D39 · Stored XSS: buyer `full_name` unescaped in event-guests wp-admin metabox Mom2Be Security Audit

ביקורת אבטחה

חזרה ללוח

D39אומת בקודP0

Stored XSS: buyer `full_name` unescaped in event-guests wp-admin metabox

C · authS2 · active-safeSECT1

תיקון

95%

מורכבות low

A buyer's name is shown unescaped in an admin screen, allowing stored cross-site scripting.

event-leads.php:171

תיק מלא

ממצאים קשורים

D40 · Stored XSS in admin dashboards (guest…D58 · Stored XSS: event ACF fields + seat-m…D13 · God-router: no nonce + no capability …D37 · Hardcoded payment bypass: `cc_id == 3…D63 · Raw `session_start()` on init after o…