WP Manifestindependent plugin directory
manifest / email / wp-gov-uk-notify

GOV.UK Notify WP RegistryLow-severity findings · 1 findingOpen the reportA-

A WordPress plugin that configures Wordpress to send emails via the GOV.UK Notify Service

by ministryofjustice · github.com/ministryofjustice/wp-gov-uk-notify

★ 2stars
1.0.4latest · 7mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/ministryofjustice/wp-gov-uk-notify/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/ministryofjustice/wp-gov-uk-notify ↗

GOV.UK Notify Wordpress Plugin

A WordPress plugin that configures Wordpress to send emails via the GOV.UK Notify Service.

Required

Installation

This plugin is suitable for loading from the mu-plugins directory.

However, it can be installed in the normal way.

Use the standard method of installing plugins for your site. For example go to Plugins > Add new > Upload Plugin.

Or use if using Composer, run composer require ministryofjustice/wp-gov-uk-notify in the directory where your composer.json file is located. This will install the latest version of this plugin.

Once the plugin folder is in place activate it by going to wp-admin/plugins.php and clicking on the Activate link under GOV.UK Notify.

Settings

You will need to enter both your Gov Notify API Key and Template ID into the plugin settings fields. To get these keys you'll need to log into Gov Notify. You can also ask to be added to an exsiting Gov Notify account.

Releases

5 releases.

Tag
Published
1.0.4 latest
Mar 12, 2026 7mo ago
1.0.3
Dec 3, 2025 11mo ago
1.0.2
Jan 20, 2023 3 years ago
1.0.1
Jan 19, 2023 3 years ago
1.0.0
Jan 19, 2023 3 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

A- grade

Security

GOV.UK Notify 1.0.4 · audited by WP Registry

Low-severity findings only.

1 low
Audited release
1.0.4
Findings
1
Worst severity
low
Content hash
856657e1c8bfba674ba2229c…

Findings

  • low Unescaped settings values in admin input fields

    missing_escaping

    gov_uk_notify_input_field_render() prints the stored API key and template ID with short echo tags directly into value="..." and the field name, without esc_attr(). register_setting('gov_uk_notify_plugin','gov_uk_notify_settings') has no sanitize_callback. A value containing a double quote breaks out of the attribute (stored HTML/JS on the settings page). Only users with manage_options can write the option.

    src/settings.php:53-65

    Recommendation

    Escape with esc_attr() on output, add a sanitize_callback (sanitize_text_field per key), and render the API key as a password field rather than echoing it.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →