WP Manifestindependent plugin directory
manifest / content / wp-manual-cu

WordPress Manual Content Units WP RegistryMedium-severity findings · 1 findingOpen the reportB

a plugin that allows you to manually add Specific Content Units to WordPress

by Simon Sessingø, Frederik Rabøl & Alf Henderson · github.com/benjaminmedia/wp-manual-cu · website

★ 1stars
339composer installs
v0.1.3latest · 10 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/benjaminmedia/wp-manual-cu/archive/refs/heads/master.zip

On Packagist as benjaminmedia/wp-manual-cu:

composer require benjaminmedia/wp-manual-cu
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/benjaminmedia/wp-manual-cu ↗

a plugin that allows you to manually add Specific Content Units to WordPress

Customization

change the width of the container (width between the banners)

.bonnier-banner-container.sticky {
width: 930px;
}

change offset from the top:

.bonnier-banner-container.sticky .banner {
top: 700px;
}

To only change offset on the left/right:

.bonnier-banner-container.sticky .left .banner {
   top: 200px;
}

Shortcode

If you want to manually add a banners somewhere, you can use the shortcode.

[banner sticky="true" cu="xxxxxx" offset="" parent-container=""]

sticky = (bool) If set to true, the banner will remain on screen while scrolling

cu = Content Unit number

offset = top Offset in pixels where the banner will start to be sticky (default = calculates the offset itself)

parent-container = jQuery selector element on which the sticky banner will scroll inside

Releases

2 releases.

Tag
Published
v0.1.3 latest
Feb 24, 2016 10 years ago
v0.1.2
Dec 1, 2015 10 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

WordPress Manual Content Units 1.2 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.2
Findings
1
Worst severity
medium
Content hash
75da53e6b0d92deb425571fb…

Findings

  • medium CSRF on ad content-unit settings echoed to frontend scripts

    csrf

    mcu_settings_page() updates options from every $_POST key without verifying a nonce. Those option values (ad CU IDs) are echoed unescaped into frontend JavaScript ad loaders. An attacker can CSRF an administrator into replacing CU IDs, hijacking ad inventory site-wide.

    wp-manual-cu.php:249-259

    Recommendation

    Add wp_nonce_field + check_admin_referer; whitelist option keys; sanitize CU IDs as alphanumeric before save and escape on output.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →