Legendary SEO Pages WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.0.53

Findings

2

Worst severity

high

Content hash

9a44582fa5f43e6002b5346e… Copy

Findings

• high Stored XSS via unauthenticated ll_marketing_add_data

  wp_ajax_nopriv_ll_marketing_add_data inserts raw $_POST['name'] and $_POST['url'] into ll_marketing_tracker with no sanitization or nonce. Admin reports view (views/reports.php) echoes $value->name and $value->url without escaping. An unauthenticated visitor can plant script payloads that execute when an admin opens the Legendary SEO reports page.

  legendary-seo-pages.php:64-110

• low Unsafe SQL string concat for IP lookup (magic-quotes mitigated)

  IP existence check concatenates esc_like($_POST['ip_address']) into SQL with double quotes instead of $wpdb->prepare. On default WP, wp_magic_quotes escapes quotes so classic SQLi fails; still unsafe coding (defense-in-depth).

  legendary-seo-pages.php:76-78

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.