WP Manifestindependent plugin directory
manifest / editor / wp-gutenberg-button-popup

Block Button Popup WP RegistryHigh-severity findings · 1 findingOpen the reportC-

A boilerplate WordPress Gutenberg block

by Genero · github.com/generoi/wp-gutenberg-button-popup · website

★ 17stars
1.8kcomposer installs
v0.4.0latest · 1 year ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/generoi/wp-gutenberg-button-popup/archive/refs/heads/master.zip

On Packagist as generoi/wp-gutenberg-button-popup:

composer require generoi/wp-gutenberg-button-popup
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/generoi/wp-gutenberg-button-popup ↗

A Gutenberg block for creating buttons that open popups

gutenberg-popups

Installation

composer require generoi/wp-gutenberg-button-popup

Requirements

  • WordPress 5.6 or newer

Usage

You can customize the default template for popups with a filter.

import { addFilter } from '@wordpress/hooks'

addFilter('wp-gutenberg-button-popup.popupTemplate', 'theme/popup-template', () => {
  return [
    ['core/columns', {align: 'full'}, [
      ['core/column', {}, [
        ['core/image'],
        ['core/group']
      ]],
      ['core/column', {}, [
        ['core/heading'],
        ['core/paragraph'],
        ['core/list'],
        ['core/buttons'],
      ]],
    ]],
  ];
})

Development

Install dependencies

composer install
npm install

Run the tests

npm run test

Build assets

# Minified assets which are to be committed to git
npm run build:production

# Watch for changes and re-compile while developing the plugin
npm run start

Releases

7 releases.

Tag
Published
v0.4.0 latest
Jul 24, 2025 1 year ago
v0.3.2
Apr 21, 2022 4 years ago
v0.3.1
Apr 26, 2021 5 years ago
v0.3.0
Apr 24, 2021 5 years ago
v0.2.0
Apr 9, 2021 5 years ago
v0.1.1
Mar 24, 2021 5 years ago
v0.1.0
Mar 24, 2021 5 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

Block Button Popup 1.0.0 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.0.0
Findings
1
Worst severity
high
Content hash
b5723fcfee6dd8c68ec2acb3…

Findings

  • high Stored XSS via unescaped Gutenberg class/color/align attributes in popup markup

    xss_stored

    genero/button-popup and genero/button-popups are dynamic blocks (JS save() returns only InnerBlocks.Content). At view time Block::render() copies attacker-controlled attributes into $this->classes with no sanitize_html_class: additional CSS className, align (Str::start prefix), contentJustification, textColor, and backgroundColor are implode'd with spaces. Both PHP views then echo $block->classes raw into a double-quoted class attribute (and do not use get_block_wrapper_attributes()). WordPress filter_block_kses_value() runs wp_kses on string attrs, which strips tags but does not encode quotes, so a Contributor or Author without unfiltered_html can store className x" onclick="alert(document.domain) (or the same breakout in textColor/backgroundColor/align/contentJustification) in the block comment JSON. When the post is previewed or published the markup is <div class="wp-block-genero-button-popup x" onclick="alert(document.domain)"> and the handler runs in the visitor's or reviewing admin's origin. Button label text is correctly passed through wp_kses_post; $block->className is slug(block.json name) and $block->id is wp_unique_id — those echoes are not this bug. Frontend script.js only toggles aria-expanded / moves the popup node; it is not required for the attribute XSS.

    src/blocks/button_popup/views/button-popup.php:1-6

    Recommendation

    Escape every interpolation: echo esc_attr($block->classes), esc_attr($block->className), esc_attr($block->id). Prefer get_block_wrapper_attributes() for the outer wrapper. Sanitize class fragments with sanitize_html_class() (or an allowlist of align/color slugs) before implode. Keep wp_kses_post() on the button text.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →