WP Manifestindependent plugin directory
manifest / integrations / objectiv-google-maps

Objectiv Google Maps WP RegistryMedium-severity findings · 2 findingsOpen the reportB

Searchable Google Map for WordPress

by Objectiv, Matthew Sigley · github.com/objectivco/objectiv-google-maps · website

★ 1stars
v1.1latest · 9 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/objectivco/objectiv-google-maps/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/objectivco/objectiv-google-maps ↗
Objectiv Google Maps Welcome to Objectiv's Google Maps plugin. We often need to display an interactive google map that displays markers for a client's list of locations. It can be quite a pain, so we created this plugin to help speed up the process when creating searchable maps. Objectiv Google Maps will automatically pull from a selected post type and display the locations on a google map via shortcode. Users can search for locations by city using Google's autocomplete library. If you would like to learn more or have questions you can get in touch with us at @objectivco.

Releases

2 releases.

Tag
Published
v1.1 latest
Feb 13, 2017 9 years ago
v1.0
Jan 23, 2017 9 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Objectiv Google Maps 1.1 · audited by WP Registry

Medium-severity findings.

1 medium 1 low
Audited release
1.1
Findings
2
Worst severity
medium
Content hash
8a2d28176f3024e1a07b19f1…

Findings

  • medium Location metabox save does not verify nonce

    missing_nonce

    save_metabox and save_location_lat_long update obj_google_address / lat/lng from $_POST without checking obj_google_address_nonce or current_user_can for the post. A crafted save_post request context or compromised lower-priv editor flow can write location meta.

    includes/class-obj-admin.php:114-157

    Recommendation

    Verify wp_verify_nonce( $_POST['obj_google_address_nonce'], ... ) and current_user_can('edit_post', $post_id) before updating meta.

  • low Geocoding request uses http:// to Google Maps API

    insecure_config

    Address geocoding uses an unencrypted http://maps.googleapis.com URL, exposing addresses and enabling response tampering on hostile networks.

    includes/class-obj-admin.php:124-128

    Recommendation

    Use https:// and a valid API key; validate JSON before storing coordinates.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →