WP Manifestindependent plugin directory
manifest / media / azrcrv-floating-featured-image

Floating Featured Image WP RegistryHigh-severity findings · 2 findingsOpen the reportD+

Floating Featured Image plugin for ClassicPress

by azurecurve · github.com/azurecurve/azrcrv-floating-featured-image · website

★ 2stars
1.6krelease downloads
≈150active sites
v1.2.3latest · 1 year ago

Install

Download azrcrv-floating-featured-image.zip From the v1.2.3 release on GitHub, May 31, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/azurecurve/azrcrv-floating-featured-image/releases/download/v1.2.3/azrcrv-floating-featured-image.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/azurecurve/azrcrv-floating-featured-image ↗

Floating Featured Image

Plugin Banner

Description

[featured-image] shortcode allows a floating featured image to be placed at the top of a post or page.

Featured Images are added as a custom post type; iamges can be linked to a category, tag or using a custom link.

This plugin is multisite compatible; each site will need settings to be configured in the admin dashboard.

Installation Instructions

  • Download the latest release of the plugin from GitHub.
  • Upload the entire zip file using the Plugins upload function in your ClassicPress admin panel.
  • Activate the plugin.
  • Configure relevant settings via the configuration page in the admin control panel (azurecurve menu).

About azurecurve

azurecurve was one of the first plugin developers to start developing for Classicpress; all plugins are available from azurecurve Development and are integrated with the Update Manager plugin for fully integrated, no hassle, updates.

The other plugins available from azurecurve are:

Releases

11 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.2.3 latest
May 31, 2025 1 year ago
azrcrv-floating-featured-image.zip
174
v1.2.2
Feb 3, 2024 2 years ago
azrcrv-floating-featured-image.zip
1,052
v1.2.1
Feb 4, 2023 3 years ago
azrcrv-floating-featured-image.zip
174
v1.2.0
Oct 29, 2020 6 years ago
azrcrv-floating-featured-image.zip
146
v1.1.4
Apr 5, 2020 6 years ago
azrcrv-floating-featured-image.zip
8
v1.1.3
Apr 4, 2020 6 years ago
azrcrv-floating-featured-image.zip
4
v1.1.2
Mar 29, 2020 6 years ago
azrcrv-floating-featured-image.zip
6
v1.1.1
Feb 3, 2020 6 years ago
azrcrv-floating-featured-image.zip
5
v1.1.0
Jan 28, 2020 6 years ago
azrcrv-floating-featured-image.zip
7
v1.0.1
Jan 7, 2020 6 years ago
azrcrv-floating-featured-image.zip
8
v1.0.0
Mar 31, 2019 7 years ago
azrcrv-floating-featured-image.zip
4

Active-site estimate ≈150 comes from the median of recent superseded releases. Method.

D+ grade

Security

Floating Featured Image 1.2.3 · audited by WP Registry

High-severity findings.

1 high 1 low
Audited release
1.2.3
Findings
2
Worst severity
high
Content hash
b99f222a3cbd21b44e32f42b…

Findings

  • high Reflected XSS via unescaped id parameter on Images admin page

    xss_reflected

    azrcrv_ffi_list_images() reads $_GET['id'] when ?edit is present and echoes it verbatim into a hidden input's value attribute. An attacker who lures a logged-in administrator to /wp-admin/admin.php?page=azrcrv-ffi-list&edit&id="><svg onload=...> gets JavaScript execution in the admin context (wp_magic_quotes inserts a backslash before the quote, which has no meaning in HTML, so the attribute still breaks out). The id is cast only inside $wpdb->prepare for the lookup, not for output.

    azrcrv-floating-featured-image.php:509-536

    Recommendation

    Use $id = absint( $_GET['id'] ) and echo esc_attr( $id ).

  • low Bundled update client falls back to plain HTTP for update metadata

    insecure_config

    The bundled Code Potent UpdateClient posts to the update server over HTTPS but retries over plain HTTP on any transport error; the response supplies update package metadata, so a network-positioned attacker could serve a malicious package URL.

    libraries/updateclient/UpdateClient.class.php:664-677

    Recommendation

    Remove the HTTP fallback; require HTTPS for update checks.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →