High-severity findings.

Audited release

1.3.6

Findings

2

Worst severity

high

Content hash

36f1ccd7c7e57efbb4ced7ce… Copy

Findings

• high Stored XSS via unsanitized [ifcp-icon] class attribute (Contributor+)

  xss_stored

  process_shortcode() takes the shortcode class attribute from shortcode_atts and concatenates it directly into a frontend HTML attribute: ' class="'.$p['class'].'"' then '<span'.$p['class'].'>'. There is no esc_attr(), sanitize_html_class(), or kses on that value. WordPress shortcode_parse_atts preserves a single-quoted value that itself contains double quotes, so a Contributor or Author (edit_posts, no unfiltered_html required) can store [ifcp-icon class='x" onmouseover="alert(document.domain)'] or [ifcp-icon class='x" autofocus onfocus="alert(document.domain)']. do_shortcode on the_content then emits <span class="x" onmouseover="alert(document.domain)">…</span> for every visitor of that post. wp_kses_post strips HTML tags inside post content but does not parse shortcode attributes, so the quote breakout survives the Contributor kses pass. The payload does not need a valid icon name: a missing icon makes get_svg() return empty and the injected span still renders. size/color are passed through DOMDocument::setAttribute (entity-encoded) and are not this bug. Observable: published post HTML contains attacker event handlers in the site origin; a logged-in administrator viewing the post (or preview) can have their session used for plugin install / new-user creation.

  icons-for-cp.php:453-464

  Recommendation

  Escape the class token with esc_attr() (or better, sanitize_html_class() / a strict [A-Za-z0-9_-]+ allowlist) before interpolating it into HTML. Do not concatenate raw shortcode attributes into markup. Keep size/color on setAttribute or likewise escape them if the SVG path changes.

• medium Authenticated SVG import uses wp_remote_get on an arbitrary URL and returns the body (full-read SSRF)

  ssrf

  wp_ajax_ifcp → ajax_callback() case 'import' passes esc_url_raw($_REQUEST['remote_url']) into fetch_svg(), which calls wp_remote_get($remote_url) and returns ['bad'=>false,'icon'=>$response['body']]. wp_remote_get does not apply wp_http_validate_url, so localhost, RFC1918, and link-local targets including http://169.254.169.254/ (cloud instance metadata) are fetched by the WordPress server; the full body is JSON-encoded back to the browser. posteditor.js writes that body into CodeMirror and, on change, jQuery('#ifcp-pw-inner').html(...), so a non-SVG HTML response also executes in wp-admin. The handler verifies nonce ifcp-ajax-nonce but never calls current_user_can('manage_options') (or edit_posts). In default configuration that nonce is only localized on the icons-for-cp editor, whose CPT caps are manage_options, so Subscriber/Author cannot mint it — this is Administrator-reachable SSRF, not unauthenticated. There is no host allowlist (the UI default is a GitHub Font Awesome URL, but any http/https URL is accepted). Observable: an Administrator POST to admin-ajax.php?action=ifcp&req=import&remote_url=http://169.254.169.254/latest/meta-data/ with the editor nonce receives instance-role credentials in the JSON icon field.

  icons-for-cp.php:210-296

  Recommendation

  Replace wp_remote_get with wp_safe_remote_get, allowlist hosts (e.g. raw.githubusercontent.com) or schemes/paths expected for SVG import, and refuse private/link-local addresses. Add current_user_can('manage_options') next to the nonce check. Do not assign the fetched body to innerHTML; treat it as text until it is confirmed safe SVG.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.