WP Manifestindependent plugin directory
manifest / integrations / azrcrv-get-github-file

Get GitHub File WP RegistryHigh-severity findings · 1 findingOpen the reportC-

Get GitHub File ClassicPress plugin

by azurecurve · github.com/azurecurve/azrcrv-get-github-file · website

★ 1stars
1.8krelease downloads
≈160active sites
v2.0.0latest · 1mo ago

Install

Download azrcrv-get-github-file.zip From the v2.0.0 release on GitHub, Sep 8, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/azurecurve/azrcrv-get-github-file/releases/download/v2.0.0/azrcrv-get-github-file.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/azurecurve/azrcrv-get-github-file ↗

Get GitHub File

Plugin Banner

Description

Gets the content of a file from a GitHub repository and outputs using the [github-file] shortcode.

Settings allow default options, such as author, folder, filename to be specified. Additional options to allow the removal or conversion of WordPress headers in readme.txt files.

Available shortcode parameters:

  • account - account on GitHub
  • branch - branch to get file from
  • folder - folder containing the file
  • file - file to get from GitHub repository
  • repository - name of GitHub repository
  • startfrom - text in file to start outputting from (e.g. # Description)
  • htmlastext - 1 to output HTMl as text and 0 to output as HTML
  • shortcodesastext - 1 to output shortcodes as text and 0 to output as shortcode
  • wordpresstitles - remove/ignore/convert

All parameters except repository can be defined as defaults in settings.

Example shortcode usage:

[github-file branch="master" repository="azrcrv-get-github-file"]

Output is in markdown, but use of a plugin such as Markdown by azurecurve can convert this markdown to HTML markup.

This plugin is multisite compatible; settings need to be configured for each site.

Installation Instructions

  • Download the latest release of the plugin from GitHub.
  • Upload the entire zip file using the Plugins upload function in your ClassicPress admin panel.
  • Activate the plugin.
  • Configure relevant settings via the configuration page in the admin control panel (azurecurve menu).

About azurecurve

azurecurve was one of the first plugin developers to start developing for Classicpress; all plugins are available from azurecurve Development and are integrated with the Update Manager plugin for fully integrated, no hassle, updates.

The other plugins available from azurecurve are:

Releases

12 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v2.0.0 latest
Sep 8, 2026 1mo ago
azrcrv-get-github-file.zip
44
v1.2.5
May 31, 2025 1 year ago
azrcrv-get-github-file.zip
354
v1.2.4
Feb 3, 2024 2 years ago
azrcrv-get-github-file.zip
1,053
v1.2.3
Feb 4, 2023 3 years ago
azrcrv-get-github-file.zip
161
v1.2.2
Mar 30, 2022 4 years ago
azrcrv-get-github-file.zip
86
v1.2.1
Dec 10, 2021 4 years ago
azrcrv-get-github-file.zip
40
v1.2.0
May 15, 2021 5 years ago
azrcrv-get-github-file.zip
54
v1.1.0
Oct 29, 2020 6 years ago
azrcrv-get-github-file.zip
7
v1.0.3
Apr 5, 2020 6 years ago
azrcrv-get-github-file.zip
4
v1.0.2
Apr 4, 2020 6 years ago
azrcrv-get-github-file.zip
7
v1.0.1
Mar 29, 2020 6 years ago
azrcrv-get-github-file.zip
7
v1.0.0
Feb 9, 2020 6 years ago
azrcrv-get-github-file.zip
8

Active-site estimate ≈160 comes from the median of recent superseded releases. Method.

C- grade

Security

Get GitHub File 2.0.0 · audited by WP Registry

High-severity findings.

1 high
Audited release
2.0.0
Findings
1
Worst severity
high
Content hash
0b5747f45e680506a8f03590…

Findings

  • high Contributor stored XSS via [github-file] shortcode with htmlastext=0

    xss_stored

    The shortcode fetches https://raw.githubusercontent.com/<account>/<repository>/<branch>/<folder><file> with all path parts taken from shortcode attributes, and only escapes '<'/'>' when htmlastext is 1. Because htmlastext is a shortcode attribute, any user who can insert shortcodes (Contributor and above, who lack unfiltered_html) can set htmlastext=0 and point to a repository they control, causing arbitrary HTML/JavaScript to be rendered on the page. The remote content can be swapped after editorial review.

    includes/functions-shortcode.php:158-264

    Recommendation

    Do not allow the shortcode attribute to disable escaping unless the post author has unfiltered_html; otherwise always escape (esc_html) or run the output through wp_kses_post(). Consider restricting account/repository to an admin-configured allow-list.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →