Booking Engine WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

5.2.0

Findings

2

Worst severity

high

Content hash

5054d0e38d33f3e495f27363… Copy

Findings

• high Missing nonce on booking settings save enables CSRF to stored front-end XSS

  csrf

  admin/customize-be.php runs be_opt() on any POST with be_submit while the page is loaded. There is no wp_nonce_field/check_admin_referer. An attacker can CSRF a manage_options user into writing arbitrary values into omnibees_bg, omnibees_texto, omnibees_botao, omnibees_url, hotel_id, and affiliate. Those options are echoed unescaped into front-end widget CSS and form attributes (views/*/booking-widget.php), so CSRF can inject </style><script>…</script> (stored XSS/skimmer) or redirect bookings via omnibees_url/hotel_id.

  admin/customize-be.php:3-56

  Recommendation

  Add check_admin_referer before be_opt(); sanitize colors (sanitize_hex_color), URLs (esc_url_raw), and escape all get_option outputs in views with esc_attr/esc_url.

• high Unescaped omnibees_* options echoed into front-end CSS and form attributes

  xss_stored

  Booking widget templates echo get_option('omnibees_bg'), omnibees_texto, omnibees_botao, omnibees_idioma, affiliate, and form action URLs without escaping. Combined with unsanitized admin saves, any value stored in those options executes in visitors' browsers (CSS breakout) or controls the booking destination.

  views/off-canvas/booking-widget.php:8-115

  Recommendation

  Escape every option echo (esc_attr for CSS/color and attributes, esc_url for action). Validate allowed templates/idiomas against a whitelist.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.