Calendar Feed Generator WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.1.0

Findings

1

Worst severity

medium

Content hash

a4fe902cb45f1a0c2c3f3b30… Copy

Findings

• medium Calendar application password stored in plaintext user meta

  insecure_config

  ggl_cf__generate_access_token stores the raw application password in user meta key calendar_password. Any vulnerability or privileged read of usermeta exposes a reusable Application Password credential for that user.

  src/generate.php:23-35

  Recommendation

  Do not persist the plaintext app password; store only the UUID and have users regenerate tokens, or encrypt at rest.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.