WP Manifestindependent plugin directory
manifest / builders / daveden-builderius-enhancements

Daveden Builder Enhancements WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC- #7 in Page Builder Addons

Quality-of-life, theming and accessibility enhancements for the Builderius builder UI

★ 9stars
151release downloads
≈10active sites
v2.0.3latest · 2mo ago

Install

Download daveden-builderius-enhancements.zip From the v2.0.3 release on GitHub, Aug 16, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/daveden2/daveden-builderius-enhancements/releases/download/v2.0.3/daveden-builderius-enhancements.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

A free, open-source companion plugin that makes the Builderius builder interface faster, calmer and more accessible.

Around sixty separate improvements to the builder chrome, each behind its own toggle, so you switch on only what you want. Find them under Builderius → Builder Enhancements in the WordPress dashboard. Built by Daveden.

The Builder Enhancements menu item under Builderius in the WordPress dashboard

Every change touches the builder chrome only. Nothing is added to the front end of your site, and nothing is written into your templates. Each feature is intended to be retired as a native equivalent lands in Builderius itself.

What it does

Accessibility

The builder is reachable and readable by keyboard and screen reader. Landmark regions for the top bar, panels and canvas; arrow-key toolbars; keyboard access to the Inserter, the panel tabs and the Builderius menu; proper combobox and tab semantics on custom widgets; a visible focus ring on every control; accessible names on icon-only buttons; and contrast fixes for overlays and forced-colours mode.

Navigator

Filter search that hides branches which do not match, collapse and expand the whole tree, follow-selection that keeps your place visible, tag badges, inline rename, full keyboard operation of the tree, per-row quick actions, a rearrangeable favourites bar, and the option to detach the panel.

Editing

A regrouped right-click menu with flyouts for inserting, moving and advanced tools. Move elements up, down, in and out; wrap a selection in a new element; paste where you click in the Navigator; rename by double-click; undo a deletion, with Redo after undoing. Helpers for HTML attributes, image defaults, display conditions and component property order.

HTML authoring tools

  • Edit as HTML (Pro, experimental, off by default) — open an element and everything inside it as plain HTML, edit it, and apply the changes back. A preview shows exactly what will change first.
  • Import HTML (Pro, experimental, off by default) — paste markup from anywhere, preview the elements it will create, and insert them. Repeated blocks can be collapsed into a Collection, and a pasted SVG stays editable.
  • Change tag (Pro) — change an element's HTML tag from the Navigator or the command palette, keeping its label and any data binding.
  • A shorthand syntax for building elements quickly from the command palette. See the Emmet guide.

The two editors rewrite a whole element in one step and that step cannot be undone, so they stay off by default and carry a warning on the settings screen. Pasted markup is cleaned before it reaches the builder, and the tools are available only to users who are already allowed to post unfiltered HTML.

Styles panel

The CSS code editor open by default, a scope badge with an instant Global/Template switch, an All CSS shortcut, bulk BEM-style class naming, an explainer for the %local% and %selector% hints, and the option to hide the editor minimap. Most of this section needs Builderius Pro.

Appearance and workflow

A light, dark or follow-the-OS theme for the builder chrome with a top-bar switcher (props to David McCan), a comfortable/compact density toggle, resizable panels, restyled controls and a consistent typeface.

For workflow: Cmd/Ctrl+S to save, a save-state cue for Builderius versions before 1.3.6, a command palette on Cmd/Ctrl+K, a keyboard-shortcuts overlay, a warning when another tab has the same template open, and drag handles for resizing the preview canvas around its centre for container-query work.

Requirements

  • WordPress 6.4 or later, PHP 8.2 or later
  • Builderius (the free wordpress.org plugin) active. DBE is currently audited against 1.3.6-beta; on WordPress 6.5+ the hard dependency is enforced natively through the Requires Plugins header.
  • A handful of features need Builderius Pro. They are labelled on the settings screen and stay hidden without it.

Every JavaScript feature fails softly. If a future Builderius release moves the markup a feature depends on, that feature reports itself as missing rather than breaking the builder.

Installation

Download daveden-builderius-enhancements.zip from the latest release and install it like any other WordPress plugin. The bundled update checker watches this repository's releases, so you will be offered updates on the Plugins screen from then on.

[!IMPORTANT] The plugin directory name must contain builderius. In builder mode, Builderius removes every hook whose callback file lives under wp-content/plugins unless the path contains an allowlisted plugin name. If you rename the folder, every builder feature silently disappears.

Settings

Builderius → Builder Enhancements. A tab rail shows how much of each section is switched on. Every feature is a name, a switch and a plain description; one switch turns a whole tab or section on or off.

The Dashboard tab offers quick-start presets: accessibility, keyboard, visual, safer editing and power editing. A preset switches on a considered set of features in one step and never turns anything off. Nothing is saved until you review the changes and press Save.

Switching a feature off releases everything it added: listeners, observers, timers and generated interface state. Uninstalling the plugin removes its options.

Documentation

Contributing

Suggestions, bug reports and pull requests are welcome. Start with CONTRIBUTING.md; contributors are credited in CONTRIBUTORS.md. Bug reports are most useful with your WordPress, PHP, Builderius and plugin versions, and the browser you saw it in.

Support

Daveden Builder Enhancements is free and open source. If it saves you time, you can support its continued development through GitHub Sponsors, Ko-fi or PayPal. Support is entirely optional; every feature remains available either way.

Releases

Releases ship from main; day-to-day work lands on develop. Merging the release pull request tags the version, publishes the GitHub release from the readme.txt notes and attaches the distributable zip. The process is written up in RELEASING.md.

Licence

Licensed under the GNU General Public License, version 2 or later — see LICENSE for the full text.

The plugin is free software and free of charge. There is no paid tier, no upsell and no telemetry.

A note on names

This is an independent community project. It is not affiliated with, endorsed by or supported by Builderius. Please report problems here rather than to the Builderius team.

Releases

Newest 25 of 30 recorded releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v2.0.3 latest
Aug 16, 2026 2mo ago
daveden-builderius-enhancements.zip +1 asset
28
daveden-builderius-enhancements.zip28
daveden-builderius-enhancements.zip.sha2560
Aug 6, 2026 2mo ago
daveden-builderius-enhancements.zip +1 asset
15
daveden-builderius-enhancements.zip14
daveden-builderius-enhancements.zip.sha2561
Jul 30, 2026 2mo ago
daveden-builderius-enhancements.zip +1 asset
15
daveden-builderius-enhancements.zip15
daveden-builderius-enhancements.zip.sha2560
Jul 29, 2026 2mo ago
daveden-builderius-enhancements.zip +1 asset
7
daveden-builderius-enhancements.zip6
daveden-builderius-enhancements.zip.sha2561
Jul 16, 2026 3mo ago
daveden-builderius-enhancements.zip
17
Jul 14, 2026 3mo ago
daveden-builderius-enhancements.zip
12
Jul 14, 2026 3mo ago
daveden-builderius-enhancements.zip
4
Jul 13, 2026 3mo ago
daveden-builderius-enhancements.zip
9
Jul 13, 2026 3mo ago
daveden-builderius-enhancements.zip
5
Jul 13, 2026 3mo ago
daveden-builderius-enhancements.zip
8
Jul 13, 2026 3mo ago
daveden-builderius-enhancements.zip
8
Jul 12, 2026 3mo ago
daveden-builderius-enhancements.zip
3
Jul 12, 2026 3mo ago
daveden-builderius-enhancements.zip
3
Jul 12, 2026 3mo ago
daveden-builderius-enhancements.zip
1
Jul 12, 2026 3mo ago
daveden-builderius-enhancements.zip
2
Jul 10, 2026 3mo ago
daveden-builderius-enhancements.zip
5
Jul 10, 2026 3mo ago
daveden-builderius-enhancements.zip
3
Jul 10, 2026 3mo ago
daveden-builderius-enhancements.zip
1
Jul 9, 2026 3mo ago
daveden-builderius-enhancements.zip
3
Jul 9, 2026 3mo ago
daveden-builderius-enhancements.zip
3
Jul 8, 2026 3mo ago
daveden-builderius-enhancements.zip
1
Jul 7, 2026 3mo ago
tag only
—
Jul 7, 2026 3mo ago
tag only
—
Jul 7, 2026 3mo ago
tag only
—
Jul 7, 2026 3mo ago
tag only
—
All releases on GitHub →

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

C- grade

Security

Daveden Builder Enhancements 2.0.3 · audited by WP Registry

High-severity findings.

1 high
Audited release
2.0.3
Findings
1
Worst severity
high
Content hash
38eebbe77cd323e29a6e7337…

Findings

  • high Command-palette Emmet stores unsanitised HTML tags, bypassing the unfiltered_html HTML-converter gate

    xss_stored

    Import HTML, Edit as HTML, and Change tag declare cap unfiltered_html and refuse tags outside DBE_HTML_KNOWN_TAGS (script, iframe, object, embed, meta, base, link, style are stripped). The command palette is on by default, has no capability gate, and is exposed to every builderius-development user. Its Emmet path (dbeEmmetParse → dbeEmmetNodeToModule → dbeElementModule) copies the parsed tag name into HtmlElement.settings.tag without dbeCleanTagInput(). dbeEmmetStructureError only validates collection:subTag, not the primary tag. Builderius then renders that tag and the content setting raw on published pages. A multisite editor/site-admin (or any custom role with builderius-development but not unfiltered_html) can therefore Cmd/Ctrl+K → Add elements (Emmet) → script{alert(document.domain)} or iframe[srcdoc=<script>alert(1)</script>], save, and get stored XSS in the front-end template. dbeAttrBlocked also omits srcdoc (only href/src/action/formaction/poster/xlink:href), so even an iframe created this way can carry an executable document. This is the same trust boundary the plugin documents in dbe_feature_output_permitted() and then fails to apply to Emmet.

    assets/builder/js/chunks/editing.js:247-378

    Recommendation

    Run every Emmet tag through dbeCleanTagInput() (or DBE_HTML_KNOWN_TAGS plus the same STRIP_TAGS list as dbeParseHtmlFragment) before dbeElementModule(); refuse script/iframe/object/embed/meta/base/link/style. Gate command_palette markup-entry (Emmet + Add attributes) on unfiltered_html the same way Import/Edit HTML are gated, or hide those palette commands when dbe_feature_output_permitted('import_html') is false. Extend dbeAttrBlocked/DBE_URL_ATTRS to srcdoc, srcset, and other URL-bearing attributes. Prefer matching tags against the curated DBE_PICKER_ELEMENTS/DBE_TAG_CHOICES lists already used by the element picker and Change tag flyout.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.