WordPress / WordPress/wordpress.org
Menu Navigation Title, lack of sanititation intentional?
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 163
- Forks
- 221
- PR merge metrics
- No merged PRs in 30d
Description
Caught a site with a poor security that had an injection (assumed) to the first menu item's Navigation Title that added to the end of the text a string of
</a><div style="position:absolute;left:-14569px;"><a href="https://jerkfacepersonurlhere"> somenamehere</a></div><a>
The issue aside of how it got in, it made me wonder if this input field should get sanitized against something like this?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file or test is named; start by locating where a menu item's Navigation Title is saved and rendered, then trace the existing sanitization or escaping behavior for the reported HTML payload. Confirm the intended security behavior and add or update focused coverage so the issue is resolved with a reproducible check.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 42/100