WP Manifestindependent plugin directory
manifest / events / ukexhibition-wordpress-plugin

HimoEXPO WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

WordPress plugin that scrapes and categorizes UK B2B exhibition listings, with search, registration, and admin dashboard — built for Royal Hermes Group by HimoEXPO

★ 1stars
3release downloads
v10.1.0latest · 23d ago

Install

Download royal-hermes-exhibitions-v10.1.0.zip From the v10.1.0 release on GitHub, Sep 29, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/devhimoco/ukexhibition-wordpress-plugin/releases/download/v10.1.0/royal-hermes-exhibitions-v10.1.0.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

HimoEXPO — UK Exhibitions WordPress Plugin

A WordPress plugin that automatically scrapes daily-updated UK B2B trade exhibition listings, categorizes them, and lets site visitors search, browse, and register interest in exhibitions — with a full admin dashboard for managing registrations.

Built for Royal Hermes Group by HimoEXPO (h.maghsoudloo).


What it does

The plugin scrapes UK B2B exhibition listings from EventsEye once a day via WP-Cron, stores them in a dedicated database table, and displays them on the front end through a shortcode. Visitors can search, filter by category, and submit a registration-of-interest form for any exhibition — which triggers a confirmation email to the visitor and dual notification emails to admins.

Key features

  • Automated daily scraping — WP-Cron job (with a manual "Run Scrape Now" button) pulls exhibition data from EventsEye: name, dates, city, venue, cycle, and description
  • Auto-categorization — a keyword-based engine sorts every exhibition into one of 20 default categories (Automotive, Aerospace, Construction, Energy, Technology, Food & Drink, Healthcare, Fashion, Finance, Marketing, Manufacturing, Logistics, Real Estate, Education, Science, Agriculture, Sports, Printing, Franchise & Business, Other), each with its own bundled icon and a custom-image upload option
  • Front-end shortcode [rhg_exhibitions] — a responsive (desktop/tablet/phone) card grid with:
    • Live debounced search and a configurable per-page count (10/20/40/50)
    • Multi-select category filtering (dropdown on mobile, pills on desktop)
    • "Days to go" badges, hover-to-reveal descriptions, and a branded registration popup
    • A "Can't find your exhibition?" flow for visitors to manually request a listing that isn't in the database yet
  • Registration system — full name, email, job title, searchable country/town, and an optional phone number, with server-side validation
  • Email notifications — visitor confirmation email plus two configurable admin notification addresses, with a built-in "Send Test Email" diagnostic and captured SMTP error reporting
  • Admin dashboard ("HimoEXPO" menu in wp-admin) with three pages:
    • Registrations — every submission, filterable by keyword, date range, city, and category, including flagged "not found" requests
    • Exhibitions — all scraped listings grouped into a collapsible accordion by category, with registrant counts and drill-through to each exhibition's registrant list
    • Settings — admin notification emails, category management (add/edit/remove + keyword rules + images), scrape controls, and a shortcode reference
  • Self-upgrading database schema — new columns introduced in later versions are added automatically on first load after an update, no manual reactivation required

Requirements

  • WordPress (tested on recent 5.x/6.x releases)
  • PHP 7.4+
  • MySQL/MariaDB (standard WordPress database)
  • WP-Cron enabled (either the default or a real system cron hitting wp-cron.php)
  • Outbound HTTPS access from the server to eventseye.com (required for the daily scrape)
  • A working mail transport for notification emails — on local environments (XAMPP, Local, etc.) install WP Mail SMTP, since PHP's built-in mail() function has no real mail server to talk to on localhost and will fail silently. See docs/TROUBLESHOOTING.md.

Installation

Option A — Download a release (recommended)

  1. Go to Releases and download the .zip for the version you want (the latest tag is the current production version)
  2. In wp-admin, go to Plugins → Add New → Upload Plugin, choose the zip, and click Install Now
  3. Click Activate

Option B — Clone from GitHub

cd wp-content/plugins
git clone https://github.com/devhimoco/UKExhibition-Wordpress-Plugin.git himoexpo-uk-exhibitions

Then activate HimoEXPO from Plugins in wp-admin.

