URI Admin WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

2.3.0

Findings

2

Worst severity

high

Content hash

067c1ea54a32b3ad4b4edd2f… Copy

Findings

• high Stored admin XSS via unescaped network notice options

  xss_stored

  uri_admin_custom_admin_notice outputs get_site_option('uri_admin_heading|content|color') using _e(), which echoes translated strings without escaping. Combined with uri_admin_save_options storing raw $_POST into those options, a CSRF'd network administrator (or any writer of those options) injects HTML/JS that runs in the Dashboard for users viewing admin_notices.

  inc/uri-admin-welcome.php:5-16

  Recommendation

  Escape with esc_html/esc_attr on output. Sanitize on save (wp_kses_post or sanitize_text_field as appropriate).

• high Network settings save missing nonce and capability checks

  csrf

  uri_admin_save_options hooked to network_admin_edit_settings writes uri_admin_* site options from $_POST without check_admin_referer/settings nonce verification and without current_user_can. WordPress network/edit.php requires manage_network to reach the hook, so impact is CSRF against a network admin leading to stored XSS payload installation.

  inc/uri-admin-welcome-settings.php:226-243

  Recommendation

  Verify the options.php nonce from settings_fields and require manage_network_options (or manage_options) before updating site options; sanitize inputs.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.