WP Manifestindependent plugin directory
manifest / media / wp-live2d

Live2D WP RegistryLow-severity findings · 1 findingOpen the reportA-

WordPress Live2D Plugin

by Kasai. · github.com/kasaidot/wp-live2d · website

★ 7stars
0.1.7latest · 8 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/kasaidot/wp-live2d/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/kasaidot/wp-live2d ↗

WordPress Live2D Plugin

=== Live2D ===
Author: Kasai.
Tags: live2d
Requires at least: 4.7.4
Tested up to: 4.7.4
Stable tag: 4.7.4
License: GPLv3 or later
License URI: http://www.gnu.org/licenses/gpl-3.0.html

== Description ==
Plugin realy simple right now, just display a live2d model on the page.

To be Implemented Soon ?
* Ability to add/edit/remove models.

== Installation ==
This section describes how to install the plugin and get it working.

e.g.

1. Upload `wp-live2d` folder to the `/wp-content/plugins/` directory
2. Activate the plugin through the 'Plugins' menu in WordPress
3. Re-Activate it through the "Live2D" menu in WordPress
4. Create a Widget for Live2D

Releases

4 releases.

Tag
Published
0.1.7 latest
Dec 19, 2017 8 years ago
0.1.6.6
Dec 15, 2017 8 years ago
0.1.6.5
Dec 14, 2017 8 years ago
0.1.6.2
Dec 14, 2017 8 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

A- grade

Security

Live2D 0.1.6.5 · audited by WP Registry

Low-severity findings only.

1 low
Audited release
0.1.6.5
Findings
1
Worst severity
low
Content hash
d9df4ffe03f038455f799798…

Findings

  • low Settings save lacks nonce and uses undefined 'live2d' capability

    missing_nonce

    settings.php gates on current_user_can('live2d') (never granted by the plugin) and updates live2d_status from $_POST without check_admin_referer. Menu registration uses manage_options. Impact is limited to a cosmetic option toggle and the broken cap check currently blocks normal admins.

    settings.php:5-14

    Recommendation

    Use manage_options consistently, add check_admin_referer, and sanitize input.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →