WP Manifestindependent plugin directory
manifest / ecommerce / hdwebmobile-recent-sales-notifications

HDWebmobile Recent Sales Notifications

A server-rendered recent-sales popup for WooCommerce — no live endpoint, no PII, ever.

by htrxuan - Han Tran · github.com/htrxuan/hdwebmobile-recent-sales-notifications · website

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/htrxuan/hdwebmobile-recent-sales-notifications/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/htrxuan/hdwebmobile-recent-sales-notifications ↗

A "Someone just bought…" popup built entirely on the server — there is no live endpoint a visitor's browser ever calls for order data.

Description

Shows a small popup cycling through recent real orders — "Someone bought {Product} 2 hours ago" — built from your store's own completed/processing orders.

Why this plugin exists

"Live sales notification for WooCommerce" (≤ 2.3.39) shipped CVE-2025-12955 (CWE-862 Missing Authorization) — its getOrders function had no authorization check, letting unauthenticated visitors extract customer data.

Closed by construction — not by fixing an endpoint, but by having none:

  • Nothing is fetched live. The list is computed server-side on render and handed to a script as a fixed payload — no AJAX action, no REST route, returns order data.
  • Only two narrow fields ever leave the order — a public product name/URL and a relative time. No name, email, address, order id, or total is ever read.
  • Location is off by default, and coarse even when enabled — only a two-letter country code, never a city/name/address.
  • The script only writes plain text — never innerHTML, never fetches anything itself.

Features

  • Unobtrusive "Someone just bought…" popup
  • Configurable look-back window, display duration, interval
  • Optional (off by default) country-level location only
  • No custom DB table; briefly cached results
  • Bottom-left or bottom-right placement

Limitations

  • Shows only the first product per order
  • No per-product opt-out in this version
  • No admin preview beyond the live storefront

Installation

  1. Upload to /wp-content/plugins/hdwebmobile-recent-sales-notifications, or install through the WordPress plugins screen.
  2. Activate. WooCommerce must already be installed and active.
  3. Go to WooCommerce > HDWebmobile > Recent Sales Notifications, enable, and save.

License

GPLv2 or later — https://www.gnu.org/licenses/gpl-2.0.html