P

Plugin Security Checker

@psc-for-wp.bsky.social

5 Followers 0 Following

Tool that checks for the possibility of some instances of security issues in WordPress plugins. https://www.pluginvulnerabilities.com/plugin-security-checker/

The output of the add_query_arg() or remove_query_arg() function is being output without escaping it, while the documenation states that it should be escaped. File: /estatik/templates/admin/settings/tabs/auth-tab.php Code: <li><?php echo add_query_arg( 'auth_network', 'facebook-login-buttons', site_url( '/' ) ); ?></li> File: /estatik/templates/admin/settings/tabs/auth-tab.php Code: <li><?php echo add_query_arg( 'auth_network', 'facebook-buyer-register-buttons', site_url( '/' ) ); ?></li> File: /estatik/templates/admin/settings/tabs/auth-tab.php Code: <li><?php echo add_query_arg( 'auth_network', 'google-login-buttons', site_url( '/' ) ); ?></li> File: /estatik/templates/admin/settings/tabs/auth-tab.php Code: <li><?php echo add_query_arg( 'auth_network', 'google-buyer-register-buttons', site_url( '/' ) ); ?></li>
The output of the add_query_arg() or remove_query_arg() function is being output without escaping it, while the documenation states that it should be escaped. File: /vendor/appsero/client/src/License.php Code: echo add_query_arg( [-] Hide details
Possible Issues Detected in Woostify Sites Library: The plugin may allow arbitrary WordPress options (settings) to be updated based on user input. [+] Show details User input looks to be output without being validated, sanitized, or escaped, which could lead to reflected cross-site scripting (XSS). [+] Show details The plugin registers one or more AJAX actions to be accessible whether the requester is logged in to WordPress or not. Those registrations should be checked to make sure that they are intended to be accessed by those not logged in. [+] Show details This plugin may be vulnerable to host header injection due to use of server variables that can rely on the user specified Host header. [+] Show details The output of the add_query_arg() or remove_query_arg() function is being output without escaping it, while the documenation states that it should be escaped. [+] Show details