Kybernaut - iframe manager WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

0.1.6

Findings

1

Worst severity

high

Content hash

57023a6e81072bf0f9f13c65… Copy

Findings

• high Stored XSS via data-title consumed with insertAdjacentHTML

  xss_stored

  Vendored iframemanager (src/js/00-iframemanager.js, concatenated into assets/kybernaut-iframemanager.min.js) does document.querySelectorAll('div[data-service="'+service_name+'"]') for youtube and vimeo, reads dataset.title, and injects it with insertAdjacentHTML. That API parses markup; <script> tags do not run, but event-handler tags do. wp_enqueue_scripts loads this file whenever the current post has a core/embed block (or kbnt_iframe_manager_load_script is true). WordPress post kses allows div[data-*]. Empirically wp_kses_post() keeps <div data-service="youtube" data-id="x" data-title="<img src=x onerror=alert(1)>"></div> unchanged; the HTML parser then yields dataset.title === '<img src=x onerror=alert(1)>'. An Author (publish_posts, no unfiltered_html) or Contributor (pending review) can save that Custom HTML block plus any core/embed so the script loads. Every visitor of the published post executes the handler in the site origin. Independently, render_block_core/embed copies the oEmbed iframe title attribute (YouTube/Vimeo video title, decoded by DOMDocument::getAttribute) into the same data-title field, so a malicious provider title on an otherwise-normal embed is also XSS. Subscriber cannot create posts or comments with divs; this is not unauth. No plugin option/meta write is involved — core post_content is the store.

  src/js/00-iframemanager.js:406-420

  Recommendation

  Set the notice title with textContent (or document.createTextNode), never insertAdjacentHTML. If HTML in titles is required, run the string through a sanitizer that strips tags and event-handler attributes before injection. On the PHP side, treat iframe titles as plain text (sanitize_text_field) before writing data-title. Do not rely on wp_kses_post: encoded entities in data-* attributes are allowed and decode in dataset.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.