WP Manifestindependent plugin directory
manifest / social / yelp-widget-premium

Yelp Widget Premium WP RegistryMedium-severity findings · 1 findingOpen the reportB

Easily display Yelp business reviews and ratings with a simple and intuitive WordPress, block, widget, and shortcode.

by WordImpress · github.com/stellarwp-sunset/yelp-widget-premium · website

★ 0stars
2.0.0latest · 8 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/stellarwp-sunset/yelp-widget-premium/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/stellarwp-sunset/yelp-widget-premium ↗

Easily display Yelp business reviews and ratings with a simple and intuitive WordPress widget and shortcode.

Releases

2 releases.

Tag
Published
2.0.0 latest
Dec 21, 2017 8 years ago
1.9.5
Apr 27, 2017 9 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Yelp Widget Premium 2.0.0 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
2.0.0
Findings
1
Worst severity
medium
Content hash
be4e882f91e68d403f2d63df…

Findings

  • medium Logged-in AJAX can delete arbitrary transients

    missing_auth

    ywp_clear_widget_cache is hooked to wp_ajax_clear_widget_cache with no check_ajax_referer and no current_user_can. Any authenticated user can delete_transient on an attacker-chosen transient_id (cache DoS / force re-fetch of other plugins' data).

    includes/widget-main.php:35-46

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →