Enfold Gravity Modal WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

0.3.0

Findings

2

Worst severity

medium

Content hash

7dfb19c68287f198d6591066… Copy

Findings

• medium Unauthenticated AJAX renders arbitrary Gravity Forms

  information_disclosure

  ic_gravity_modal_get_form is registered for nopriv and calls gravity_form($form_id,..., $_GET, true) for any form_id. Exposes form markup/structure (and field population via $_GET) without checking the form is modal-enabled.

  gravity-forms/config.php:30-38

  Recommendation

  Only allow form IDs with ic-gravity-modal enabled; avoid passing raw $_GET as field values.

• low Unsafe JSON embedding into single-quoted JS string

  xss_stored

  Form options json_encode()'d then wrapped in JSON.parse('%s')—apostrophes in titles/options break out of the single-quoted string (admin-controlled stored content).

  gravity-forms/config.php:52-55

  Recommendation

  Use wp_localize_script / wp_add_inline_script with wp_json_encode only (no manual quoting).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.