WP Manifestindependent plugin directory
manifest / admin / psource-branding

PSOURCE Toolkit WP RegistryMedium-severity findings · 2 findingsOpen the reportB

White Label & Rebranding Deiner Anmeldeseite & ClassicPress-Dashboard. Passe System-E-Mails an und lasse ClassicPress mit CP Toolkit umbenennen.White label & rebrand your login page & ClassicPress dashboard. Customize system emails and let ClassicPress rename with CP Toolkit.

by PSOURCE · github.com/cp-psource/psource-branding · website

★ 0stars
27release downloads
≈10active sites
v2.3.4latest · 1 year ago

Install

Download psource-branding.zip From the v2.3.4 release on GitHub, May 6, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/cp-psource/psource-branding/releases/download/v2.3.4/psource-branding.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.
Readme github.com/cp-psource/psource-branding ↗

White Label & Rebranding Deiner Anmeldeseite & ClassicPress-Dashboard. Passe System-E-Mails an und lasse ClassicPress mit CP Toolkit umbenennen.

White label & rebrand your login page & ClassicPress dashboard. Customize system emails and let ClassicPress rename with CP Toolkit.

Description

Deutsch

Passe jeden Aspekt von ClassicPress an Deine Marke an, indem Du CP Toolkit verwendest, das einzige Premium- und 100% kostenlose White-Label-Plugin für ClassicPress. Verwandel Dein Dashboard, passe System-E-Mails (Standard-E-Mails) an, schalte den Wartungsmodus und die bald erscheinenden Zielseiten schnell um, ändere jeden Aspekt Deines Anmeldebildschirms, entferne oder ersetze Logos, erstelle Farbschemata und vieles mehr. PSToolkit bietet alles, um ClassicPress kostenlos umzubenennen, ohne Code zu berühren.**

Spare Zeit, beseitige Probleme mit der Plugin-Kompatibilität und verbessere die Sicherheit mit einem Plugin und ohne weitere Hack-Änderungen.

Selbst die besten ClassicPress-Theme-Builder verlassen das ClassicPress-Branding auf Deiner Webseite. CP Toolkit hilft Dir beim Rebranding!

In Deinem persönlichen Blog ist dies kein großes Problem, aber für ein kleines Unternehmen, eine Design- und Entwicklungsagentur oder eine professionelle Webseite ist ein fertiger Look mit einem vollständigen Markenpaket wichtig. Hier kommt PSToolkit ins Spiel! Verwandel Dein ClassicPress in Deine eigene White-Label-Lösung.

Mehr als 30 Module im CP Toolkit enthalten!

English

Brand every aspect of ClassicPress using CP Toolkit, the only premium and 100% free white label plugin for ClassicPress. Transform your dashboard, customize system emails (default emails), quickly toggle maintenance mode and upcoming landing pages, change every aspect of your login screen, remove or replace logos, create color schemes, and more. PSToolkit has everything to rename ClassicPress for free without touching any code.**

Save time, eliminate plugin compatibility issues, and improve security with one plugin and no other hack changes.

Even the best ClassicPress theme builders leave ClassicPress branding on your website. CP Toolkit helps you with rebranding!

On your personal blog, this isn't a big problem, but for a small business, design and development agency, or professional website, a finished look with a full branding package is important. This is where PSToolkit comes in! Turn your ClassicPress into your own white label solution.

More than 30 modules included in CP Toolkit!

POWERED BY PSOURCE

Projektseite GitHub

Changelog

2.3.4

  • Better PhP8.2 compatibility
  • Some Bugfixes

2.3.3

  • Several Deprecated Fixes

2.3.2

  • Fix: Konflikt mit eMail-Templates
  • Fix: PHP Fatal error im Email-Log
  • Updater 1.3

2.3.1

  • Fix: PHP Deprecated: Required parameter

2.3.0

  • Only ClassicPress
  • Aktualisierte Links

2.2.9

  • Public Release

Releases

5 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v2.3.4 latest
May 6, 2025 1 year ago
psource-branding.zip
8
v2.3.3
Jun 22, 2024 2 years ago
psource-branding.zip
5
v2.3.2
Feb 18, 2024 2 years ago
psource-branding.zip
4
v2.3.1
Aug 1, 2023 3 years ago
psource-branding.zip
4
v2.3.0
Mar 7, 2023 3 years ago
psource-branding.zip
6

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

B grade

Security

PSOURCE Toolkit 2.3.4 · audited by WP Registry

Medium-severity findings.

1 medium 1 low
Audited release
2.3.4
Findings
2
Worst severity
medium
Content hash
6056d87585dd0e669e003f63…

Findings

  • medium AJAX handlers mutate site state with nonce only (no capability / access check)

    missing_capability

    PSToolkit_Helper::check_input_data() verifies request nonces but never calls current_user_has_access() or current_user_can(). Sensitive handlers such as PSToolkit_SMTP::ajax_deactivate_coflicted_plugin() call deactivate_plugins() after nonce alone, and tracking-code/module toggles likewise lack a capability gate. Admin menus are registered with capability 'read' once Permissions allows the user, so any Permissions-granted non-administrator with a Branding nonce can perform privileged module and plugin changes. Default installs limit nonce minting to administrators, but the missing server-side capability check is a real BAC gap whenever Permissions expands access.

    inc/class-pstoolkit-helper.php:3564-3573

    Recommendation

    Inside check_input_data (or each AJAX callback) require PSToolkit_Permissions::current_user_has_access() and, for deactivate_plugins/install paths, current_user_can('activate_plugins').

  • low Cookie notice AJAX allows updating another user's dismissal meta (IDOR)

    missing_capability

    save_user_meta() verifies a frontend nonce then writes update_user_meta() using attacker-supplied user_id (sanitized only for the emptiness check, raw $_POST['user_id'] used in the write). Any logged-in user who can load the cookie banner can alter another account's cookie-notice meta.

    inc/modules/front-end/cookie-notice.php:487-510

    Recommendation

    Force user_id to get_current_user_id(); do not accept client-supplied user IDs.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →