WP Manifestindependent plugin directory

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/benjaminmedia/wp-bcm-manager/archive/refs/heads/master.zip

On Packagist as benjaminmedia/wp-bcm-manager:

composer require benjaminmedia/wp-bcm-manager
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Wordpress bcm manager plugin

When installed it will create a BCM settings page where custom values can be set.

In order to generate the following meta tags this plugin must be enabled from the settings page.

Meta tags present

  • bcm-type - required - can be set in settings page
  • bcm-country - required - this will be fetched automatically
  • bcm-brand - required - can be set in settings page
  • bcm-sub - optional - can be set in settings page
  • bcm-tablet-breakpoint - optional - can be set in settings page
  • bcm-mobile-breakpoint - optional - can be set in settings page
  • bcm-title - automatically fetched on article page and overwritten by filter wp_bcm_set_title
  • bcm-content-type - this will be fetched automatically and corresponds to get_fields(get_post()->ID)['kind']
  • bcm-categories - automatically fetched on article page and overwritten by filter wp_bcm_set_categories
  • bcm-tags - automatically fetched on article page and overwritten by filter wp_bcm_set_tags
  • bcm-advertorial-type - this will be fetched automatically and corresponds to get_fields(get_post()->ID)['commercial_type']
  • bcm-advertorial-label - this will be fetched automatically and corresponds to pll__(get_fields(get_post()->ID)['commercial_type'])

Note: The 'commercial_type' field values are presumed to have been registered as string translations.

Inclusion script

The javascript code will be inserted at wp_footer action and it looks like: ``, where all the placeholders will be replaced by correct ones from above listing.

Country code

This will be fetched from polylang plugin by looking at the current language code and fetching the proper country code. If that is not possible then it will be fetched from current wordpress locale.

Worpress filters available

  • __wp_bcm_set_title__

    add_filter('wp_bcm_set_title', function($strTitle) {
      // tamper title
      return $strTitle;
    });
  • __wp_bcm_set_categories__

    add_filter('wp_bcm_set_categories', function($arrCategories) {
      // tamper with categories
      return $arrCategories;
    });
  • __wp_bcm_set_tags__

    add_filter('wp_bcm_set_tags', function($arrTags) {
      // tamper with tags
      return $arrTags;
    });
  • wp_bcm_set_content_type

    add_filter('wp_bcm_set_content_type', function($strContentType) {
      // tamper content type
      return $strContentType;
    });
  • wp_bcm_set_advertorial_type

    add_filter('wp_bcm_set_advertorial_type', function($arrTags) {
      // tamper advertorial type
      return $arrTags;
    });

Releases

8 releases.

Tag
Published
1.1.6 latest
Apr 23, 2021 5 years ago
Jun 22, 2018 8 years ago
May 7, 2018 8 years ago
May 3, 2018 8 years ago
Apr 23, 2018 8 years ago
Jun 13, 2017 9 years ago
Jun 12, 2017 9 years ago
Jun 9, 2017 9 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

WP BCM Manager 1.1.6 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.1.6
Findings
1
Worst severity
medium
Content hash
b38e455ee60131bff58f6a92…

Findings

  • medium Unescaped post title/taxonomy names in BCM meta tags (stored XSS)

    xss_stored

    MetaTag::write_meta_tags concatenates $strKey and $strValue into HTML meta tags without esc_attr. Values include get_bcm_title() (raw $post->post_title) and category/tag names. An Author/Contributor who can set a malicious post title or term name can break out of the content attribute and achieve stored XSS on the frontend for all visitors. Admin settings fields are sanitized, but post-derived values are not escaped at echo time.

    src/Bonnier/BCM/Services/MetaTag.php:132-135,185-191

    Recommendation

    Escape both attribute name and value with esc_attr() (and consider esc_html for safety). Prefer allowlisting bcm-* keys.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.