WP Manifestindependent plugin directory
manifest / analytics / wp-tns

TNS for WordPress WP RegistryMedium-severity findings · 1 findingOpen the reportB

Norway TNS tracking script for WordPress

by Frederik Rabøl of Bonnier Interactive · github.com/benjaminmedia/wp-tns

★ 0stars
232composer installs
v0.2latest · 10 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/benjaminmedia/wp-tns/archive/refs/heads/master.zip

On Packagist as benjaminmedia/wp-tns:

composer require benjaminmedia/wp-tns
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/benjaminmedia/wp-tns ↗
Norway & Denmark TNS tracking script for WordPress

Releases

2 releases.

Tag
Published
v0.2 latest
Oct 14, 2016 10 years ago
v0.1
Aug 11, 2016 10 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

TNS for WordPress 0.2 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
0.2
Findings
1
Worst severity
medium
Content hash
1ad934d0537069acdba642a3…

Findings

  • medium CSRF on TNS tracking settings (no nonce)

    csrf

    loadAdminPage calls updateOptionsIfChanged which writes every $_POST key via update_option without nonce or capability re-check beyond options page (manage_options). Tracking params s/cp are echoed into front-end JS.

    wp-tns.php:103-137

    Recommendation

    Add check_admin_referer; whitelist option keys; sanitize values.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →