WP Manifestindependent plugin directory
manifest / ai / altgenius

AltGenius WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

A WordPress plugin that generates alt text for images using the OpenAI key.

★ 2stars
v1.0.1latest · 9mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/kacperbaranowski/altgenius/archive/refs/heads/main.zip
Updates itself. It ships its own updater, so new versions appear under Dashboard → Updates.

AltGenius - AI-Powered ALT Text Generator for WordPress

AltGenius is an advanced WordPress plugin for automatically generating alternative texts (ALT) for images using OpenAI artificial intelligence. The plugin significantly improves website accessibility and SEO through intelligent image descriptions.

🚀 Key Features

🤖 Automatic ALT Generation

  • AI Generation: Uses GPT models (gpt-4o-mini, gpt-4.1, o3, o4-mini) to create accurate, contextual image descriptions
  • Vision API: Direct image analysis (base64) instead of URL
  • Content Context: Automatic consideration of post/page/product context

⚡ Automation (CRON)

  • Frequency: Every 5 minutes (288×/day) - runs automatically in the background
  • Limit: 30 images per run
  • Performance: ~8,640 requests/day (safe for OpenAI Tier 1: 10,000/day)
  • Detailed logging of all operations to logs/alt-scan-log.txt

🔄 Gutenberg Sync

  • Two-way ALT synchronization between Media Library and Gutenberg image blocks
  • Automatic update: ALT change in library → update in all posts
  • Reverse sync: ALT edit in Gutenberg → save to library
  • Block support: wp:image and classic <img>

📊 Statistics Dashboard

  • Dedicated top-level menu in WordPress
  • Real-time KPIs:
    • All images in library
    • Images with ALT
    • Images without ALT
    • Coverage percentage
  • Unsupported formats (SVG, etc.) - shows how many images cannot be processed
  • Cron Status: Whether active, when next run
  • Model Information: Alert showing supported image formats and limitations of selected AI model

🛡️ Format Validation

  • Supported OpenAI formats: PNG, JPEG, JPG, GIF, WEBP
  • Automatic validation: SVG and other unsupported formats are rejected before sending to API
  • Savings: Prevents 400 errors and wasting API limits
  • Future-ready: Structure prepared for adding other AI providers (e.g., Gemini) with different supported formats

⚙️ Bulk Actions

  • Generate for selected - processing selected images in media library
  • Library button - single "Generate ALT" button for each image

🔄 Automatic Updates

  • GitHub Releases integration - automatic update downloads from kacperbaranowski/AltGenius
  • Public repo - no token required
  • Safe updates - settings preserved

📦 Installation

Method 1: Via WordPress Dashboard

  1. Download the latest version from GitHub Releases
  2. Go to Plugins → Add New → Upload Plugin
  3. Select the downloaded ZIP file
  4. Click Install Now
  5. Activate the plugin

Method 2: Manual Installation

  1. Download the plugin from GitHub
  2. Extract the folder to /wp-content/plugins/
  3. Activate the plugin in WordPress dashboard

Method 3: Git (for developers)

cd wp-content/plugins/
git clone https://github.com/kacperbaranowski/AltGenius.git wp-alt-generator

⚙️ Configuration

1. Get OpenAI API Key

  1. Go to platform.openai.com
  2. Log in or create an account
  3. Create a new API key
  4. Copy the key (keep it in a safe place!)

2. Plugin Configuration

  1. In WordPress go to AltGenius → Settings
  2. Paste the API Key in the appropriate field
  3. Select Model (recommended: gpt-4o-mini for best price-to-quality ratio)
  4. (Optional) Customize the Prompt to your needs
  5. (Optional) Enable Automatic generation on upload
  6. Click Save Changes

📖 Usage

Statistics Dashboard

  1. Go to AltGenius → Statistics
  2. View:
    • KPI Cards: All images, With ALT, Without ALT, Coverage %
    • Cron Status: Whether active, when next run (every 5 minutes)
    • Info: Cron processes ~8,640 images/day

Generating ALT for a Single Image

  1. Go to Media → Library
  2. Find an image without ALT
  3. Click the Generate ALT button
  4. Wait for generation (status will appear next to the button)

Bulk ALT Generation

  1. Go to Media → Library
  2. Select images (checkbox next to thumbnails)
  3. From Bulk Actions menu select Generate ALT for selected
  4. Click Apply

Automatic Generation (CRON)

Cron runs automatically every 5 minutes and:

  • Scans media library for images without ALT
  • Processes 30 images per run
  • Logs all operations to logs/alt-scan-log.txt
  • Requires no intervention - runs in background 24/7

Cron Status: Check in AltGenius → Statistics

🎨 Customization

Changing the Prompt

Default prompt:

Describe this photo in one sentence in English for ALT. URL: {{image_url}}

You can customize it in AltGenius → Settings → Prompt. Use {{image_url}} as a placeholder.

Examples:

Create a short, descriptive alt text for this image: {{image_url}}
Generate WCAG 2.1 compliant alt text for: {{image_url}}

Changing Cron Frequency (advanced)

Default: every 5 minutes. To change, edit in the plugin file (line ~537):

$schedules['every_5_minutes'] = [
    'interval' => 300, // 300 seconds = 5 minutes
    'display'  => __('Every 5 minutes')
];

Example values:

  • 60 - every minute (not recommended - rate limits!)
  • 300 - every 5 minutes (default, recommended for Tier 1)
  • 600 - every 10 minutes
  • 1800 - every 30 minutes

⚠️ Note: After changing, you must deactivate and reactivate the plugin!

Changing Processing Limit

Default: 30 images/batch (optimal for OpenAI Tier 1). Edit in default settings (line ~78):

'scan_limit' => 30

⚠️ Note:

  • Tier 1 (10,000 RPD): max ~35 at 5-minute interval
  • Tier 2+ (50,000 RPD): you can increase to 100-150

🗂️ File Structure

wp-alt-generator/
├── wp-alt-generator.php    # Main plugin file
├── assets/
│   ├── altgpt.js           # JS for media library
│   ├── stats.js            # JS for statistics dashboard
│   └── stats.css           # Styles for statistics dashboard
├── logs/
│   └── alt-scan-log.txt    # Log file (created automatically)
└── README.md

🔐 Security

  • API Key: Stored securely in WordPress database
  • Nonce verification: All AJAX actions secured
  • Capability checks: Only administrators have access (manage_options)

💰 OpenAI API Costs

The plugin uses Vision API (image analysis), which affects costs:

OpenAI Tier 1 (10,000 RPD)

  • Cost per image: ~$0.001 - $0.003 (model: gpt-4o-mini)
  • Daily performance: ~8,640 images (with default settings)
  • Daily cost: ~$8.64 - $25.92
  • Monthly cost: ~$259 - $777

Examples (gpt-4o-mini):

  • 100 images: ~$0.10 - $0.30
  • 1,000 images: ~$1.00 - $3.00
  • 10,000 images: ~$10.00 - $30.00

💡 Tip: Use gpt-4o-mini for lowest costs while maintaining good quality!

Check current prices at OpenAI Pricing.

🐛 Troubleshooting

"Missing API key"

  • Make sure the API key is correctly pasted in AltGenius → Settings
  • Check for extra spaces

"OpenAI error 401"

  • API key is invalid or expired
  • Generate a new key at platform.openai.com

"OpenAI error 429" (Rate Limit)

  • API request limit exceeded
  • Tier 1: Reduce limit to 20-25 images or increase interval to 10 minutes
  • Solution: Upgrade to Tier 2+ on OpenAI

Cron not working

  • Check status: AltGenius → Statistics → "Automatic Generation" section
  • Reset cron: Deactivate and reactivate the plugin
  • WordPress Cron: Check if not disabled (DISABLE_WP_CRON)
  • Logs: Check logs/alt-scan-log.txt for errors

Gutenberg Sync not working

  • Verification: Edit a post in Gutenberg and change an image's ALT
  • Check logs: Saved in logs/alt-scan-log.txt
  • Cache: Clear WordPress and browser cache

High API usage

  • Reduce limit from 30 to 20 (line ~78)
  • Increase interval from 5 to 10 minutes (line ~537)
  • Monitor usage at platform.openai.com/usage

🤝 Support and Bug Reports

📄 License

GPLv2 or later - https://www.gnu.org/licenses/gpl-2.0.html


Was this plugin helpful? Leave a ⭐ on GitHub!

Releases

2 releases.

Tag
Published
v1.0.1 latest
Jan 29, 2026 9mo ago
Jan 28, 2026 9mo ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

AltGenius 1.0.1 · audited by WP Registry

Medium-severity findings.

2 medium
Audited release
1.0.1
Findings
2
Worst severity
medium
Content hash
cd5d6b4d1489706a83dcfdce…

Findings

  • medium ALT sync lets Contributors overwrite any attachment's ALT and rewrite other users' posts

    missing_capability

    WP_Alt_Gutenberg_Sync::on_save_post parses wp:image blocks and <img class="wp-image-N"> tags in any saved post and calls update_post_meta(N, '_wp_attachment_image_alt', <attacker alt>) for whatever attachment ID appears, without checking current_user_can('edit_post', N). The updated_post_meta hook then runs sync_alt_to_posts(), which selects every post (publish/draft/pending/private/future) embedding that attachment and calls wp_update_post() to rewrite its block JSON and alt attribute. A Contributor saving a draft referencing another author's image ID can therefore change ALT text site-wide and modify posts they have no right to edit (SEO spam, defacement, new revisions/modified dates). kses runs in the contributor's context, which prevents script injection.

    wp-alt-generator.php:837-946

    Recommendation

    Only sync when current_user_can('edit_post', $attachment_id) and, when propagating, only update posts the current user can edit (or skip propagation entirely in user context).

  • medium Generate-ALT AJAX has no capability/ownership check and returns debug payload

    missing_capability

    wp_ajax_altgpt_one_generate verifies only the 'altgpt_one_nonce' nonce (printed in the Media library list for any user with upload_files, i.e. Authors) and then runs generate_and_update_alt() on an arbitrary attachment_id. Authors can spend the site's OpenAI credits, overwrite ALT on others' media, and receive the 'request' debug object containing the prompt (which appends the parent post title, including private/draft posts) and the base64-encoded file contents.

    wp-alt-generator.php:237-268,276-348

    Recommendation

    Require current_user_can('edit_post', $id) (and optionally upload_files/manage_options) in ajax_generate_alt and stats handlers; drop the debug payload from responses.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.