WP Manifestindependent plugin directory
manifest / integrations / db-wp-plugin

MF Datablocks WP Widget WP RegistryHigh-severity findings · 1 findingOpen the reportC-

A wordpress plugin for MFN integrations

by Alexander Forrest // Modular Finance · github.com/modfin/db-wp-plugin · website

★ 0stars
272release downloads
≈20active sites
4.5kcomposer installs
v0.0.10latest · 3 years ago

Install

Download db-wp-plugin-v0.0.10.zip From the v0.0.10 release on GitHub, Dec 7, 2022

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/modfin/db-wp-plugin/releases/download/v0.0.10/db-wp-plugin-v0.0.10.zip

On Packagist as modfin/db-wp-plugin:

composer require modfin/db-wp-plugin
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/modfin/db-wp-plugin ↗

Datablocks Wordpress plugin

Releases can be found at https://github.com/modfin/db-wp-plugin/releases for manual installation

or

composer require modfin/db-wp-plugin

Releases

10 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v0.0.10 latest
Dec 7, 2022 3 years ago
db-wp-plugin-v0.0.10.zip
167
v0.0.9
Mar 18, 2022 4 years ago
db-wp-plugin-v0.0.9.zip
37
v0.0.8
Oct 11, 2021 5 years ago
db-wp-plugin-0.0.8.zip
24
v0.0.7
Oct 8, 2021 5 years ago
db-wp-plugin-0.0.7.zip
7
v0.0.6
Jun 2, 2021 5 years ago
db-wp-plugin-0.0.6.zip
25
v0.0.5
May 12, 2021 5 years ago
db-wp-plugin-0.0.5.zip
12
v0.0.4
Feb 4, 2020 6 years ago
tag only
—
v0.0.3
Jan 27, 2020 6 years ago
tag only
—
v0.0.2
Jan 24, 2020 6 years ago
tag only
—
v0.0.1
Jan 24, 2020 6 years ago
tag only
—

Active-site estimate ≈20 comes from the median of recent superseded releases. Method.

C- grade

Security

MF Datablocks WP Widget 0.0.10 · audited by WP Registry

High-severity findings.

1 high
Audited release
0.0.10
Findings
1
Worst severity
high
Content hash
0c83214fd1002ff430907358…

Findings

  • high Stored XSS via mfdb_widget shortcode type and classname attributes

    xss_stored

    load_shortcode_widget() passes shortcode atts straight to the_widget('DB_WP_Widget', $atts), which calls widget() without running update() (the only strip_tags sanitizer). widget() then builds $elementId = 'widget-' . $type . '-' . mt_rand() and $widget->class = "class='" . $classname . "'" and echoes <div id='$elementId'$class></div> with no esc_attr/esc_html. Title is also echoed raw. Authors and Contributors lack unfiltered_html, but they do not need raw ' or <>: a payload such as [mfdb_widget type="x' style='position:fixed;inset:0' onpointerenter='alert(document.domain)"] survives wp_kses_post (entities, no tags). Core shortcode_parse_atts() does not html_entity_decode, so the entities reach the HTML. The browser then decodes ' inside the single-quoted id/class attributes, breaking out into a new attribute. The resulting full-viewport onpointerenter handler executes in any visitor or previewing administrator. The same breakout works with classname. Widget Appearance saves are limited to edit_theme_options and are a weaker copy of the same sink; the shortcode is the below-admin path.

    db-wp-plugin.php:85-107,231-239

    Recommendation

    Escape every instance field on output: esc_attr() for id/class/attribute context, esc_html() for the title, and wp_json_encode($widget, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT) (or esc_js) for the inline script. Run shortcode atts through shortcode_atts() plus sanitize_text_field/sanitize_html_class before the_widget(). Keep Widget::update() sanitization but do not rely on it for the shortcode path.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →