University of Michigan: Events WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.4.2

Findings

2

Worst severity

high

Content hash

9711f595c91db42c3df7259c… Copy

Findings

• high Contributor stored XSS via unescaped Gutenberg className on the events block

  xss_stored

  The umichevents/events dynamic block copies the Gutenberg className attribute (block style class plus the Additional CSS class(es) field) into a string and the template prints it raw inside a class="..." attribute. WordPress kses on save does not neutralize a quote-breakout payload because it contains no HTML tags, and this plugin does not use get_block_wrapper_attributes()/esc_attr(). A user with edit_posts (Contributor can plant it; Author can publish) can store className value x" onmouseover="alert(1) so the frontend renders <div class="wp-block-umichevents-events x" onmouseover="alert(1)">, executing in visitors' and previewing admins' browsers. moreLinkText is also echoed unescaped in the same template (text node of the more-link <a>); that is a second missing-escape but script tags there are largely stripped by kses, unlike the class attribute breakout.

  templates/block-events.tpl:1-23

  Recommendation

  Build the wrapper with get_block_wrapper_attributes() or echo esc_attr( sanitize_html_class() / a space-separated list of sanitized class tokens ) — never raw className. Escape moreLinkText with esc_html() and the more-link URL with esc_url(). Do not concatenate unsanitized attribute values into HTML.

• medium Event feed fields rendered without escaping in frontend templates

  xss_stored

  Shortcode, widget, and block templates print events.umich.edu JSON properties directly into HTML: permalink in href, event_title/event_subtitle/location_name/building_name as element bodies, image_url as img src (getResizedEventImage returns the raw URL unchanged when size is full or the editor fails), and image_description as alt. There is no esc_url/esc_html/esc_attr. The feed is treated as trusted, but it is a campus-wide calendar that imports Maize Pages student-organization events; any HTML or quote in those fields is stored in uploads/umich-events-cache and replayed to every visitor of pages that embed the plugin. This is not writable by a WP Subscriber, but it is a persistent XSS sink for whoever can create or import an event on the upstream calendar.

  templates/event.tpl:1-14

  Recommendation

  Escape every feed field at the output boundary: esc_url() for permalink/image src (and reject non-https hosts if the image is fetched), esc_attr() for alt text, esc_html() for titles, subtitles, and location names. Apply the same escaping in templates/block-events.tpl, templates/widget.tpl, and any theme overrides. Optionally allowlist image_url to events.umich.edu before calling wp_get_image_editor().

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.