WP Manifestindependent plugin directory
manifest / integrations / mcdaniel-wp-reviews

McDaniel WP Reviews WP RegistryHigh-severity findings · 2 findingsOpen the reportD+

by Rory McDaniel · github.com/mcdanielsoftware/mcdaniel-wp-reviews · website

★ 0stars
181composer installs
1.1.0latest · 5 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/mcdanielsoftware/mcdaniel-wp-reviews/archive/refs/heads/master.zip

On Packagist as mcdanielsoftware/mcdaniel-wp-reviews:

composer require mcdanielsoftware/mcdaniel-wp-reviews
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/mcdanielsoftware/mcdaniel-wp-reviews ↗
McDaniel WP Reviews This is an early version of a WordPress plugin that will display a floating slideshow of your five most helpful reviews. Installation composer require mcdaniel/wp-reviews Activation wp plugin activate mcdaniel-wp-reviews Setup Log in as an Administrator Settings - Google Reviews Settings Enter the API Key, Place ID, minimum star rating, and Google reviews URL Save The widget will now appear on all pages.

Releases

10 releases.

Tag
Published
1.1.0 latest
Mar 18, 2021 5 years ago
1.0.8
Mar 18, 2021 5 years ago
1.0.7
Mar 18, 2021 5 years ago
1.0.6
Mar 18, 2021 5 years ago
1.0.5
Mar 18, 2021 5 years ago
1.0.4
Mar 17, 2021 5 years ago
1.0.3
Mar 17, 2021 5 years ago
1.0.2
Mar 9, 2021 5 years ago
1.0.1
Mar 8, 2021 5 years ago
1.0.0
Mar 8, 2021 5 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

McDaniel WP Reviews 1.0.1 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
1.0.1
Findings
2
Worst severity
high
Content hash
ae69462a96392265be77990b…

Findings

  • high Unauth REST iframe leaks Google API key

    information_disclosure

    REST route mcdaniel/v1/iframe/get is registered without permission_callback and serves template.php which prints carbon_get_theme_option('mcd_google_api_key') into a publicly readable meta tag. Also missing escaping on echoed option values.

    mcdaniel-wp-reviews.php:62-76

    Recommendation

    Add permission_callback that still allows embedding if needed via short-lived signed token; never expose API keys to anonymous clients — proxy Places API server-side; escape output.

  • medium REST route missing permission_callback

    missing_permission_callback

    Omitting permission_callback is deprecated/unsafe; WordPress treats such routes as publicly accessible while raising doing_it_wrong notices.

    mcdaniel-wp-reviews.php:63-66

    Recommendation

    Set an explicit permission_callback (even __return_true if intentionally public, preferably token-gated).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →