WP Manifestindependent plugin directory
manifest / integrations / wp-volunteer-plus

WP Volunteer Plus WP RegistryMedium-severity findings · 1 findingOpen the reportB

by Simon Maddox · github.com/smadds/wp-volunteer-plus · website

★ 0stars
1.0.7latest · 8 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/smadds/wp-volunteer-plus/archive/refs/heads/master.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.
Readme github.com/smadds/wp-volunteer-plus ↗

Volunteer Plus Plugin

WP Volunteer Plus

Contributors: Simon Maddox Tags: comments, spam Requires at least: 4.6 Tested up to: 4.7 Stable tag: 4.1 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html

A selection of tools for integrating Pipe Media's Volunteer Plus Database into WordPress.

Description

Coming later....

Releases

Newest 25 of 29 recorded releases.

Tag
Published
1.1.1
Oct 21, 2018 8 years ago
1.1.0
Oct 20, 2018 8 years ago
1.0.9
May 17, 2018 8 years ago
1.0.8
May 11, 2018 8 years ago
1.0.7 latest
Feb 28, 2018 8 years ago
1.0.6
Feb 3, 2018 8 years ago
1.0.5
Feb 2, 2018 8 years ago
1.0.4
Jan 31, 2018 8 years ago
1.0.3
Jan 30, 2018 8 years ago
1.0.2
Jan 30, 2018 8 years ago
1.0.1
Jan 30, 2018 8 years ago
1.0.0
Jan 29, 2018 8 years ago
0.4.16
Jan 26, 2018 8 years ago
0.4.15
Jan 26, 2018 8 years ago
0.4.14
Jan 26, 2018 8 years ago
0.4.13
Jan 24, 2018 8 years ago
0.4.12
Jan 8, 2018 8 years ago
0.4.11
Jan 8, 2018 8 years ago
0.4.10
Jan 8, 2018 8 years ago
0.4.9
Jan 5, 2018 8 years ago
0.4.8
Jan 5, 2018 8 years ago
0.4.7
Jan 5, 2018 8 years ago
0.4.6
Jan 4, 2018 8 years ago
0.4.5
Jan 3, 2018 8 years ago
0.4.4
Jan 3, 2018 8 years ago
All releases on GitHub →

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

WP Volunteer Plus 1.0.7 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.0.7
Findings
1
Worst severity
medium
Content hash
2d8be2919bba42dd0cbeca85…

Findings

  • medium volplusajaxenquire CSRF — nonce check commented out

    csrf

    wp_ajax_nopriv_volplusajaxenquire → ajax_enquire() has check_ajax_referer commented out. Unauthenticated CSRF can POST interested_notes using victim cookies volplus_user_id / volplus_opp_id to create remote enquiries via Bearer API_KEY.

    includes/volplus_Functions.php:579-597

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →