WP Manifestindependent plugin directory
manifest / integrations / slotslaunch-wp-embeds

Slots Launch Embeds WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

Tiny WordPress plugin to use slotslaunch.com direct embeds

★ 0stars
1.0.2latest · 1mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/slotslaunch/slotslaunch-wp-embeds/archive/refs/heads/main.zip
Updates itself. It ships its own updater (Update URI header), so new versions appear under Dashboard → Updates.

Slots Launch Embeds (WordPress)

Lightweight WordPress plugin for signed Slots Launch game embeds. Install, add your API credentials, paste a shortcode — no game sync, no custom code.

Repository: github.com/slotslaunch/slotslaunch-wp-embeds

For full game sync, rankings, and advanced features, use the main Slots Launch WordPress plugin.

Install

  1. Download a release (includes vendor/), or clone and run composer install --no-dev.
  2. Upload to wp-content/plugins/slotslaunch-wp-embeds/ and activate.
  3. Go to Settings → Slots Launch Embeds.
  4. Enter your API key and API secret from Launch Pad → API.

Shortcode

[slotslaunch_game id="45958"]

Optional attributes:

[slotslaunch_game id="45958" height="600" width="100%" autoload="false"]

Set autoload="false" to output the embed container without loading the game until the visitor clicks play. See docs/click-to-load.md.

Alias: [slotslaunch id="45958"]

Game IDs are shown in Launch Pad. You can also use Copy Shortcode on any game page.

wp-config.php (optional)

define('SLOTSLAUNCH_API_KEY', 'your-api-key');
define('SLOTSLAUNCH_API_SECRET', 'your-api-secret');
define('SLOTSLAUNCH_SITE_DOMAIN', 'yourdomain.com');

Constants override saved settings. The API secret must never appear in theme files or front-end JavaScript.

How it works

The shortcode outputs a placeholder. JavaScript calls WordPress admin-ajax.php, PHP signs a fresh iframe URL, and the game loads. Works with full-page cache plugins because exp and sig are not stored in cached HTML.

Uses slotslaunch-php on the server. Your API secret never leaves PHP.

Deadline

Signed embeds are required from November 15, 2026. This plugin signs URLs automatically once configured.

Releases

2 releases.

Tag
Published
1.0.2 latest
Aug 27, 2026 1mo ago
Aug 27, 2026 1mo ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

Slots Launch Embeds 1.0.2 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.0.2
Findings
1
Worst severity
high
Content hash
bc49886ec5ffdbbb7ce5c7ff…

Findings

  • high Unauthenticated embed AJAX discloses SlotsLaunch API key in iframe URL

    information_disclosure

    wp_ajax_nopriv_slotslaunch_embed_url is registered for anonymous users. check_ajax_referer only validates a nonce that Assets::registerScript() localizes into slotslaunchEmbeds for any page that enqueues the embed script (shortcode/block). embedUrl() then returns client->iframeUrl($gameId), and Client::iframeUrl() concatenates the raw API key into the query string as token=. Any visitor who can load a page with the embed (or otherwise obtain the public nonce) receives the site's SlotsLaunch API key in the JSON response. The HMAC sig uses apiSecret (not returned), but the API key itself is a credential and should never be sent to browsers.

    includes/class-ajax.php:13-35

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.