WP Manifestindependent plugin directory
manifest / utilities / meom-live-search

MEOM Live Search WP RegistryHigh-severity findings · 2 findingsOpen the reportD+

WordPress plugin for showing live search results. Compatible with Polylang and Relevanssi plugins.

by MEOM · github.com/meom/meom-live-search · website

★ 1stars
1.0.5latest · 1 year ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/meom/meom-live-search/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/meom/meom-live-search ↗
MEOM Live Search Usage 1. Add where you'd like to list live search results. 2. For custom results, add a following file to your theme folder: /meom-live-search/search-results.php. Below is an example of custom search result template. Our function returns a variable called $searchresults that contains an array of posts, if found any. HOX! You need to include search form before using this plugin. For example: Notes - Plugin listens inputs with [name="s"] and fires ajax request on changes. Input have to be wrapped inside element. - Plugin will render results inside .meom-live-search elements. - Result element .meom-live-search will have a class .active on input focusin event and the class will be removed on focusout event. - Loader is shown while requesting server for results. Loader uses class name .meom-live-searchloader. When loader is visible it gets class name .meom-live-searchloader--show Filters Filter for changing the class that gets results. Filter for changing input element we are listening to. Filter for changing search arguments.

Releases

6 releases.

Tag
Published
1.0.5 latest
Mar 14, 2025 1 year ago
1.0.4
Mar 14, 2025 1 year ago
1.0.3
Mar 16, 2021 5 years ago
1.0.2
Nov 26, 2019 6 years ago
1.0.1
May 31, 2019 7 years ago
1.0.0
Apr 9, 2019 7 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

MEOM Live Search 1.0.5 · audited by WP Registry

High-severity findings.

1 high 1 low
Audited release
1.0.5
Findings
2
Worst severity
high
Content hash
4203ec7e7826ff5be37359fc…

Findings

  • high WP_Query argument injection via public live-search REST

    information_disclosure

    GET meom-live-search/v1/search uses permission_callback __return_true and builds args with array_merge($default_args, $_GET). Attackers can pass post_status=private/draft, post_type=, author=, meta_query-like params (via query vars WP_Query accepts) to retrieve non-public content as resultHTML.

    meom-live-search.php:66-98

    Recommendation

    Whitelist allowed query keys (s, paged, posts_per_page, lang); force post_status=publish; never merge raw $_GET into WP_Query.

  • low Unsanitized mls_locale query parameter influences determine_locale

    unsafe_input

    mls_change_locale_for_rest returns $_GET['mls_locale'] unsanitized into determine_locale.

    meom-live-search.php:177-183

    Recommendation

    Sanitize with sanitize_text_field and validate against available locales.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →