WP Manifestindependent plugin directory
manifest / editor / feed-block

Feed Loop Block WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

Advanced RSS and Atom feed block plugin for WordPress/Gutenberg

★ 5stars
34release downloads
0.5.0latest · never

Install

Download feed-block.zip From the 0.5.0 release on GitHub, May 3, 2023

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/cr0ybot/feed-block/releases/download/0.5.0/feed-block.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Advanced RSS and Atom feed block with configurable child blocks for the WordPress Gutenberg editor, similar to the Query Loop block.

Blocks

Feed Loop

The Feed Loop block is the main block that is used to display items from a feed. It is similar to the Query Loop block, but instead of querying posts from the WordPress database, it queries items from an RSS or Atom feed.

Feed Item Template

The Feed Item Template block is used to display the layout of a single feed item. It is similar to the Post Template block, but instead of displaying a post, it displays a feed item.

Inside the Feed Item Template block, you can add the blocks below to display parts of the feed item, such as the title, content, and summary. You can add any other block inside the Feed Item Template block as well, like groups and columns, to lay out the parts as you see fit.

Feed Item Title

The Feed Item Title block is used to display the title of a feed item. It is similar to the Post Title block.

You can also choose to display the contents of a custom tag instead of the default title.

The title can optionally link to the feed item's URL, and includes other typography settings.

Feed Item Content

The Feed Item Content block is used to display the content of a feed item. It is similar to the Post Content block.

You can also choose to display the contents of a custom tag instead of the default content.

The content can be displayed as HTML, HTML with images removed, and plain text, and also includes other typography settings.

Feed Item Summary

The Feed Item Summary block is used to display the summary of a feed item. It is similar to the Post Excerpt block.

You can also choose to display the contents of a custom tag instead of the default content.

The summary can be limited to a certain number of words, and can optionally include a "read more" link.It also includes other typography settings.

Feed Item Image

The Feed Item Image block is used to display the primary image of a feed item. It is similar to the Post Featured Image block.

The image can come from either an itunes:image tag (in the case of a podcast feed) or the first HTML img tag in the primary content, in that order. You can also choose a different tag that includes an HTML img tag, though tags with src or href attributes are not yet supported.

The image can optionally link to the feed item's URL, and includes other settings such as an optional overlay, aspect ratio, and border options.

Feed Item Date

The Feed Item Date block is used to display the date of a feed item. It is similar to the Post Date block.

The date can be formatted using PHP date format strings, and includes other typography settings.

You can choose to display the published or modified date (if available), or the contents of a custom tag. When displaying a custom tag, additional input format options are available to read the date from the tag's contents.

Feed Item Link

The Feed Item Link block is used to display a link to a feed item. It is similar to the Read More block.

The link can be styled with background and border options, and includes other typography settings.

It does not currently support displaying the contents of a custom tag, nor can it pull a URL from anywhere other than the feed item's main URL.

Feed Loop - No Results

The Feed Loop - No Results block is used to display text or other blocks when no feed items are found. It is similar to the No Results block used by the Query Loop block.

To Do

  • [ ] Add support for displaying top-level feed attributes, such as title, description, icon, and authors.
  • [ ] Add support for getting the image source from tag attributes.
  • [ ] Add support for displaying enclosure media (audio/video).

Releases

5 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
0.5.0 latest
May 3, 2023 3 years ago
feed-block.zip
16
Mar 29, 2023 3 years ago
feed-block.zip
1
Mar 24, 2023 3 years ago
feed-block.zip
9
Mar 24, 2023 3 years ago
feed-block.zip
7
Mar 17, 2023 3 years ago
feed-block.zip
1
C- grade

Security

Feed Loop Block 0.5.0 · audited by WP Registry

High-severity findings.

1 high
Audited release
0.5.0
Findings
1
Worst severity
high
Content hash
b7c1a7d10f01cc77158602ce…

Findings

  • high Stored XSS in the block editor: RSS HTML assigned to dangerouslySetInnerHTML without sanitization

    xss_stored

    Feed Item Content's editor script imports DOMPurify and uses it when contentType is text (ALLOWED_TAGS: []), but for html and htmlNoImg it assigns the remote feed body straight to React dangerouslySetInnerHTML. That path is reachable by any logged-in user with edit_posts: the parent Feed Item Template POSTs feedURL to wp_ajax_feed_block_get_feed (nonce feed-block + edit_posts), get_feed() copies SimplePie get_content() into items[].content_html with no kses, and the JSON is placed on block context. The SelectControl always offers HTML / HTML (images removed); readme.txt says this requires unfiltered_html, but neither the JS nor render.php checks that capability. A Contributor (or Author) can insert <!-- wp:feed-block/feed-item-content {"contentType":"html"} /--> with feedURL pointing at an attacker-controlled RSS item such as <img src=x onerror=…>. When an Editor or Administrator opens the post in Gutenberg, the live feed is fetched and event-handler markup executes in wp-admin (innerHTML does not run <script> tags, but onerror/onload and similar handlers do). Frontend render.php is not this bug — it correctly echoes wp_kses_post($content). Sibling title/summary/image editor scripts do sanitize with DOMPurify.

    build/blocks/feed-item-content/index.js:112-122

    Recommendation

    Sanitize html/htmlNoImg with DOMPurify (or wp.sanitize) before dangerouslySetInnerHTML, matching the text-mode path. Hide or disable HTML contentType unless current_user_can('unfiltered_html'), as the readme already documents. Consider running content_html through wp_kses_post in get_feed() / get_feed_action before returning it to the editor.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.