WordPress.org
Get WordPress

Make WordPress Core

Changes between Version 2 and Version 3 of Ticket #65051, comment 4


Ignore:
Timestamp:
04/16/2026 04:55:03 AM (5 months ago)
Author:
liaison

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #65051, comment 4

    v2 v3  
    1 del
     1Test Report & Security Impact Analysis
     21. Environment
     3WordPress: 7.1-alpha (trunk)
     4
     5Setup: Multisite Network Admin
     6
     7Verification Method: Standalone PHP Mock + Browser DevTools Interception
     8
     92. Security Analysis: Why a PoC is currently "Silent"
     10I would like to clarify the current impact of this vulnerability. While the fix is essential, a successful XSS alert is currently unlikely to trigger in the default UI for the following reasons:
     11
     12Empty Response on Malicious Payload: When a payload like <script>alert('XSS')</script> is injected into the term parameter, the backend executes a get_users query. Since no user account exists with such a string, the database returns an empty set. The resulting Ajax response is an empty array [].
     13
     14Safe Client-Side Handling: The current core JavaScript expects a JSON array of user objects. When it receives [], it simply does not render any dropdown items, preventing the payload from being echoed back into the DOM.
     15
     163. Why the fix is still critical
     17Log Poisoning / Second-Order XSS: If the search term is recorded in server-side logs (e.g., Audit logs or Slow Query logs) viewed in other admin interfaces, the script could execute.
     18
     19Future-Proofing: Any UI changes displaying "No results found for: [term]" would immediately turn this into a high-risk Reflected XSS.
     20
     21Data Integrity: Aligning with WP coding standards by sanitizing at the entry point.
     22
     234. Verification Results
     24[Next comment]My standalone tests confirm that the patch correctly strips HTML tags at the entry point.
     25
     26Payload Intercepted via DevTools:
     27
     28
     29action: autocomplete-user
     30term: <script>alert('XSS')</script>Admin
     31site_id: 2
     32Backend Observation (using attached test script):
     33
     34Before Patch: get_users receives the raw <script> tag.
     35
     36After Patch: get_users receives the sanitized string alert('XSS')Admin.
     37
     38[[Image(test-65051-sanitize.png)]]