First-time setup

  1. Activating the plugin creates its database tables (rhg_exhibitions, rhg_registrations) and schedules the daily scrape automatically
  2. Go to HimoEXPO → Settings and:
    • Enter the two admin notification email addresses
    • Use Send Test Email to confirm mail delivery works before relying on it
    • Click Run Scrape Now to populate exhibitions immediately instead of waiting for the next daily cron run
    • Review Category Management — edit keyword rules or upload custom category images if desired
  3. Add the shortcode to any page or post:
    [rhg_exhibitions]
  4. If Run Scrape Now reports 0 exhibitions (most common on local XAMPP setups), see docs/TROUBLESHOOTING.md — it covers SSL/certificate errors, connectivity issues, and bot-detection responses, matched to the exact error message the plugin shows.

Project structure

royal-hermes-exhibitions.php   # Plugin bootstrap: activation, cron, schema auto-upgrade
admin/
  class-rhg-admin.php          # wp-admin menu + Registrations/Exhibitions/Settings pages
includes/
  class-rhg-categories.php     # Keyword-based auto-categorization engine
  class-rhg-db.php             # Database schema + queries
  class-rhg-scraper.php        # EventsEye scraper
  class-rhg-cron.php           # Daily WP-Cron scheduling
  class-rhg-shortcode.php      # [rhg_exhibitions] front-end rendering
  class-rhg-ajax.php           # Search/filter/registration AJAX handlers
  class-rhg-email.php          # Registration + admin notification emails
assets/
  css/, js/, img/              # Front-end and admin styling, scripts, category icons
docs/
  TROUBLESHOOTING.md           # Scraper failure diagnostics (SSL, connectivity, bot-blocking)
CHANGELOG.md                   # Full version-by-version history from v5.0.0 onward

Version history

This repository's main branch always reflects the latest version. Every historical build — including early pre-release prototypes and alternate variants — is preserved and downloadable from Releases, each with its own notes and the original .zip as a downloadable asset.

For the detailed, version-by-version technical changelog (what changed and why, from v5.0.0 through the current release), see CHANGELOG.md.

Versioning follows semantic versioning from v5.0.0 onward:

  • +0.1 — small changes (bug fixes, minor UI tweaks, small feature additions)
  • +1.0 — big changes (new pages, new systems, major redesigns, new integrations)

Versions prior to v5.0.0 (v0.1.0–v0.4.0 in this repo's Releases) were early prototypes built before this versioning scheme was adopted.

License

Proprietary — All rights reserved. This code is the property of Royal Hermes Group / HimoEXPO and is not licensed for reuse, modification, or redistribution by third parties. See LICENSE.

