nCorePlat API WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

0.1.5

Findings

2

Worst severity

high

Content hash

c01d8e9afb7b40c3c4c67f66… Copy

Findings

• high Unauthenticated shortcode injection / XSS via get_shortcode_ncore_plat_api_content

  wp_ajax_nopriv_get_shortcode_ncore_plat_api_content concatenates every $_POST key/value into a [ncoreplat-api ...] shortcode string without sanitization, runs do_shortcode, and echoes the HTML. No nonce or capability check. Attacker-controlled attribute values can break out (e.g. "][other_shortcode]") to invoke arbitrary registered shortcodes. Frontend nCorePlat-api.js inserts the response with jQuery.replaceWith(), which parses HTML and can execute scripts — reflected XSS for visitors who trigger the AJAX path, and stored impact if injected shortcodes persist content.

  inc/shortcode_functions.php:6-24

• medium Open redirect via nCoreUrl query parameter

  Frontend JS base64-decodes the nCoreUrl query parameter and calls window.location.replace(decoded) with no allowlist — unauthenticated open redirect.

  inc/js/nCorePlat-api.js:39-42

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.