WP Manifestindependent plugin directory
manifest / themes / cherry-plugin

Cherry Plugin WP RegistryHigh-severity findings · 6 findingsOpen the reportD

Сompatibility: Cherry Framework v.3

by Cherry Team · github.com/cherryframework/cherry-plugin · website

★ 8stars
v1.2.8.2latest · 10 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/cherryframework/cherry-plugin/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/cherryframework/cherry-plugin ↗

Cherry Plugin contains all shortcodes and widgets used in Cherry Framework. Also Cherry Framework Import/Export features are also added by Cherry plugin.

v1.2.8.2

  • FIX: [google_map_ap] shortcode

v1.2.8.1

  • FIX: Minor bugfixes

v1.2.8

  • ADD: lightbox attribute to posts_grid, mini_posts_grid, video-preview
  • ADD: custom_tag attribute in recentposts shortcode
  • ADD: text and linked attributes to testi shortcode
  • ADD: Output photos by hashtag in Instagram widget
  • FIX: Disable draggable option in google_map on mobile devices
  • FIX: banner shortcode logic
  • FIX: Widget visibility on blog page
  • FIX: Gravatar in Recent Comments widget
  • FIX: WP_Query in My Recent Posts widget
  • FIX: WP 4.3.0 compatibility - updated constructor method for WP_Widget
  • UPD: Language files
  • UPD: Maintenance Mode page

v1.2.7

  • ADD: Pinterest and Twitter widgets
  • ADD: icon_link attribute to the service_box shortcode
  • FIX: Plugin security bug
  • FIX: Usage of wp-content in code
  • FIX: Check and validation for amount parametr in flickr widget
  • FIX: roundabout shortcode in home page
  • FIX: a limit parametr for twitter widget
  • FIX: Added a check for empty post array in carousel_owl and posts_grid shortcodes
  • FIX: widget visibility
  • FIX: Save menu badges meta data if is WooCommerce template
  • UPD: Width for pseudo-elements in content_box shortcode CSS
  • UPD: Centering of navigation icons in Post Cycle widget
  • UPD: Changed a priority for wp_enqueue_scripts
  • UPD: Added a wc-logs directory to the exclude folder for export
  • UPD: Visibility items in carousel_owl shortcode
  • UPD: Language files

v1.2.6

  • FIX: set_site_transient for update_plugins
  • FIX: Replaced a double quote on a single quote in ru_RU.po file
  • UPD: Replaced using function for trims text
  • UPD: Changed a content_box shortcode logic

v1.2.5

v1.2.4

  • ADD: New google map api shortcode
  • FIX: Shortcode dialog (changed sizes)
  • FIX: A wrong function_exists check for content_box shortcode
  • FIX: Trouble when used сyrillic in the tabs shortcode
  • FIX: Argumets variable name in carousel_owl shortcode
  • UPD: Changed maintenance mode user rights
  • UPD: Rename title_box shortcode in wp-editor and edit description

v1.2.3

  • FIX: Reset to the previous columns.php file version

v1.2.2

  • FIX: conflicts flexslider.css
  • UPD: carousel.php
  • ADD: Added style for under-construction page in mobile devices
  • UPD: recent post shortcode(video post type)
  • upd: my-social-widget widgets
  • FIX: Fixed quotes
  • ADD: Added clearfix class to the li item in recent_posts shortcode
  • ADD: Added to the all shortcodes filters html-formatted data before return
  • ADD: Added outputing value for email custom field in Team and Testimonails post type
  • ADD: Added some style to the flex-slider
  • Fix: Fixed https://github.com/CherryFramework/CherryFramework/issues/17
  • Fix: Fixed display parametr in button shortcode
  • UPD: ul counter for post grid shotcode
  • FIX: https://github.com/CherryFramework/CherryFramework/issues/13
  • FIX: https://github.com/CherryFramework/CherryFramework/issues/10
  • UPD: recent testimonials shotcode
  • ADD: category filter to mini post shotcode
  • UPD: postcycle widget
  • UPD: flex slider css
  • UPD: Updated flexslider to version 2.2.2
  • UPD: css .comments-custom
  • Fix: hotfix: removed post-cycle's loader
  • Fix: hotfix: Fixed rtl-support in post_cycle shortcode
  • Fix: hotfix: removed post-cycle's loader
  • Fix: hotfix: Fixed rlt-support in post_cycle shortcode

