URI RSS Reader WP Registry grade D+. High-severity findings · 4 findingsWP RegistryHigh-severity findings · 4 findingsOpen the reportD+

High-severity findings.

Audited release

1.2.3

Findings

4

Worst severity

high

Content hash

d4d632c253ceb3b55891bfac… Copy

Findings

• high Stored XSS via unescaped RSS item fields in shortcode output

  xss_stored

  uri_rss_reader_display prints feed item title, link, description, date, and media thumbnail URL/alt with raw print/echo. A contributor/author who embeds [uri-rss-reader url="https://attacker/feed"] (or an admin embedding a compromised feed) causes visitor browsers to execute attacker HTML/JS when the page renders. Cache stores the parsed array, so the XSS persists for the cache TTL.

  inc/uri-rss-reader-parse.php:145-173

  Recommendation

  Escape all feed fields: esc_url for URLs, esc_attr for attributes, wp_kses_post/esc_html for text. Consider stripping HTML from remote descriptions entirely.

• high Stored XSS via unescaped shortcode attributes (heading_level/title/before)

  xss_stored

  Shortcode attributes title, heading_level, before, and after are printed raw. heading_level is concatenated into an HTML tag name (h{$heading_level}), enabling tag breakout. Users who can place shortcodes (authors/editors; contributors on some setups) can inject markup into front-end pages.

  inc/uri-rss-reader-parse.php:114-121

  Recommendation

  Allowlist heading_level to digits 1-6, escape title with esc_html, and do not accept raw HTML before/after attributes (or kses them).

• medium Shortcode render updates site option without capability check

  missing_capability

  Every shortcode render calls update_site_option('uri_rss_reader_recency', $attributes['cache']). Any user who can publish content containing the shortcode can change this network/site option that controls feed cache lifetime, enabling cache-busting or forcing frequent remote fetches (DoS/SSRF amplification via wp_safe_remote_get).

  inc/uri-rss-reader-shortcode.php:250-251

  Recommendation

  Store cache TTL in a request-local variable or post meta; do not write site options from a front-end shortcode path.

• low Unescaped error messages from wp_remote failures

  missing_escaping

  uri_rss_reader_get_xml echoes WP_Error messages and status codes without escaping when feeds fail, which can reflect unexpected content into the page.

  inc/uri-rss-reader-parse.php:299-306

  Recommendation

  Use esc_html on error output or return errors to the shortcode buffer instead of echoing.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.