WP Manifestindependent plugin directory
manifest / editor / wp-button-shortcode

Button Shortcode by Pivotal WP RegistryMedium-severity findings · 1 findingOpen the reportB

A Wordpress Plugin for adding a Button Shortcode

by Pivotal Agency · github.com/pvtl/wp-button-shortcode · website

★ 2stars
0.1.4latest · 5 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/pvtl/wp-button-shortcode/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/pvtl/wp-button-shortcode ↗
A Wordpress Plugin for adding Buttons from the editor - Install and activate the plugin - From any WYSIWYG editor in WP, click the new 'Button' button which adds the [button] shortcode to the editor Installing with Composer (if using Bedrock)

Releases

3 releases.

Tag
Published
0.1.4 latest
May 17, 2021 5 years ago
0.1.3
Jan 10, 2019 7 years ago
0.1.2
Jan 10, 2019 7 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Button Shortcode by Pivotal 0.1.3 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
0.1.3
Findings
1
Worst severity
medium
Content hash
5c82ca223e9d366a3102d9ea…

Findings

  • medium Unescaped button shortcode attributes enable stored XSS

    xss_stored

    The [button] shortcode copies text/href/size/style/target/class into HTML without esc_attr/esc_url/esc_html. Content authors can inject javascript: URLs or break out of attributes.

    button-shortcode.php:100-103

    Recommendation

    Escape href with esc_url, other attrs with esc_attr, and text with esc_html.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →