# ATT Consent — Security & Standards Audit Audit date: 2026-02-18 ## Summary | Severity | Count | Status | |----------|-------|--------| | Critical | 0 | — | | High | 2 | Documented (by-design / future consideration) | | Medium | 4 | Fix in progress | | Low | 7 | Fix in progress (priority items) | --- ## High Severity ### H1. Admin Script Snippets Rendered Raw to Frontend **File:** `includes/class-scripts-manager.php:106`, `includes/class-frontend.php:178,185` **Status:** By design — no action required **Detail:** The `snippet` field is stored raw and rendered to all visitors. This is the standard WordPress pattern for code-injection features (Theme Editor, HFCM). Protected by `manage_options` capability + nonce verification on save. ### H2. Inline Scripts Incompatible with CSP **File:** `includes/class-frontend.php:68-127` **Status:** Future consideration **Detail:** The consent defaults and tracking scripts are output as raw inline `