Author

HimoEXPO (h.maghsoudloo) — built for Royal Hermes Group

Releases

Newest 25 of 37 recorded releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v10.1.0 latest
Sep 29, 2026 23d ago
royal-hermes-exhibitions-v10.1.0.zip
2
Sep 29, 2026 23d ago
royal-hermes-exhibitions-v10.0.0.zip
0
Sep 29, 2026 23d ago
royal-hermes-exhibitions-v9.15.0-WithMail.zip
0
Sep 29, 2026 23d ago
royal-hermes-exhibitions-v9.14.0-Complete-No_email.zip
0
Sep 29, 2026 23d ago
royal-hermes-exhibitions-v9.13.0.zip
0
Sep 29, 2026 23d ago
royal-hermes-exhibitions-v9.12.0.zip
0
Sep 29, 2026 23d ago
royal-hermes-exhibitions-v9.11.0.zip
0
Sep 29, 2026 23d ago
royal-hermes-exhibitions-v9.10.0.zip
0
Sep 29, 2026 23d ago
royal-hermes-exhibitions-v9.8.0.zip
0
Sep 29, 2026 23d ago
royal-hermes-exhibitions-v9.7.0.zip
0
Sep 29, 2026 23d ago
royal-hermes-exhibitions-v9.6.0.zip
0
Sep 29, 2026 23d ago
royal-hermes-exhibitions-v9.5.0-Style.css-Not-change.zip
0
Sep 29, 2026 23d ago
royal-hermes-exhibitions-v9.4.0-Himo.zip
0
Sep 29, 2026 23d ago
royal-hermes-exhibitions-v9.4.0-Orginal.zip
0
Sep 29, 2026 23d ago
royal-hermes-exhibitions-v9.3.0.zip
0
Sep 29, 2026 23d ago
royal-hermes-exhibitions-v9.2.0.zip
0
Sep 29, 2026 23d ago
royal-hermes-exhibitions-v9.1.0.zip
0
Sep 29, 2026 23d ago
royal-hermes-exhibitions-v9.0.0.zip cohort
1
Sep 29, 2026 23d ago
royal-hermes-exhibitions-v8.3.0.zip
0
Sep 29, 2026 23d ago
royal-hermes-exhibitions-v8.2.0.zip
0
Sep 29, 2026 23d ago
royal-hermes-exhibitions-v8.0.0.zip
0
Sep 29, 2026 23d ago
royal-hermes-exhibitions-v7.0.0-Used-Whitout-PIC.zip
0
Sep 29, 2026 23d ago
royal-hermes-exhibitions-v6.0.0.zip
0
Sep 29, 2026 23d ago
royal-hermes-exhibitions-v5.9.0.zip
0
Sep 29, 2026 23d ago
royal-hermes-exhibitions-v5.8.0.zip
0
All releases on GitHub →
B grade

Security

HimoEXPO 10.1.0 · audited by WP Registry

Medium-severity findings.

1 medium 1 low
Audited release
10.1.0
Findings
2
Worst severity
medium
Content hash
f6ea6830a91df6387ffb6bff…

Findings

  • medium Unauthenticated registration endpoint can be abused as an outbound email relay and to flood registrations

    unnecessary_attack_surface

    rhg_exh_register is registered for both wp_ajax_ and wp_ajax_nopriv_. Its only gate is verify_nonce() against 'rhg_exh_nonce', which is created for uid 0 and printed in the localized rhgExhData script on every page using the shortcode, so any visitor can obtain it. With requested_exhibition set (the 'can't find my exhibition' flow) no real exhibition is needed. The handler inserts a row via RHG_DB::add_registration() and RHG_Email::send_customer_confirmation() calls wp_mail() to the attacker-supplied email address with a body containing attacker-controlled full_name and requested_exhibition text (sanitize_text_field only strips tags, so URLs/phishing text pass), plus admin notifications for every submission. There is no rate limiting, CAPTCHA or per-address throttle, so an attacker can send unlimited site-branded emails to arbitrary recipients (damaging the domain's mail reputation / phishing from a trusted sender) and fill the registrations table and admin inboxes.

    includes/class-rhg-ajax.php:18-19, 89-170

    Recommendation

    Add per-IP and per-recipient rate limiting and a CAPTCHA/Turnstile check for unauthenticated submissions, avoid echoing free-form visitor text into the customer confirmation email (or require double opt-in), and cap stored registrations per IP.

  • low Settings/scrape/test-email handler on admin_init has nonce but no capability check

    missing_capability

    RHG_Admin::handle_actions() is hooked to admin_init (runs for any logged-in user hitting wp-admin, admin-ajax.php or admin-post.php) and processes settings saves (admin notification emails, category names/keywords/images including wp_handle_upload), a manual scrape run, and a test email, gated only by check_admin_referer('rhg_exh_settings_nonce') with no current_user_can(). The nonce is only rendered on the manage_options settings page and is user-bound, so a Subscriber cannot normally obtain one; this is a defence-in-depth gap (any nonce leak would let a low-privileged user redirect admin registration notifications to their own address).

    admin/class-rhg-admin.php:19, 100-170

    Recommendation

    Add current_user_can('manage_options') at the top of handle_actions() (or move the processing into the settings page callback / admin_post handlers with capability checks).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.