WP Manifestindependent plugin directory

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/badabingbreda/easy-uikit/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Easy UIkit is a WordPress plugin that enqueues the UIkit3 library so that it can be used regardless of which theme you're using.

Plugin Description

Easy UIKit adds the UIkit3 library to the asset queue so you can use it even when changing themes. Great for page builders plugins like Beaver Builder. It also includes AlekVolsk's width-ex for extended column support (up to 30 columns).

The CSS and scripts are also loaded on the dashboard, so that you can use them in the Gutenberg Editor as well. Ideal for your occasional blocks development using popular block frameworks like ACF Pro or Meta Box.


Disabling Backend CSS

If you do not need them loaded on the backend, you can dequeue the action:

remove_action( 'admin_enqueue_scripts', 'easy_uikit_admin_enqueue', 100, 1 );

or by adding a constant

define( 'EASYUIKIT_ADMIN_ENQUEUE' , false );


More info

More info on UIKit here: https://getuikit.com

UIkit-ex Thanks AlekVolsk


Beaver Builder Flex Modules

Since version 1.4.0 you can also use flexbox inside Beaver Builder Columns. Currently support for uk-child-width-1-x is up to 6 columns, however, individual modules may use any supported uk-width-1-x that is supported.

Column class Module class
uk-flex uk-flex-1
uk-flex-none
uk-flex-auto

SVG Background shapes

Row background shapes (SVG's) and Row Shape Effects (UABB addon) have been improved and are working as expected.


Current UIkit version

Current version is v3.23.11 ( released Jun 25th, 2025 )


CHANGELOG

v.2.0.3 Update to UIkit 3.23.11 Update github updater class for enhanced errors handling

v.2.0.2 Updated to UIkit 3.15.24.

v.2.0.1 Fixed release info

v.2.0.0 Updated to UIkit 3.15.19. Updated plugin to autoloader Made changes to GithubUpdater to allow for tested check, icons and banners

v.1.8.0 Updated to UIkit 3.11.1.

v.1.7.0 Updated to UIkit 3.10.1.

v.1.6.0 Updated to UIkit 3.6.18, removed Base theme settings (font settings for uk-h1 etcetera). Reduced supported columns to 12, uncompressed CSS file reduced 30% in size.

v.1.5.0 Updated to UIkit 3.5.4

v.1.4.3 (January 13th, 2020) Fixed URL path for enqueued js and css files

v.1.4.2 (December 11th, 2019) Removed resetting svg height, seemed to still interfere with row-shapes.

v.1.4.1 (December 5th, 2019) Fixed row background-shapes and UABB row-effect not showing the SVG shapes correctly.

v.1.4.0 (November 25th, 2019) Updated UIkit to version 3.2.2. Added extra CSS-styling in components/lightbox.less to fix close button moving away on hover. Tweaked svg positioning; reset .fl-builder-edit svg {} to initial so that the interface aligns correctly.

Added uk-flex support for Beaver Builder columns. Use all default UIkit classes in a column to control the modules added inside the column as the flex-items. Works up to 6 columns using uk-child-width-1-6@ and uk-width-1-6 classes.

1.3.2 (July 30th, 2019) Fixed to show correct UIkit version (3.1.6) in plugin's description Removed CSS font-family style from uk-h1 through uk-h6, uk-heading-*

1.3.1 (July 20th, 2019) Minor update for SVG borders not handling well in Beaver Builder

1.3.0 (July 20th, 2019)

Updated to version 3.1.6 Removed re-styling of base html-tags Updated Github Updater Class to fix error-notices

1.2.0 (May 14th, 2019)

Updated to version 3.1.4

1.1.2 (April 6th, 2019)

Bugfix: added Images folder, which contain SVG icons

1.1.1 (April 5th, 2019)

Initial commit

Releases

15 releases.

Tag
Published
2.0.3 latest
Jan 10, 2026 9mo ago
Feb 15, 2023 3 years ago
Jan 8, 2023 3 years ago
Jan 8, 2023 3 years ago
Feb 15, 2022 4 years ago
Jan 19, 2022 4 years ago
Mar 28, 2021 5 years ago
Jan 13, 2020 6 years ago
Dec 5, 2019 6 years ago
Jul 30, 2019 7 years ago
Jul 20, 2019 7 years ago
Jul 20, 2019 7 years ago
May 14, 2019 7 years ago
Apr 6, 2019 7 years ago
Apr 6, 2019 7 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

Easy UIkit 2.0.3 · audited by WP Registry

High-severity findings.

1 high
Audited release
2.0.3
Findings
1
Worst severity
high
Content hash
7aee224153f2e7955650b13d…

Findings

  • high Stored XSS via globally enqueued UIkit data-uk-* attributes that survive kses

    xss_stored

    ScriptStyles hooks wp_enqueue_scripts and admin_enqueue_scripts at priority 100 and loads js/uikit.min.js (UIkit 3.23.11) on every front-end and dashboard request. UIkit auto-initializes components from data-uk-* (and uk-*) attributes via MutationObserver. WordPress post kses (_wp_add_global_attributes) allows data-* on all post tags, so Author (publish_posts, no unfiltered_html) and Contributor can store payloads that core will not strip. Confirmed sinks in this bundle: (1) tooltip _show builds `<div class="uk-tooltip-inner">${title}</div>` and parses it with template.innerHTML / append — hover or focus executes <img onerror>; (2) lightbox beforeitemshow calls vt(selCaption, item.caption), and vt() is the html() helper that sets innerHTML from the data-caption string (UIkit issue #5162, still present in 3.23.11; DOMPurify PR #5170 was not in this build); (3) uk-svg fetch()es the img src and inlines SVG. This is the same WordPress wrap as CVE-2026-10077 (YOOtheme Pro Author+ stored XSS via UIkit data attributes). Observable consequence: JS in the origin of any visitor or of an administrator previewing a pending Contributor post, enabling session theft. innerHTML of a <script> tag would not run; these payloads use event handlers, which do.

    inc/Helpers/ScriptStyles.php:8-35

    Recommendation

    Do not treat untrusted post HTML as UIkit component config. Either (a) strip data-uk-* / uk-* attributes from content that passed through kses without unfiltered_html, (b) disable UIkit's auto-boot/MutationObserver on the public front end and only init on a trusted allowlist of theme/builder markup, or (c) fork UIkit so tooltip titles use textContent and lightbox captions are sanitized (DOMPurify / text). Until then, do not enqueue uikit.min.js globally on every page; gate admin enqueue on the documented EASYUIKIT_ADMIN_ENQUEUE constant (the current check compares the misspelled EASUIKIT_ADMIN_ENQUEUE). Upgrade past 3.23.11 when a release actually sanitizes captions.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.