Silverback Shortcakes WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.6

Findings

1

Worst severity

medium

Content hash

494fe0fa5dfd1fdb50354842… Copy

Findings

• medium unserialize of base64-decoded GET input in shortcode

  unsafe_input

  Input shortcode reads filter_input(INPUT_GET), base64_decodes, then unserialize()s user-controlled data. Even with esc_html on output, unserialize enables PHP object injection if gadgets exist in the environment.

  src/Forms/Input.php:48-65

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.