WP Manifestindependent plugin directory
manifest / media / ucf-video-vtt

UCF Video VTT Tools WP RegistryMedium-severity findings · 1 findingOpen the reportB

A collection of tools for including a descriptive text track for videos in themes.

by UCF Web Communications · github.com/ucf/ucf-video-vtt

★ 1stars
1composer installs
v0.1.1latest · never

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/ucf/ucf-video-vtt/archive/refs/heads/main.zip

On Packagist as ucf/ucf-video-vtt:

composer require ucf/ucf-video-vtt
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/ucf/ucf-video-vtt ↗
UCF Video VTT Tools # Plugin that provides a series of tools for developers to properly enqueue descriptive text tracks for videos (vtt files) for their videos. Description ## The primary goal of this project is to provide a series of tools for including Documentation ## Head over to the UCF Video VTT Tools wiki for detailed information about this plugin, installation instructions, and more. Changelog ## 0.1.1 ### Enhancements: Added composer file. 0.1.0 ### Initial release of the plugin. Includes a field for setting a custom vtt file for a video. Generates a vtt using the video description field if no custom file is provided. Provides an API endpoint that delivers the vtt file. Provides helper classes that will insert the appropriate markup to point to the vtt file. Upgrade Notice ## n/a Development ## Enabling debug mode in your wp-config.php file is recommended during development to help catch warnings and bugs. Requirements ### node v16+ gulp-cli Instructions ### 1. Clone the UCF-Video-VTT repo into your local development environment, within your WordPress installation's plugins/ directory: git clone https://github.com/UCF/UCF-Video-VTT.git 2. cd into the

Releases

2 releases.

Tag
Published
v0.1.1 latest
Mar 22, 2023 3 years ago
v0.1.0
Aug 1, 2022 4 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

UCF Video VTT Tools 0.1.1 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
0.1.1
Findings
1
Worst severity
medium
Content hash
897d601ef4a672b62849f930…

Findings

  • medium REST route uses misspelled permissions_callback so permission_callback is missing

    missing_permission_callback

    register_rest_route registers GET ucf-video-vtt/v1/vtt/{id} with key 'permissions_callback' (plural) set to __return_true. WordPress only recognizes 'permission_callback'. On WP 5.5+ a missing permission_callback triggers doing_it_wrong and denies the route; on older WP the endpoint is public. Intent was public VTT. Separately get_video_vtt_file calls wp_remote_get on ACF field vtt_file (admin-controlled URL) — SSRF if a privileged editor points it at internal URLs — and echoes attachment post_content into the VTT body.

    includes/api.php:75-80

    Recommendation

    Rename to permission_callback. Validate vtt_file URLs against an allowlist before wp_remote_get; escape post_content for VTT context.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →