WP Manifestindependent plugin directory
manifest / developer / ns-basics

Nightshift Basics WP RegistryMedium-severity findings · 2 findingsOpen the reportB

The framework essential for all themes and plugins built by NightShift Creative.

by Nightshift Creative · github.com/nightshiftcreative/ns-basics · website

★ 0stars
1.0.8latest · 4 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/nightshiftcreative/ns-basics/archive/refs/heads/master.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.
Readme github.com/nightshiftcreative/ns-basics ↗

Welcome to NS Basics

NS Basics is a WordPress framework used by all themes and plugins created by Nightshift Creative.

Installation and Docs

For detailed information on installing and using NS Basics, please see the knowledge base

Support

Please do not request support here. Instead use our ticket system here

Releases

9 releases.

Tag
Published
1.0.8 latest
Dec 23, 2021 4 years ago
1.0.7
Mar 26, 2021 5 years ago
1.0.6
Oct 7, 2020 6 years ago
1.0.5
Jul 26, 2020 6 years ago
1.0.4
Apr 30, 2020 6 years ago
1.0.3
Apr 9, 2020 6 years ago
1.0.2
Mar 29, 2020 6 years ago
1.0.1
Feb 13, 2020 6 years ago
1.0.0
Jan 30, 2020 6 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Nightshift Basics 1.0.8 · audited by WP Registry

Medium-severity findings.

1 medium 1 low
Audited release
1.0.8
Findings
2
Worst severity
medium
Content hash
01d0d08e4868b44ee673177f…

Findings

  • medium Frontend profile update does not verify nonce

    csrf

    edit_profile.php outputs wp_nonce_field('update-user') but the POST handler never calls wp_verify_nonce. A logged-in victim can be CSRF'd to change email/password/avatar via the ns_edit_profile shortcode form.

    includes/templates/edit_profile.php:18-72

  • low Unauthenticated AJAX alt-text lookup without nonce

    missing_nonce

    ns_basics_auto_img_alts is registered for both priv and nopriv AJAX with no nonce or capability check. It accepts image_url from $_REQUEST and echoes attachment alt text. Impact is limited (public media metadata) but the endpoint is an unnecessary unauthenticated surface.

    includes/global-functions.php:31-50

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →