WP Manifestindependent plugin directory
manifest / ecommerce / add-to-cart-form-shortcode

Add to Cart Form Shortcode for WooCommerce WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Add [add_to_cart_form] shortcode that display a single product add to cart form for WooCommerce

★ 21stars
94release downloads
≈30active sites
3.1.0latest · 2 years ago

Install

Download wc-add-to-cart-form-shortcode-3.0.2.zip From the 3.1.0 release on GitHub, Jan 4, 2024

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/helgatheviking/add-to-cart-form-shortcode/releases/download/3.1.0/wc-add-to-cart-form-shortcode-3.0.2.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Add [add_to_cart_form] shortcode that display a single product add to cart form for WooCommerce.

The default WooCommerce shortcodes can be a little lacking for complex product types or for products with custom add-ons such as Name Your Price. For example: [add_to_cart id="99"] shows only the loop add to cart button, which lacks the hooks that a plugin such as Name Your Price needs to display it's own input.

And the product page shortcode, [product_page id="99"] displays the entire product page, which may or may not work well for the layout you are trying to build.... especially with page builders that don't have good WooCommerce modules.

The [add_to_cart_form] solution

The newly added [add_to_cart_form] shortcode lives in between the [add_to_cart] and [product_page] shortcodes. It displays the entire add to cart form from the single product page, but only the form.

How to Use

Like any other shortcode you can paste it into your page/post content. Or use it in a page builder's text editor module. The shortcode supports product identification by either product ID:

[add_to_cart_form id="99"]

or product SKU:

[add_to_cart_form sku="GUACAMOLE99"]

To use in a template you would use:

echo do_shortcode( '[add_to_cart_form id="99"]' );

Additional Parameters

show_price

By default, the price template will be displayed just prior to the add to cart template. You can hide it by setting the parameter to "false".

[add_to_cart_form id="99" show_price="false"]

hide_quantity

The quantity buttons can look a little weird when displayed outside the product page. You can hide them, by setting the parameter to "true". Effectively, this sets the quantity to 1. [add_to_cart_form id="99" hide_quantity="true"]

allow_form_action

This form action is disabled by default so the page will refresh in place instead of redirecting to the single product page. However, the form action is filterable and so some users may wish to allow the page to redirect (for example, directly to the cart). To enable the form action, you can use [add_to_cart_form id="99" allow_form_action="true"]

Screenshot

Here's an example of the shortcode used on a simple Name Your Price product

Add to cart form, displays Name Your Price text input

Download

Download latest release

Donations

If you find this plugin helpful, please consider donating to the USA Women's National Handball Team.

Releases

3 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
3.1.0 latest
Jan 4, 2024 2 years ago
wc-add-to-cart-form-shortcode-3.0.2.zip
45
Oct 11, 2022 4 years ago
wc-add-to-cart-form-shortcode-3.0.2.zip
49
May 6, 2022 4 years ago
tag only
—

Active-site estimate ≈30 comes from the median of recent superseded releases. Method.

B grade

Security

Add to Cart Form Shortcode for WooCommerce 3.0.2 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
3.0.2
Findings
1
Worst severity
medium
Content hash
568f7f47a5d7e88e70024d44…

Findings

  • medium Contributor+ unpublished product disclosure via [add_to_cart_form] status attribute

    information_disclosure

    kia_add_to_cart_form_shortcode copies the attacker-controlled status shortcode attribute into WP_Query post_status (default publish) with no perm=readable, no invalid-status denylist, and no current_user_can('read_product') after the query. WP_Query treats an explicit post_status as a pass-through, so draft, private, pending, trash, future, any, and comma-separated lists all return. A Contributor can preview (an Author can publish) [add_to_cart_form id="N" status="draft"] and the handler renders woocommerce_template_single_price() plus woocommerce_template_single_add_to_cart() for that unpublished product — list/sale price, variation attributes, and typically data-product_variations JSON. This is the same product_page shortcode bug WooCommerce patched in 8.6 as CVE-2024-1310; this fork never added the read_product gate. Subscriber/customer cannot insert shortcodes on a default role map.

    wc-add-to-cart-form-shortcode.php:64-174

    Recommendation

    Mirror WooCommerce 8.6+ WC_Shortcodes::product_page: reject trash (and other invalid statuses), and after WP_Query if the product is not publish and the current user cannot read_product for that ID, return empty. Optionally drop the status attribute entirely and always query publish.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.