX_TAG/JSON_HEX_AMP. PHP's default json_encode would escape / as \/, which prevents an HTML </script> closer; JSON_UNESCAPED_SLASHES removes that defense, so a string containing </script><script>…</script> is emitted verbatim and the HTML parser terminates the JSON-LD script and executes the injected script. Article schema is emitted on is_singular($article_post_types) when tsmap_jsonld_article_post_types is non-empty (the JSON-LD settings section). Tainted fields: headline <= get_the_title() (post_title is not kses-filtered on save, even for users without unfiltered_html), author.name <= display_name, author.url <= user_url when it matches #^https?://.+#. A Contributor or Author can set those from the post editor or profile.php. Preview of a pending post also hits is_singular(), so an editor who clicks Preview is XSS'd before publish. Front-page WebSite schema uses only bloginfo (admin-only) and is not this vector. Fix is to encode with JSON_HEX_TAG (and preferably JSON_HEX_AMP/JSON_HEX_APOS) or wp_json_encode() plus those flags so < becomes \u003C.

  src/Tarosky/Sitemap/Seo/Features/StructuredDataGenerator.php:100-110

  Recommendation

  Replace json_encode(...) with wp_json_encode($json, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS) (or equivalent) so <, >, and & become \u003C/\u003E/\u0026 and cannot close the HTML script tag. Do not echo JSON-LD via printf into a raw <script> without those flags. Keep JSON_UNESCAPED_SLASHES only together with JSON_HEX_TAG.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.