Offensive
Web Security Audit & Remediation
Nonprofit early-childhood center — audit, fix, verify.
- WordPress
- PHP
- OWASP
- WPScan
- Patchstack
Note:Client details are withheld under the terms of the engagement. The technical findings below are reproduced in full.
- plugins audited
- 16
- stored XSS found & fixed
- 1
- vulnerability databases cross-checked
- 5
- upstream files modified
- 0
A nonprofit early-childhood center engaged me to review their public site.
The audit covered WordPress core, 16 plugins, and a custom theme, cross-checked against Wordfence Intelligence, WPScan, Patchstack, the GitHub Advisory Database, and NVD.
The significant finding was a stored XSS path in the parent theme: it registered contact and social customizer settings with no sanitize_callback, then echoed them unescaped straight into href attributes. Anyone with customizer access could persist script into every page.
The fix mattered as much as the finding. Rather than patching the parent theme — which would have been silently reverted by the next update — remediation went into the child theme via theme_mod_{$name} filters applying esc_url, sanitize_email, and sanitize_text_field. Zero upstream files touched, so the site stays updatable and the fix survives.
Also verified: the site's forms plugin against a 2025 supply-chain compromise of that vendor's distribution, and its backup plugin against an actively exploited CVE. Both confirmed patched.
A separate 23-page content audit ran alongside it under an explicit no-PII rule — individual staff names and addresses were deliberately kept out of the written record. It surfaced a departed employee's address still routing live job applications to an unmonitored mailbox, duplicate pages advertising conflicting prices, and five empty published pages.
Details
- Audited WordPress core, 16 plugins, and a custom theme against five vulnerability databases
- Identified stored XSS: customizer settings registered without sanitize_callback, echoed unescaped into href
- Remediated in the child theme via theme_mod_{$name} filters — no parent-theme edits, so the fix survives updates
- Verified the forms plugin against a 2025 vendor supply-chain compromise
- Confirmed the backup plugin patched against an actively exploited CVE
- 23-page content audit conducted under a documented no-PII rule
- Found a departed employee's address still receiving live job applications