WP Manifestindependent plugin directory
manifest / social / relax-comment-filters

Relax Comment Filters WP RegistryMedium-severity findings · 1 findingOpen the reportB

WordPress Plugin: Relax Comment Filters

by required · github.com/wearerequired/relax-comment-filters

★ 0stars
1.4kcomposer installs
1.0.1latest · 8 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/wearerequired/relax-comment-filters/archive/refs/heads/master.zip

On Packagist as wearerequired/relax-comment-filters:

composer require wearerequired/relax-comment-filters
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/wearerequired/relax-comment-filters ↗

Forces comments to go through the more liberal post HTML filters, rather than the restrictive comment filters.

Description

With this plugin users can for example post images into comments which don't get stripped by the default KSES filters. This is done by using wp_filter_post_kses() instead of wp_filter_kses().

Releases

2 releases.

Tag
Published
1.0.1 latest
Dec 8, 2017 8 years ago
1.0.0
Dec 8, 2017 8 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Relax Comment Filters 1.0.1 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.0.1
Findings
1
Worst severity
medium
Content hash
f4b71086c8afecb32309f1a1…

Findings

  • medium Comment content filtered with post KSES instead of comment KSES

    wp_kses_bypass

    For users without unfiltered_html, the plugin removes wp_filter_kses from pre_comment_content and adds wp_filter_post_kses, allowing a wider HTML subset in comments than WordPress intends. Combined with themes that output comment_content via the_content-style filters or insufficient escaping, this increases stored XSS risk from commenters.

    relax-comment-filters.php:52-55

    Recommendation

    Avoid relaxing comment KSES on public sites; if required, keep an allowlist closer to comment defaults and ensure themes escape comment output.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →