WP Manifestindependent plugin directory
manifest / integrations / gf-hubspot-addon

Hubspot Form Submission Add-On for Gravity Forms WP RegistryHigh-severity findings · 1 findingOpen the reportC-

This plugin works as an add-on for Gravity Forms allowing you to submit any Gravity Form to a duplicate form in Hubspot to automatically sync your submissions.

by TheDevCave · github.com/thedevcave/gf-hubspot-addon · website

★ 0stars
1.1latest · 3 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/thedevcave/gf-hubspot-addon/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/thedevcave/gf-hubspot-addon ↗

This plugin works as an add-on for Gravity Forms allowing you to submit any Gravity Form to a duplicate form in Hubspot to automatically sync your submissions.

NOTE: It is highly recommended that you also have either the official Hubspot WP plugin installed or at least have the Hubspot tracking code installed on your site as well. This will ensure that all of the Hubspot tracking data gets sent over with each submission.

Releases

2 releases.

Tag
Published
1.1 latest
Nov 9, 2022 3 years ago
1.0
Nov 8, 2022 3 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

Hubspot Form Submission Add-On for Gravity Forms 1.1 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.1
Findings
1
Worst severity
high
Content hash
6c5c8d5f2e7e6d9273678914…

Findings

  • high OAuth token store REST route missing permission_callback

    missing_permission_callback

    register_rest_route gf-hs/v1/auth has no permission_callback. Callback exchanges $_GET[code] for tokens via HubspotClientHelper and saves them (OAuth2Helper::saveTokenResponse). Unauthenticated callers who obtain a code can overwrite site HubSpot credentials.

    lib/classes/class-GFHubspotAddOn.php:53-67

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →