WP Manifestindependent plugin directory
manifest / content / cultivate-rss-builder

Cultivate RSS Builder WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

★ 1stars
41release downloads
≈20active sites
1.1.0latest · 1 year ago

Install

Download cultivate-rss-builder.zip From the 1.1.0 release on GitHub, Sep 5, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/cultivatewp/cultivate-rss-builder/releases/download/1.1.0/cultivate-rss-builder.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

Build custom RSS feeds for email marketing. Go to Settings > RSS Builder to create a new feed.

After making your selections, click "Get Feed URL" and copy the URL at the top of the page.

screenshot

Customization Options

  • Limit to a Category
  • Change the sort order ( most recent, recently updated, most comments, or random )
  • Change how many are returned
  • Control the offset (first posts excluded from feed) - useful when using multiple feeds in a single email campaign
  • Change image size for featured image
  • Exclude posts older than a date, or a strtotime() compatible string (ex: "-1 year ago")
  • Exclude posts published since a date (ex: "1 month ago")
  • Exclude posts in a specific category or tag

Feed of updated posts

Set the order to "Recently Updated", and exclude posts published since "3 months ago". When a post is first published, the updated date equals the published date, which is why we want to exclude recently published posts.

screenshot

Custom RSS Post Title

This plugin also adds a "RSS Post Title" metabox for specifying a separate title for use in the RSS feed. You can disable this using:

add_filter( 'be_rss_builder_post_types', '__return_empty_array' );

No Newsletter tag

When building your feed, there's a checkbox labeled "Exclude posts tagged 'no-newsletter'". This allows content editors to easily mark certain content as excluded, like sponsored posts.

You should use the ea_no_newsletter_term_id filter to specify the term_id used for this tag. Ex:

add_filter( 'ea_no_newsletter_term_id', function() { return 123; });

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.1.0 latest
Sep 5, 2025 1 year ago
cultivate-rss-builder.zip
17
Apr 28, 2025 1 year ago
cultivate-rss-builder.zip
24

Active-site estimate ≈20 comes from the median of recent superseded releases. Method.

B grade

Security

Cultivate RSS Builder 1.1.0 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.1.0
Findings
1
Worst severity
medium
Content hash
12b7f7a009a7e142b28dd3ed…

Findings

  • medium Any logged-in user can write option be_rss_builder via GET on admin_menu

    missing_capability

    maybe_redirect is hooked to admin_menu, which WordPress fires from wp-admin/includes/menu.php on every authenticated admin request after auth_redirect() (Subscriber dashboard and profile.php included). The handler only checks is_admin(), $_GET['page']==='be_rss_builder', and that $_GET['be_filter'] is a non-empty array; there is no current_user_can('manage_options') and no nonce. It then calls get_settings_hash() which sha1-keys the GET array and update_option('be_rss_builder', maybe_serialize($feeds), false). A Subscriber GET to /wp-admin/profile.php?page=be_rss_builder&be_filter[orderby]=rand&be_filter[posts_per_page]=20 therefore persists a new feed recipe before the subsequent redirect to options-general.php (which that role cannot view). The settings form itself is method=GET with no nonce, so a top-level click/CSRF from any logged-in victim also writes. Existing hashes are not replaced (array_key_exists), but keys can be appended without bound. Consumer: get_feed_data() → rss_query() on public RSS. Not unauth-direct (auth_redirect).

    includes/class-cwp-rss-builder.php:53-71

    Recommendation

    Require current_user_can('manage_options') (and a nonce, or at least restrict to POST) before calling get_settings_hash(). Do not persist options from a GET on admin_menu; write only from the manage_options settings page after check_admin_referer(). Cap the size/count of stored hashes.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.