Live chat Stream WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.0.4

Findings

1

Worst severity

high

Content hash

21a2cda7b0a51679b7debdab… Copy

Findings

• high Unauthenticated comment posting via nopriv AJAX without nonce

  missing_auth

  wp_ajax_nopriv_pbd_event_stream_add_comment inserts comments from $_POST without nonce, capability, or login requirement (user_id = get_current_user_id() which is 0). Bypasses normal comment controls; spam/XSS stored if comments rendered.

  includes/class-live-chat-stream-loader.php:240-249

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.