WP Manifestindependent plugin directory
manifest / ecommerce / glami-feed-generator-pixel-for-woocommerce

GLAMI feed generator + PiXel for WooCommerce WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

GLAMI feed generator & Pixel for WooCommerce

★ 2stars
1.0.17latest · 6mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/glami/glami-feed-generator-pixel-for-woocommerce/archive/refs/heads/main.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

URI: http://www.gnu.org/licenses/gpl-3.0.html

GLAMI feed generator + PiXel is an extension built for GLAMI, an engine that focuses on all styles of fashion, apparel and accessories.

Description

GLAMI feed generator + PiXel is an extension built for GLAMI, an engine that focuses on all styles of fashion, apparel and accessories.

GLAMI feed generator + PiXel is an essential tool for any online store featured on the Glami product search engine. With GLAMI feed generator + PiXel for WooCommerce you update your products daily on Glami, automatically creating the XML that contains all the features required by it, as well as integrating the functionality of Glami Pixel.

Installation

  1. Upload glami-feed-generator-pixel-for-woocommerce.zip to the /wp-content/plugins/ directory
  2. Activate the plugin through the 'Plugins' menu in WordPress

Changelog

1.0.17

Version Bump

1.0.16

Version Bump

1.0.15

  • Added support for source tag
  • Moved purchase event on order meta
  • Code tidy up
  • Improvements on updater

1.0.14

  • Changed tracking

1.0.13

  • Added Polish version

1.0.12

  • Temporary removed GLAMI Top integration

1.0.11

  • Fixed color issues
  • Added filters for almost any attribute on XML
  • Fixed backorders issue
  • Changed XML labels to capital
  • Added GLAMI Top integration

1.0.10

  • Added The SEO framework to category listing
  • Bumped WordPress and WooCommerce versions

1.0.9

  • Added Italy on engine listing

1.0.8

  • Added the ability to exclude out of stock products from XML

1.0.7

  • Added missing cron file

1.0.6

  • Fixed variation issue

1.0.5

  • Localization issue

1.0.4

  • HPOS declaration support
  • WP-CLI support

1.0.3

  • Fixed notice error when options not set

1.0.2

  • Fixed Yoast SEO compatibility
  • Fixed Rank Math compatibility
  • Fixed Glami engine main script

1.0.1

  • Fixed product description and illegal characters
  • Support product link

1.0.0

  • Initial version

Releases

2 releases.

Tag
Published
1.0.17 latest
Mar 30, 2026 6mo ago
Feb 6, 2026 8mo ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

GLAMI feed generator + PiXel for WooCommerce 1.0.17 · audited by WP Registry

High-severity findings.

2 high
Audited release
1.0.17
Findings
2
Worst severity
high
Content hash
6483048acf427bd81973f6be…

Findings

  • high AJAX feed generation missing capability and nonce checks

    missing_capability

    glami_feed_run_ajax_event is hooked to wp_ajax_ only (authenticated) but never calls current_user_can or check_ajax_referer; any logged-in role can trigger full feed generation.

    admin/class-glami-feed-generator-pixel-for-woocommerce-admin.php:184-188

    Recommendation

    Require manage_woocommerce (or manage_options) and check_ajax_referer before generate().

  • high Direct cron.php bootstrap via wp-load.php without authentication

    missing_auth

    cron.php resolves four directories up, requires wp-load.php, and immediately runs feed generate() with no token, capability, or DOING_CRON guard. If the plugins directory is web-accessible, unauthenticated callers can trigger generation repeatedly.

    cron.php:1-7

    Recommendation

    Remove web-reachable bootstrap; use WP-Cron/Action Scheduler with a secret query arg or WP-CLI only.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.