High-severity findings.

Audited release

2.1.1

Findings

1

Worst severity

high

Content hash

8ee71efd4f41ea91e156025b… Copy

Findings

• high Contributor+ stored XSS via [uri-tides] class and height shortcode attributes

  xss_stored

  uri_tides_shortcode() interpolates the unsanitized shortcode attributes class and height directly into HTML attributes. A user with the Contributor role or higher can insert a payload such as [uri-tides class='x" onmouseover="alert(1)'] or [uri-tides height='30" onfocus="alert(1)" tabindex="0'] into a post. WordPress kses for users without unfiltered_html strips HTML tags but does not interpret shortcode attribute text, so quote-breakout event handlers persist. When the post is previewed or published, the_content runs the shortcode and the injected handlers execute in the viewer's browser. This plugin is documented for multisite, where even site administrators lack unfiltered_html by default, so the same breakout also bypasses that restriction. Observable consequence: JS runs in the origin of any page rendering the widget, enabling session/nonce theft against admins who view or preview the content.

  uri-tides.php:64-74

  Recommendation

  Escape attributes on output: sanitize class to a safe token list (or esc_attr()) and cast height with absint() before echoing. Example: $output .= ' ' . esc_attr( $class ); and $output .= '" data-height="' . absint( $height ) . '">'.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.