v1.2.1

  • Add: Added rtl-language support
  • Upd: Improved Cherry Recent Comments widget – get comment for posts, pages, attachments and porfolio custom post type
  • Add: Added compatibility audio shortcode with MotoPress plugin
  • UPD: get_the_date()
  • ADD: content_box shortcode
  • ADD: tag option to posts grid shortcode
  • ADD: tag option to posts-list shortcode
  • ADD: tag option to recent posts shortcode
  • UPD: Cherry recent posts (the_date(); -> the_time(‘F j, Y’);)
  • UPD: widget banner
  • ADD: item counter class
  • Add: added custom-class option to row, span, shortcodes
  • Fix: Fixed outputing notice
  • Fix: Fixed outputing notice
  • Add: Added define API_URL constant

v1.2

  • Add: Compatibility with WP 3.9: fix shortcode dialog
  • UPD: Exclude widgets manager on customize.php
  • UPD: Improved wpml-plugin compatibility for widgets
  • FIX: Fixed issue with french translation - https://github.com/CherryFramework/CherryFramework/issues/6
  • FIX: Compatibility with old TM-themes
  • FIX: fix instagram and banner widgets
  • FIX: import algorithm.
  • FIX: remote server error
  • UPD: Removed logic for style-switcher
  • UPD: readme update

v1.1

  • Fix: import errors
  • Add: blocking files on upload
  • Fix: sorting errors
  • Add: widgets rewrite
  • Add: widgets custom classes
  • Fix: shortcode Elastislide
  • Add: styleswitcher
  • Add: plugin-under-construction-content rewrite in child theme
  • Add: plugin updater
  • Add: intagram widget
  • Upd: social widget
  • Fix: fixes in social network widget
  • Add: banner widget
  • Upd: improvements in wpml-compatibility

Releases

8 releases.

Tag
Published
v1.2.8.2 latest
Jul 5, 2016 10 years ago
v1.2.8.1
Sep 24, 2015 11 years ago
v1.2.8
Aug 27, 2015 11 years ago
v1.2.7
Aug 19, 2015 11 years ago
v1.2.5
Sep 9, 2014 12 years ago
v1.2.3
Sep 8, 2014 12 years ago
v1.2.4
Sep 8, 2014 12 years ago
v1.2.2
Jul 1, 2014 12 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D grade

Security

Cherry Plugin 1.2.8.2 · audited by WP Registry

High-severity findings.

3 high 2 medium 1 low
Audited release
1.2.8.2
Findings
6
Worst severity
high
Content hash
e524ebeccb3cb1cd939ac8b8…

Findings

  • high export_content AJAX missing nonce and capability

    missing_capability

    wp_ajax_export_content builds sample_data.zip from the uploads tree and theme options without verifying nonce or current_user_can('export'). Any logged-in user can trigger a full content export.

    admin/import-export/export-functions.php:6-50

    Recommendation

    Mirror download-content.php: check_ajax_referer + current_user_can('export').

  • high Maintenance mode save reachable by any logged-in user

    missing_capability

    wp_ajax_mtc_save updates option mtc_options from raw $_POST['data'] with no nonce or capability check. Enabling mtc_mode_on causes cherry_maintenance_mode_redirecte to replace the front-end with an under-construction page for anonymous visitors (site-wide DoS).

    includes/plugin-assets.php:68-72

    Recommendation

    Require manage_options and a nonce; sanitize option shape.

  • high Shortcode URL checker SSRF via get_headers

    ssrf

    wp_ajax_cherry_check_url_action passes attacker-controlled $_REQUEST['url'] to get_headers() for any logged-in user (no capability beyond being authenticated). This is classic SSRF against internal network services.

    admin/shortcodes/tinymce-shortcodes.php:60-74

    Recommendation

    Restrict to edit_posts, validate allowlist of hosts/schemes, use wp_safe_remote_head.

  • medium Import AJAX steps verify nonce only, not capability

    missing_capability

    Multiple import_* handlers (import_xml, import_posts, import_attachment, etc.) call wp_verify_nonce('import_ajax-nonce') but never current_user_can('import'). Combined with CSRF against an admin session, or any leak of that nonce, a low-privileged user can drive full sample-data import.

    admin/import-export/import-functions.php:140-900

    Recommendation

    Add current_user_can('import') beside every nonce check.

  • medium remove_widgets AJAX lacks nonce and capability

    missing_capability

    wp_ajax_remove_widgets clears wp_inactive_widgets via update_option without auth beyond being logged in.

    admin/import-export/import-functions.php:1074-1080

    Recommendation

    Require manage_options + nonce.

  • low Direct wp-load bootstrap in shortcode dialog

    unnecessary_attack_surface

    admin/shortcodes/dialog.php requires wp-load.php via path splitting for unauthenticated HTTP access. Impact is limited to rendering the TinyMCE dialog shell, but it expands attack surface and bypasses normal admin bootstrapping.

    admin/shortcodes/dialog.php:1-8

    Recommendation

    Load dialog only through admin-ajax/admin pages with capability checks.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →