WP Manifestindependent plugin directory
manifest / admin / quickjump-admin

QuickJump Admin WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Navigate faster in WordPress admin with intelligent shortcuts to your recently and frequently accessed pages.

★ 0stars
23release downloads
≈10active sites
v1.1.3latest · 2mo ago

Install

Download quickjump-admin.zip From the v1.1.3 release on GitHub, Aug 3, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/guilamu/quickjump-admin/releases/download/v1.1.3/quickjump-admin.zip
Updates itself. It ships its own updater, so new versions appear under Dashboard → Updates.

Navigate faster in WordPress admin with intelligent shortcuts to your recently and frequently accessed pages.

Smart Navigation

  • Track all admin page visits automatically
  • View your last 10 recent links from the past 24 hours (configurable)
  • Access your top 10 most frequently used pages over the last 30 days (configurable)
  • Pin important pages for instant access

Quick Access Dropdown

  • Hover-activated dropdown in the admin bar (no click required)
  • Search within your navigation history
  • Visual icons for different content types (posts, pages, media, settings)
  • Relative timestamps showing "2 hours ago" style timing
  • Access count badges for most-used pages

Full Control

  • Customize number of links displayed (1-50)
  • Set time windows for recent and most-used calculations
  • Define excluded URL patterns with regex support
  • Automatic cleanup of old data based on retention period

Key Features

  • Per-User Data: Each user has their own private navigation history
  • Performance Optimized: WordPress transients cache with database indexes
  • Multilingual: Works with content in any language
  • Translation-Ready: All strings are internationalized with POT file included
  • Secure: Nonce verification, capability checks, prepared SQL statements
  • GitHub Updates: Automatic updates from GitHub releases

Requirements

  • WordPress 5.8 or higher
  • PHP 7.4 or higher

Installation

  1. Upload the quickjump-admin folder to /wp-content/plugins/
  2. Activate the plugin through the Plugins menu in WordPress
  3. Start navigating — tracking begins automatically
  4. Hover over Shortcuts in the admin bar to access your pages
  5. Go to Settings → QuickJump Admin to customize options

FAQ

How does the tracking work?

The plugin automatically records each admin page you visit, storing the URL, page title, timestamp, and incrementing the visit count. Data is stored per-user and never shared.

Can I exclude certain pages from tracking?

Yes, go to Settings → QuickJump Admin and add URL patterns to the "Excluded URL patterns" field. Both regex and simple string matching are supported.

How do I pin a page?

Hover over the Shortcuts dropdown and click the star icon next to any link. Pinned items appear at the top and are preserved during cleanup.

Can I change the button label?

Yes, go to Settings → QuickJump Admin and modify the "Admin bar button label" field to any text you prefer.

How is old data cleaned up?

A daily cron job automatically removes data older than the retention period (default: 90 days). Pinned items are always preserved.

Project Structure

.
├── quickjump-admin.php           # Main plugin file with headers
├── uninstall.php                 # Database and options cleanup
├── README.md
├── admin
│   ├── css
│   │   └── admin.css             # Dropdown and menu styles
│   └── js
│       └── admin.js              # Search, pin, and AJAX handlers
├── includes
│   ├── class-quickjump-database.php   # Database CRUD operations
│   ├── class-quickjump-menu.php       # Admin bar dropdown
│   ├── class-quickjump-settings.php   # Settings page
│   ├── class-quickjump-tracker.php    # Page visit tracking
│   └── class-github-updater.php       # GitHub auto-updates
└── languages
    └── quickjump-admin.pot       # Translation template

Changelog

1.1.3

  • Fixed: The settings page tab script no longer hijacks tab clicks on other plugins' settings screens. admin.js loads on every wp-admin page so the shortcuts dropdown is always available, but its tab handler matched WordPress's bare .nav-tab-wrapper class instead of a QuickJump-specific one — on a page with its own tabbed settings screen, clicking a tab silently failed and the URL gained a stray tab=undefined. The handler is now scoped to QuickJump's own settings page.

1.1.2

  • Improved: Rewritten GitHub updater with README.md-based "View Details" modal
  • New: "View details" thickbox link in plugin row meta

1.1.1

  • New: Integrated Guilamu Bug Reporter support
  • New: Added "Report a Bug" link in plugins list

1.0.1

  • Fixed: Shortcut menu now uses the same dark theme as the WordPress admin bar

1.0.0

  • Initial release
  • New: Admin bar dropdown with hover activation
  • New: Recent and most-used page tracking
  • New: Pin/unpin functionality for favorite pages
  • New: Search within navigation history
  • New: Configurable settings page
  • New: GitHub auto-update support
  • New: Automatic data cleanup with retention settings
  • New: Tabbed settings interface
  • New: Quick action to hide links from menu

License

This project is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0) - see the LICENSE file for details.


Made with love for the WordPress community

Releases

5 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.1.3 latest
Aug 3, 2026 2mo ago
quickjump-admin.zip
3
Mar 31, 2026 6mo ago
quickjump-admin.zip
3
Jan 19, 2026 9mo ago
quickjump-admin.zip
7
Jan 3, 2026 9mo ago
quickjump-admin.zip
5
Dec 30, 2025 9mo ago
quickjump-admin.zip
5

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

B grade

Security

QuickJump Admin 1.1.3 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.1.3
Findings
1
Worst severity
medium
Content hash
6b2e60e7254176acaa826a6e…

Findings

  • medium Contributor+ AJAX writes site-wide exclusion regex that settings gate with manage_options

    missing_capability

    wp_ajax_quickjump_hide_link is registered for any logged-in user and, after check_ajax_referer('quickjump_admin_nonce') and current_user_can('edit_posts'), takes $_POST['url'], sanitize_text_field's it, and update_option('quickjump_admin_excluded_patterns') by appending a new line. The same option is registered on the Settings screen with add_options_page(..., 'manage_options') and register_setting(..., 'sanitize_textarea_field'), so options.php refuses the write for anyone below administrator. The AJAX path does not re-check manage_options, does not verify the URL belongs to the caller's visit row, and does not restrict the value to a previously tracked admin URL — a Contributor, Author, Editor, or shop_manager who can load any page with the admin bar (nonce is localized on admin_enqueue_scripts and wp_enqueue_scripts) can POST url=/.*/ or a ReDoS pattern. Consumers QuickJump_Menu::is_url_excluded and QuickJump_Tracker::is_url_excluded run @preg_match($pattern, $url) for every pattern on every dropdown render and every in_admin_header visit, so the write hides shortcuts for every user and feeds attacker-controlled regex into PCRE on staff requests. Pin/rename/search/clear-history stay per get_current_user_id() and are out of scope. Not unauth, not Subscriber, not frontend XSS (esc_textarea / preg_match only).

    includes/class-quickjump-menu.php:651-681

    Recommendation

    Treat hide-from-menu as either (a) a personal preference stored in user meta and filtered only for get_current_user_id(), or (b) an administrator setting. In the AJAX handler require current_user_can('manage_options') if writing quickjump_admin_excluded_patterns, reject values that are not one of the caller's stored URLs, and do not accept arbitrary regex from that endpoint — keep regex editing on the manage_options settings field. Add a length cap before update_option so repeated appends cannot bloat an autoloaded option.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.