WP Manifestindependent plugin directory
manifest / integrations / scoreapp-gravityforms

ScoreApp - Gravity Forms WP RegistryMedium-severity findings · 1 findingOpen the reportB

A plugin to connect ScoreApp and Gravity Forms via webhooks

by Bizink · github.com/bizink/scoreapp-gravityforms

★ 0stars
1.2latest · 10mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/bizink/scoreapp-gravityforms/archive/refs/heads/main.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.
From the readme github.com/bizink/scoreapp-gravityforms ↗
Scoreapp Gravity Forms A plugin to connect ScoreApp and Gravity Forms via webhooks

Releases

4 releases.

Tag
Published
1.2 latest
Dec 8, 2025 10mo ago
1.1.2
Dec 12, 2024 1 year ago
1.1.1
Dec 12, 2024 1 year ago
1.1
Dec 12, 2024 1 year ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

ScoreApp - Gravity Forms 1.2 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.2
Findings
1
Worst severity
medium
Content hash
0fcdec59932b020129e27a57…

Findings

  • medium Unauthenticated Gravity Forms entry injection via REST

    missing_permission_callback

    register_rest_route scoreapp/v1/submit uses permission_callback __return_true. Any caller posting LEAD_SIGNED_UP JSON can GFAPI::submit_form to configurable/default form_id 12. No HMAC/API key. Enables spam lead injection and form flooding.

    scoreapp-gravityforms.php:14-60

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →