WP Manifestindependent plugin directory
manifest / content / jdm-find-your-nearest

JDM Find Your Nearest WP RegistryHigh-severity findings · 3 findingsOpen the reportD+

Forked from SocialEvolution's "Find Your Nearest", this custom JDM plugin creates a custom post type associated with a lat/long, which can then be sorted by distance from a postal code entered into a search field.

by JDM Digital · github.com/jdmdigital/jdm-find-your-nearest · website

★ 1stars
v2.3latest · 10 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/jdmdigital/jdm-find-your-nearest/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/jdmdigital/jdm-find-your-nearest ↗
JDM Find Your Nearest Forked from SocialEvolution's "Find Your Nearest", this custom JDM WordPress plugin creates a custom post type associated with a lat/long, which can then be sorted by distance from a postal code entered into a search field. Description This plug-in creates a custom post type associated with a lat/long calculated from an entered location's address. You can create as many entries as you want, associate them with latitude and longitude using the Google Map API and allow your visitors to search for their nearest item by entering their own postal code. It has been tested with US zipcodes among others, optimized for Bootstrap v3.x, with numerous improvements over the original plugin, now maintained by SocialEvolution. NOTE: This plugin was custom-built for a client and should (probably) NOT be used for other clients. Feel free to fork it, if you want to repurpose the code. Installation 1. Make sure you have the GitHub Updater plugin installed and setup 1. Install the plugin using the GitHub plugin installer and this repo: https://github.com/jdmdigital/jdm-find-your-nearest 1. Activate the plugin 1. Create a page that you will use to display your search results

Releases

6 releases.

Tag
Published
v2.3 latest
Feb 22, 2016 10 years ago
v2.2
Feb 19, 2016 10 years ago
v2.0
Feb 16, 2016 10 years ago
v1.2
Feb 15, 2016 10 years ago
v1.1.0
Feb 9, 2016 10 years ago
1.0.0
Feb 5, 2016 10 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

JDM Find Your Nearest 2.3 · audited by WP Registry

High-severity findings.

1 high 2 medium
Audited release
2.3
Findings
3
Worst severity
high
Content hash
92371f7bcc6781c94c92c687…

Findings

  • high Unauthenticated AJAX echoes location post content without escaping

    xss_stored

    returnSearchResults (wp_ajax_nopriv) builds HTML including get_the_content() and echoes it raw. The find_your_nearest CPT uses default post capabilities (supports editor), so an Author can plant script/HTML in a location that then executes for every visitor hitting the store locator AJAX.

    lib/classes/ajaxfunctions.php:35-70

    Recommendation

    Escape title/content/URLs with esc_html/esc_url (or wp_kses_post with a tight allowlist) before echoing; prefer JSON + client templating.

  • medium Location meta box saves without nonce

    csrf

    processMetaData updates postcode/lat/long from $_POST on save_post without wp_verify_nonce or explicit capability check beyond the save_post context, enabling CSRF against an authenticated editor of find_your_nearest posts.

    lib/classes/metaboxes.php:42-48

    Recommendation

    Add a metabox nonce, verify it, and confirm current_user_can( 'edit_post', $post_id ). Sanitize inputs.

  • medium Unauthenticated post meta disclosure via return_post_data

    information_disclosure

    wp_ajax_nopriv_return_post_data reads $_GET['postID'] without absint/capability checks and returns postcode/lat/long/title JSON for any ID, enabling enumeration of location PII.

    lib/classes/ajaxfunctions.php:75-90

    Recommendation

    Restrict to published find_your_nearest posts, absint the ID, and only expose fields intended to be public.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →