WP Manifestindependent plugin directory
manifest / content / phila.gov-customization

Phila.gov Customization WP RegistryHigh-severity findings · 1 findingOpen the reportC-

Continuing development at

by City of Philadelphia · github.com/cityofphiladelphia/phila.gov-customization · website

★ 1stars
0.21.1latest · 10 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/cityofphiladelphia/phila.gov-customization/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/cityofphiladelphia/phila.gov-customization ↗

phila.gov Wordpress Customization

General Wordpress functionality for phila.gov (CPT, custom taxonomies, etc)

Releases

Newest 25 of 60 recorded releases.

Tag
Published
0.21.1 latest
Dec 11, 2015 10 years ago
0.21.0
Dec 11, 2015 10 years ago
0.20.3
Nov 25, 2015 10 years ago
0.20.2
Nov 24, 2015 10 years ago
0.20.1
Nov 24, 2015 10 years ago
0.20.0
Nov 23, 2015 10 years ago
0.19.2
Nov 20, 2015 10 years ago
0.19.1
Nov 20, 2015 10 years ago
0.19.0
Nov 19, 2015 10 years ago
0.18.2
Nov 17, 2015 10 years ago
0.18.1
Nov 13, 2015 10 years ago
0.18.0
Nov 12, 2015 10 years ago
0.17.16
Nov 9, 2015 10 years ago
0.17.15
Nov 9, 2015 10 years ago
0.17.14
Nov 5, 2015 10 years ago
0.17.13
Nov 5, 2015 10 years ago
0.17.12
Nov 5, 2015 10 years ago
0.17.11
Nov 4, 2015 10 years ago
0.17.10
Nov 3, 2015 10 years ago
0.17.9
Oct 30, 2015 10 years ago
0.17.8
Oct 30, 2015 10 years ago
0.17.7
Oct 27, 2015 11 years ago
0.17.6
Oct 22, 2015 11 years ago
0.17.5
Oct 9, 2015 11 years ago
0.17.4
Oct 9, 2015 11 years ago
All releases on GitHub →

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

Phila.gov Customization 0.21.1 · audited by WP Registry

High-severity findings.

1 high
Audited release
0.21.1
Findings
1
Worst severity
high
Content hash
857669444a403537ec3ac2b3…

Findings

  • high Stored XSS via unsanitized department home alert output

    xss_stored

    Department home alert title and link from post meta are echoed directly into HTML without esc_html/esc_url. Any user who can edit the department site post (typically editors) can store a payload that executes for all visitors when the alert renders.

    admin/class-phila-gov-department-sites.php:263-268

    Recommendation

    Escape with esc_html() for the title and esc_url() for the href. Sanitize on save as defense in depth.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →