WP Manifestindependent plugin directory
manifest / integrations / flexyapress-mw

PB Web - Mindworking WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

★ 0stars
700release downloads
≈20active sites
v1.56latest · 29d ago

Install

Download flexyapress-mw.zip From the v1.56 release on GitHub, Sep 23, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/pbweb-mikkel/flexyapress-mw/releases/download/v1.56/flexyapress-mw.zip
Updates itself. It ships its own updater, so new versions appear under Dashboard → Updates.

Plugin Name

Here is a short description of the plugin. This should be no more than 150 characters. No markup here.

Description

This is the long description. No limit, and you can use Markdown (as well as in the following sections).

For backwards compatibility, if this section is missing, the full length of the short description will be used, and Markdown parsed.

A few notes about the sections above:

  • "Contributors" is a comma separated list of wp.org/wp-plugins.org usernames

  • "Tags" is a comma separated list of tags that apply to the plugin

  • "Requires at least" is the lowest version that the plugin will work on

  • "Tested up to" is the highest version that you've successfully used to test the plugin. Note that it might work on higher versions... this is just the highest one you've verified.

  • Stable tag should indicate the Subversion "tag" of the latest stable version, or "trunk," if you use /trunk/ for stable.

    Note that the readme.txt of the stable tag is the one that is considered the defining one for the plugin, so if the /trunk/readme.txt file says that the stable tag is 4.3, then it is /tags/4.3/readme.txt that'll be used for displaying information about the plugin. In this situation, the only thing considered from the trunk readme.txt is the stable tag pointer. Thus, if you develop in trunk, you can update the trunk readme.txt to reflect changes in your in-development version, without having that information incorrectly disclosed about the current stable version that lacks those changes -- as long as the trunk's readme.txt points to the correct stable tag.

    If no stable tag is provided, it is assumed that trunk is stable, but you should specify "trunk" if that's where you put the stable version, in order to eliminate any doubt.

Installation

This section describes how to install the plugin and get it working.

e.g.

  1. Upload flexyapress.php to the /wp-content/plugins/ directory
  2. Activate the plugin through the 'Plugins' menu in WordPress
  3. Place <?php do_action('plugin_name_hook'); ?> in your templates

Frequently Asked Questions

A question that someone might have

An answer to that question.

What about foo bar?

Answer to foo bar dilemma.

Screenshots

  1. This screen shot description corresponds to screenshot-1.(png|jpg|jpeg|gif). Note that the screenshot is taken from the /assets directory or the directory that contains the stable readme.txt (tags or trunk). Screenshots in the /assets directory take precedence. For example, /assets/screenshot-1.png would win over /tags/4.3/screenshot-1.png (or jpg, jpeg, gif).
  2. This is the second screen shot

Changelog

1.0

  • A change since the previous version.
  • Another change.

0.5

  • List versions from most recent at top to oldest at bottom.

Upgrade Notice

1.0

Upgrade notices describe the reason a user should upgrade. No more than 300 characters.

0.5

This version fixes a security related bug. Upgrade immediately.

Arbitrary section

You may provide arbitrary sections, in the same format as the ones above. This may be of use for extremely complicated plugins where more information needs to be conveyed that doesn't fit into the categories of "description" or "installation." Arbitrary sections will be shown below the built-in sections outlined above.

A brief Markdown Example

Ordered list:

  1. Some feature
  2. Another feature
  3. Something else about the plugin

Unordered list:

  • something
  • something else
  • third thing

Here's a link to WordPress and one to Markdown's Syntax Documentation. Titles are optional, naturally.

        "Markdown is what the parser uses to process much of the readme file"

Markdown uses email style notation for blockquotes and I've been told:

Asterisks for emphasis. Double it up for strong.

<?php code(); // goes in backticks ?>

Releases

Newest 25 of 52 recorded releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.56 latest
Sep 23, 2026 29d ago
flexyapress-mw.zip
13
Mar 23, 2026 7mo ago
flexyapress-mw.zip
2
Feb 27, 2025 1 year ago
flexyapress-mw.zip
15
Sep 9, 2024 2 years ago
flexyapress-mw.zip
16
Jun 7, 2024 2 years ago
flexyapress-mw.zip
15
May 27, 2024 2 years ago
flexyapress-mw.zip
194
Apr 10, 2024 2 years ago
flexyapress-mw.zip
16
Mar 7, 2024 2 years ago
flexyapress-mw.zip
16
Feb 29, 2024 2 years ago
flexyapress-mw.zip
12
Feb 1, 2024 2 years ago
flexyapress-mw.zip
15
Feb 1, 2024 2 years ago
flexyapress-mw.zip
7
Dec 11, 2023 2 years ago
flexyapress-mw.zip
12
Oct 12, 2023 3 years ago
flexyapress-mw.zip
11
Sep 25, 2023 3 years ago
flexyapress-mw.zip
14
Aug 29, 2023 3 years ago
flexyapress-mw.zip
10
Aug 29, 2023 3 years ago
flexyapress-mw.zip
2
Jul 27, 2023 3 years ago
flexyapress-mw.zip
14
May 31, 2023 3 years ago
flexyapress-mw.zip
12
Apr 3, 2023 3 years ago
flexyapress-mw.zip
11
Mar 28, 2023 3 years ago
flexyapress-mw.zip
6
Mar 28, 2023 3 years ago
flexyapress-mw.zip
3
Mar 28, 2023 3 years ago
flexyapress-mw.zip
7
Mar 6, 2023 3 years ago
flexyapress-mw.zip
13
Mar 1, 2023 3 years ago
flexyapress-mw.zip
14
Mar 1, 2023 3 years ago
flexyapress-mw.zip
7
All releases on GitHub →

Active-site estimate ≈20 comes from the median of recent superseded releases. Method.

D+ grade

Security

PB Web - Mindworking 1.56 · audited by WP Registry

High-severity findings.

2 high 1 low
Audited release
1.56
Findings
3
Worst severity
high
Content hash
f9dae1abe533de1cc3779452…

Findings

  • high Unauthenticated reflected XSS in property search template

    xss_reflected

    templates/property/property-search.php (property search shortcode) prints $_GET['minPrice'] and $_GET['maxPrice'] into data-price-*-selected attributes, and $_GET['q'] into the value attribute of the search input, with no esc_attr. The form action also echoes HTTP_HOST/REQUEST_URI without escaping. Magic quotes add backslashes, but backslashes do not escape double quotes in HTML, so a link like ?q=" autofocus onfocus=... x=" breaks out of the attribute and runs script in the site origin for any visitor who clicks it, including logged-in administrators.

    templates/property/property-search.php:48, 55, 61

    Recommendation

    Wrap every reflected value in esc_attr(wp_unslash(...)) and build the form action with esc_url(home_url(add_query_arg(null,null))).

  • high Hardcoded shared key lets anyone trigger imports and wipe case images

    hardcoded_credentials

    Flexyapress_Public runs Flexyapress_Import::import_cases($force,$debug) on frontend requests whenever ?flexya_update is set and $_GET['key'] == 'sd5d2rf16'. The key is hardcoded and identical in every install (it also appears in admin links). The import reads $_GET['clear-images'] / $_GET['force-images'] and deletes the featured image of every case before downloading it again, and debug mode echoes internal import output. An unauthenticated attacker can repeatedly trigger full API imports (resource exhaustion, API quota use), destroy media attachments, and read debug output. The same key exposes generate_facebook_catalog.

    public/class-flexyapress-public.php:71-93

    Recommendation

    Remove the hardcoded key. Run imports via WP-Cron/WP-CLI, or an admin-only action protected by current_user_can('manage_options') and a nonce, or a per-site random secret compared with hash_equals.

  • low admin_post image deletion without capability check and open redirect

    missing_capability

    pb_case_delete_images (admin_post action) checks only a nonce, not a capability, before deleting all images of an arbitrary post_id. It then redirects to the attacker-supplied $_POST['_wp_http_referer'] with a raw header(). Exploiting it needs a logged-in user with a valid nonce, which is only rendered on the admin case edit screen.

    admin/class-flexyapress-admin.php:160-170

    Recommendation

    Add current_user_can('edit_post', $id) and use wp_safe_redirect(wp_get_referer()).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.