WP Manifestindependent plugin directory
manifest / admin / eno-dashboard

ENO Dashboard WP RegistryHigh-severity findings · 4 findingsOpen the reportD+

by Alex Drum · github.com/melodicalbuild/eno-dashboard

★ 0stars
27release downloads
≈10active sites
v1.2.6latest · 3 years ago

Install

Download eno-dashboard.zip From the v1.2.6 release on GitHub, Mar 13, 2023

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/melodicalbuild/eno-dashboard/releases/download/v1.2.6/eno-dashboard.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/melodicalbuild/eno-dashboard ↗

The ENO Basic Dashboard

Description

The ENO Basic Dashboard to Store all external links.

Installation

Installing "eno-dashboard" can be done either by searching for "eno-dashboard" via the "Plugins > Add New" screen in your WordPress dashboard, or by using the following steps:

  1. Download the plugin via WordPress.org
  2. Upload the ZIP file through the 'Plugins > Add New > Upload' screen in your WordPress dashboard
  3. Activate the plugin through the 'Plugins' menu in WordPress

Screenshots

  1. Description of first screenshot named screenshot-1
  2. Description of second screenshot named screenshot-2
  3. Description of third screenshot named screenshot-3

Frequently Asked Questions

What is the plugin template for?

This plugin template is designed to help you get started with any new WordPress plugin.

Changelog

1.0

  • 2012-12-13
  • Initial release

Upgrade Notice

1.0

  • 2012-12-13
  • Initial release

Releases

4 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.2.6 latest
Mar 13, 2023 3 years ago
eno-dashboard.zip
3
v1.2.4
Mar 1, 2023 3 years ago
eno-dashboard.zip
11
v1.2.3
Feb 28, 2023 3 years ago
eno-dashboard.zip
6
v1.2.0
Feb 28, 2023 3 years ago
eno-dashboard.zip
7

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

D+ grade

Security

ENO Dashboard 1.2.6 · audited by WP Registry

High-severity findings.

2 high 1 medium 1 low
Audited release
1.2.6
Findings
4
Worst severity
high
Content hash
d1e4b4a62225f987457c7e59…

Findings

  • high SQL injection via unsanitized ORDER BY from $_GET

    sql_injection

    Asset_List_Table::prepare_items concatenates $_GET['orderby'] and $_GET['order'] directly into ORDER BY. Magic quotes do not constrain identifier/keyword injection. Reachable on ENO Asset Management (manage_options) and similar list tables.

    includes/table-classes.php:106-108

    Recommendation

    Allowlist orderby columns and order to ASC|DESC only.

  • high Reflected XSS via attacker-controlled error cookie echoed unsescaped

    xss_reflected

    Checkout/check-in pages echo $_COOKIE['eno_checkout_error'] / eno_checkin_error into HTML without escaping. Cookies are client-controlled; any edit_posts user can set a cookie containing HTML/JS and trigger XSS in wp-admin when loading the page.

    includes/class-eno-dashboard.php:350-352

    Recommendation

    Stop using cookies for flash messages; use transients/user meta; always esc_html() on output.

  • medium CSRF on asset checkout/check-in and GET delete without nonce

    csrf

    Checkout/check-in state changes (button1/2/3 POSTs) and asset delete via GET action=delete lack check_admin_referer/check_ajax_referer. An attacker can forge requests from a logged-in Contributor/Admin browser to check out assets or delete rows.

    includes/class-eno-dashboard.php:258-315

    Recommendation

    Add wp_nonce_field + check_admin_referer on all mutating forms; convert delete to POST with nonce.

  • low Unsafe LIKE search interpolates $_POST['s'] without prepare

    unsafe_input

    Search queries embed $_POST['s'] into LIKE clauses without $wpdb->prepare. wp_magic_quotes mitigates classic quote breakout, so rated unsafe_input rather than critical SQLi; still should use prepare/esc_like.

    includes/table-classes.php:119-120

    Recommendation

    Use $wpdb->prepare with '%' . $wpdb->esc_like( wp_unslash( $_POST['s'] ) ) . '%'.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →