WP Manifestindependent plugin directory
manifest / events / nuvho-booking-mask-single

Nuvho Booking Mask (Single) WP RegistryMedium-severity findings · 1 findingOpen the reportB

by Odysseus Ambut / Herobe IP Pty Ltd · github.com/odzk/nuvho-booking-mask-single · website

★ 0stars
2.1.6latest · 4mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/odzk/nuvho-booking-mask-single/archive/refs/heads/master.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

Releases

9 releases.

Tag
Published
2.1.6 latest
May 28, 2026 4mo ago
2.1.5
May 3, 2026 5mo ago
2.1.4
Apr 12, 2026 6mo ago
2.1.3
Mar 17, 2026 7mo ago
2.1.2
Mar 12, 2026 7mo ago
2.1.1
Feb 16, 2026 8mo ago
2.1.0
Jan 26, 2026 9mo ago
2.0.2
Nov 14, 2025 11mo ago
2.0.1
May 21, 2025 1 year ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Nuvho Booking Mask (Single) 2.1.6 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
2.1.6
Findings
1
Worst severity
medium
Content hash
5860294f51ad8a0529cffbde…

Findings

  • medium SSRF host check bypass in nuvho_rms_availability proxy

    ssrf

    ajax_rms_availability (wp_ajax_nopriv_) verifies nonce then allows any URL whose host strpos-contains 'rmscloud.com'. Hosts like rmscloud.com.evil.com pass. Attacker with frontend-localized nonce can coerce server-side GET to attacker DNS. Impact limited to SSRF GET + response body to caller.

    admin/class-nuvho-booking-mask-admin.php:529-541

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →