WP Manifestindependent plugin directory
manifest / themes / geeklove-assistant

Geeklove Assistant WP RegistryHigh-severity findings · 3 findingsOpen the reportD+

A plugin to assist Geeklove theme in adding widgets.

by Codestag · github.com/codestag/geeklove-assistant · website

★ 0stars
19release downloads
≈10active sites
1.1.0latest · 3 years ago

Install

Download geeklove-assistant-1.1.0.zip From the 1.1.0 release on GitHub, Jan 30, 2023

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/codestag/geeklove-assistant/releases/download/1.1.0/geeklove-assistant-1.1.0.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/codestag/geeklove-assistant ↗

A plugin to assist Geeklove theme in adding widgets.

To use this follow the below steps

  1. Make sure you have Geeklove Theme installed and then clone or download this repo.
  2. Place the repo folder in your WordPress installations wp-content/plugins/ folder.
  3. From your wp-admin Dashboard go to Plugins and activate Geeklove Assistant plugin.

Bugs

If you found a bug create a support request at Codestag Support or create an issue here.

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.1.0 latest
Jan 30, 2023 3 years ago
geeklove-assistant-1.1.0.zip
11
1.0.1
Dec 17, 2020 5 years ago
geeklove-assistant-1.0.1.zip
8

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

D+ grade

Security

Geeklove Assistant 1.1.0 · audited by WP Registry

High-severity findings.

1 high 1 medium 1 low
Audited release
1.1.0
Findings
3
Worst severity
high
Content hash
458de7b94474d856ca2036b0…

Findings

  • high Contact form email header injection and missing CSRF protection

    unsafe_input

    Shortcode geeklove_contact_form processes unauthenticated POST submit_message. contact_name is only trim()'d then concatenated into the From header: 'From: ' . $name . ' <' . $email . '>'. Newlines in the name enable classic mail header injection (e.g. Bcc). There is no wp_nonce_field/check, so cross-site POSTs can trigger mail to admin_email / theme contact email. Email is validated with is_email; message body is not HTML-escaped into headers but goes into the body.

    includes/shortcodes/contact-form.php:18-58

    Recommendation

    Strip CR/LF from name (sanitize_text_field), use a fixed From address with Reply-To set to the validated email only, add a nonce + honeypot/rate limit, and reject names containing control characters.

  • medium AJAX gallery save allows IDOR post meta write

    missing_capability

    stag_save_images (wp_ajax_stag_save_images) verifies nonce stag-ajax and current_user_can('edit_posts'), then update_post_meta( $_POST['post_id'], '_stag_image_ids', $ids ) without current_user_can('edit_post', $post_id). Any Author+ can overwrite gallery image IDs on posts they cannot edit.

    includes/metaboxes/stag-admin-metaboxes.php:368-382

    Recommendation

    Require current_user_can('edit_post', absint($_POST['post_id'])) and validate post_id as an integer belonging to an allowed post type.

  • low Plugin header version disagrees with GA_VERSION constant

    version_mismatch

    Plugin header Version is 1.1.0 while define('GA_VERSION','1.0.1') is set in Geeklove_Assistant::define_constants.

    geeklove-assistant.php:8-80

    Recommendation

    Keep header Version and GA_VERSION in sync.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →