High-severity findings.

Audited release

1.5.0.1

Findings

2

Worst severity

high

Content hash

8a86ece03810d30ba64aa4c9… Copy

Findings

• high Stored XSS: debug.log lines echoed as HTML in the admin dashboard widget

  xss_stored

  formatErrors() wraps the first [bracketed] segment in <strong> and then echoes the rest of each log line as HTML. Lines at or under $length (300 on the widget, 1000 on the VIEW action) skip strip_tags entirely; longer lines call strip_tags(..., 'strong') which, as a non-tag string, does not preserve markup but is not used for typical warning lines. A PHP 8 warning that interpolates request input (Undefined array key "<img src=x onerror=alert(document.domain)>") is 181 characters and is therefore printed raw into the Dashboard widget. The widget is registered for the administrator role (dashboardSetup) and the full-file VIEW is dumped to the response for super admins after a nonce check. debug.log is untrusted by nature (WP_DEBUG_LOG, notices from core/plugins/themes, stack traces). This is server-rendered admin HTML, not an innerHTML assignment, so script tags and event handlers execute in the administrator origin when they open Dashboard or click VIEW LOG FILE.

  src/ErrorLog.php:331-345

  Recommendation

  Escape every log line with esc_html() (or wp_kses with an empty allowlist) before output. If timestamps should be bold, escape first, then wrap a matched prefix in <strong>. Set a text/plain Content-Type and skip HTML formatting on the VIEW dump. Do not treat debug.log as trusted markup.

• medium Missing capability check on wp_ajax_wp_debug_log_clear lets any logged-in user truncate debug.log

  missing_capability

  wpDebugLogClear is hooked to wp_ajax_wp_debug_log_clear and only verifies check_ajax_referer(ErrorLog::ACTION, 'nonce'). The sibling GET handler maybeRedirect refuses CLEAR/VIEW unless currentUserCan() (default is_super_admin) AND a valid nonce. enqueueScript() does not use that gate: on every Dashboard load (index.php, capability `read`) it wp_create_nonce()s the same action and inlines it into jQuery.post for all roles, including Subscriber. A subscriber who visits /wp-admin/ and POSTs action=wp_debug_log_clear&nonce=<that value> to admin-ajax.php gets fopen($logfile, 'w') which truncates or creates wp-content/debug.log. That destroys forensic evidence and is a state change the UI only offers to super admins. No nopriv hook, so unauthenticated users cannot call it.

  src/ErrorLog.php:246-256

  Recommendation

  Call currentUserCan() (or current_user_can('manage_options') / is_super_admin()) after the nonce check and wp_send_json_error if it fails. Only enqueue the clear script and nonce for users who pass that same gate.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.