Trace stored XSS in WordPress Gutenberg render_callback functions.
npx skills add https://github.com/obenland/dotfiles --skill wp-block-security
Please help me install this Agent Skill. Skill: wp-block-security Source: https://github.com/obenland/dotfiles/tree/main/claude/.claude/skills/wp-block-security Command: npx skills add https://github.com/obenland/dotfiles --skill wp-block-security
WordPress security teams and developers need a structured methodology to identify stored XSS vulnerabilities in Gutenberg blocks by tracing how user-controlled $attributes propagate through render_callback output.
Run a targeted audit on a WordPress Gutenberg block by tracing how $attributes flow from render_callback to HTML output and validating the escaping at each step.
High-intent search queries and answers about installing and using this skill.
To find stored XSS in WordPress Gutenberg blocks, trace how user-controlled $attributes flow into HTML output through render_callback functions. Analyze the full call chain of each callback registered via register_block_type to identify escaping mistakes.
Auditing Gutenberg render_callback output contexts involves stepwise mapping of attribute flow, checking escaping adequacy at each output point, classifying severity, and generating a structured vulnerability report for reproducible security checks.
No, this XSS security auditing method does not work with blocks defined via block.json. The scope is strictly limited to tracing $attributes through render_callback paths registered via register_block_type, ignoring $content and $block.
To check if block attributes are properly escaped in WordPress, map the render_callback output contexts and verify that adequate escaping functions are applied to user-controlled $attributes before they reach the HTML output.
When tracing user-controlled attributes in Gutenberg, limitations include ignoring $content, $block, and blocks defined via block.json, restricting the analysis exclusively to render_callback paths registered through register_block_type.
Yes, you can use this approach to train CI pipelines on WordPress security patterns by applying the stepwise detection methodology and real-world reference patterns illustrating insecure and secure render paths to prevent escaping mistakes.
YehudaFrankelDetect tech stack and map features to DB access patterns in code-map.md.
xukrutdonutDevelop WordPress themes, plugins, and Gutenberg blocks following WPCS and PHP 8.1+.
oilerCreate WordPress Gutenberg blocks with PHP render callbacks and register_block_type.
AndyAnh174Detect and exploit stored, reflected, and DOM-based XSS vulnerabilities.
