Khanoumi Affiliate Partner Plugin WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA-

Low-severity findings only.

Audited release

1.2.3

Findings

1

Worst severity

low

Content hash

3ece81ecc2aca401e161076d… Copy

Findings

• low Unescaped output of remote API product fields in front-end templates

  missing_escaping

  The product carousel and grid templates echo nameFa, nameEn, imageUrl and discountPercent from the khanoumi.com API response (cached in a transient) directly into HTML and attributes with no esc_html/esc_attr/esc_url. deemaLink is built from the API 'slug' without escaping when no Deema link is configured. A compromised or malicious upstream API, or a product name containing markup, would inject script into every page that shows the shortcode, block or widget. This requires the third-party API to misbehave, so it is low severity.

  views/public/shortcodes/get-products-grid.php:7-13

  Recommendation

  Escape all remote data at output: esc_url() for links and images, esc_attr() for alt, esc_html() for names, (int) for percentages.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.