URI People Tool WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.5

Findings

2

Worst severity

high

Content hash

045f9d625a6550c2f78a539b… Copy

Findings

• high Contributor+ stored XSS via [uri-people-tool] before/after (html_entity_decode)

  xss_stored

  uri_people_tool_get_people() echoes html_entity_decode($args['before']) and html_entity_decode($args['after']) with no wp_kses. Those strings come from [uri-people-tool] shortcode attributes (defaults are wrapper divs; README documents arbitrary HTML). A Contributor or higher can insert [uri-people-tool before="<script>alert(document.domain)</script>"] or [uri-people-tool before='x"><img src=x onerror=alert(1)>'] into a post. WordPress kses for users without unfiltered_html strips raw tags but does not interpret shortcode attribute text and leaves HTML entities intact; html_entity_decode then reconstitutes executable markup. When the post is previewed or published, the_content runs the shortcode and the payload executes in the viewer's browser (including an editor previewing a pending post). This plugin targets URI department sites, commonly on multisite where even administrators lack unfiltered_html, so the same entity bypass also applies there. Observable consequence: JS runs in the origin of any page rendering the listing, enabling session/nonce theft.

  uri-people-tool.php:133-157

  Recommendation

  Do not echo decoded shortcode HTML raw. After decode, pass the wrappers through wp_kses() with an allowlist of harmless wrapper tags/attributes (e.g. div/span + class), or drop html_entity_decode and require authors with unfiltered_html to supply tags. Example: echo wp_kses( html_entity_decode( $args['before'] ), array( 'div' => array( 'class' => true, 'id' => true ), 'span' => array( 'class' => true ) ) );

• high Author+/Contributor stored XSS via unescaped people email and URL fields

  xss_stored

  The people CPT uses capability_type=post (Author can publish; Contributor can draft) and supports custom-fields, with ACF text fields peopleemail, peopleurl, peoplegooglescholar, and peopleresearchgate (not type email/url). templates/person-card.php concatenates get_field('peopleemail') into href="mailto:…" and get_field('peopleurl') into href without esc_url/esc_attr/esc_html; templates/single-people.php prints the same keys (plus the Google Scholar and ResearchGate URLs) via the_field() inside <a href>. ACF does not escape on output, and a native Custom Fields metabox write bypasses field-type UI entirely. A payload such as foo@x.com" onclick="alert(1) or javascript:alert(1) is stored in post meta and executes for every visitor of a listing that includes email/website or of /meet/{person}. peoplecustom is also echo wpautop()'d with no wp_kses_post (the apply_filters('the_content') result is discarded). This is not mitigated by Contributor kses on post_content, because the values live in post meta. Observable consequence: JS in the site origin on directory cards and profile pages, including when an administrator views them.

  templates/person-card.php:12-21

  Recommendation

  Escape on output: esc_html() for visible text, esc_attr() inside mailto:, and esc_url() on website/Scholar/ResearchGate hrefs (esc_url strips javascript:). In templates/single-people.php apply the same to the_field('peopleemail'), the_field('peopleurl'), the_field('peoplegooglescholar'), and the_field('peopleresearchgate'). Run peoplecustom through wp_kses_post() (and use the the_content filter return value). Prefer ACF field types email/url with sanitization on save.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.