Plugin Security Checker
@psc-for-wp.bsky.social
Tool that checks for the possibility of some instances of security issues in WordPress plugins. https://www.pluginvulnerabilities.com/plugin-security-checker/
The tool also identifies other possible security issues in the current version of the plugin. Including repeated missing usage of escaping.
January 24, 2024 at 6:35 PM
The tool also identifies other possible security issues in the current version of the plugin. Including repeated missing usage of escaping.
Echoing directly the result of add_query_arg() shouldn't be happening. developer.wordpress.org/reference/fu...
January 22, 2024 at 11:19 PM
Echoing directly the result of add_query_arg() shouldn't be happening. developer.wordpress.org/reference/fu...
The tool flags multiple possible issues in the latest version of the plugin.
![Possible Issues Detected in Woostify Sites Library:
The plugin may allow arbitrary WordPress options (settings) to be updated based on user input.
[+] Show details
User input looks to be output without being validated, sanitized, or escaped, which could lead to reflected cross-site scripting (XSS).
[+] Show details
The plugin registers one or more AJAX actions to be accessible whether the requester is logged in to WordPress or not. Those registrations should be checked to make sure that they are intended to be accessed by those not logged in.
[+] Show details
This plugin may be vulnerable to host header injection due to use of server variables that can rely on the user specified Host header.
[+] Show details
The output of the add_query_arg() or remove_query_arg() function is being output without escaping it, while the documenation states that it should be escaped.
[+] Show details](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:bz7kuxqy7m7rjzfwj5ipax3b/bafkreib27exncgkcjnds37gppcokc4hccrebml6ptmzntar7fdbygaonmu@jpeg)
January 22, 2024 at 11:15 PM
The tool flags multiple possible issues in the latest version of the plugin.