WP Manifestindependent plugin directory
manifest / integrations / wp-xowl-client

Xowl Service WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Xowl client for WordPress for semantic named entity recognition

★ 6stars
0.4latest · never

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/ximdex/wp-xowl-client/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Xowl Service client for WordPress

This WordPress plugin adds to your default editor (TinyMCE) the ability to detect semantic entities on your post content and link them to their official wikipedia page for further reading.

Installing instructions

This plugin works with the latest version of Wordpress (v4.2.2)

You can directly download the source code on its first release here. Install it as any WordPress plugin, that is, unzip it on the wp-content/plugins folder and WordPress itself should recognize it as plugin from its user interface.

You will have to request us an API-Key in our registration page in order to use it. The URL of this register page is provided by the module itself. Once the token has been validated, we can enrich our posts with references to a several semantic entities.

You will find a new icon on your editor's toolbar like this:

Tag icon

By clicking on this icon the plugin will send your content to our Xowl Service's API and will add entities of different types (rendered with different colors) depending on its type. If there are multiple references to a single entity, we can disambiguate choosing the proper one that best suits with our context.

When you save and publish the post, the entities will be translated into their links to their official wikipedia pages where the visitor could find more useful information about each of them.

Screenshots

For example, enhancing some post about Radiohead: Enhancing your post content

And selecting the proper entity for the entity United Kingdom: Selecting the proper entity

Finally, your published post looks like something like this: Published post

Releases

4 releases.

Tag
Published
0.4 latest
Jul 15, 2015 11 years ago
0.3
Jul 14, 2015 11 years ago
0.2
Jun 26, 2015 11 years ago
0.1
Jun 17, 2015 11 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Xowl Service 0.1 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
0.1
Findings
1
Worst severity
medium
Content hash
22839b441a392b45025ed471…

Findings

  • medium Options update without CSRF nonce

    csrf

    XowlClient::display_page calls updateVar() which writes $_POST['xowl_endpoint'] and $_POST['xowl_apikey'] via update_option with no check_admin_referer/wp_nonce_field. An attacker can CSRF a logged-in admin into changing the API endpoint/key.

    inc/XowlClient.php:105-118

    Recommendation

    Add wp_nonce_field to the form and verify with check_admin_referer before updating options; sanitize with esc_url_raw/sanitize_text_field.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.