WP Manifestindependent plugin directory
manifest / builders / oxygen-html-converter

Oxygen HTML Converter WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Convert HTML into native, editable Oxygen Builder 6 documents for WordPress — safe imports, Builder persistence, and honest scope reporting.

★ 12stars
25release downloads
v0.9.0-beta.1latest · never

Install

Download oxygen-html-converter-0.9.0-beta.zip From the v0.9.0-beta.1 release on GitHub, Jul 23, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/kamilskicki/oxygen-html-converter/releases/download/v0.9.0-beta.1/oxygen-html-converter-0.9.0-beta.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Convert pasted HTML into native Oxygen Builder 6 content that can be edited and saved in the builder.

This repository is the public Core plugin. The long-term product goal is simple: paste HTML, get a native Oxygen document, and continue editing without validation errors or broken document state.

Current staging candidate:

  • v0.9.1-beta, the compatibility and import-integrity update; public publication is separate from staging deployment.
  • WordPress.org promotion uses the numeric stable tag 0.9.1; the plugin runtime retains the 0.9.1-beta prerelease version.

What Core Does

  • Converts full HTML fragments and pages into native Oxygen elements
  • Preserves IDs, classes, data attributes, and inline styles
  • Supports builder paste/import flows
  • Maps supported safe interactions; executable script fallback requires explicit unsafe opt-in and permission
  • Keeps imported content editable in Oxygen Builder

Supported Scope

Core is intended for:

  • single-page marketing and landing-page HTML
  • inline styles
  • utility-first markup, especially Tailwind-like classes
  • native Oxygen conversion of supported utility styling
  • common frontend interactions such as nav toggles, anchor scroll, reveal-on-scroll, counters, and simple inline handlers

Core is not yet a promise of perfect conversion for every arbitrary frontend stack on the web.

Detailed scope:

Import Methods

  • Admin page: Tools -> Oxygen HTML Converter
  • Builder paste: Ctrl+V
  • Builder import modal: Ctrl+Shift+H

Requirements

  • WordPress 6.5+
  • PHP 8.2+
  • Oxygen Builder 6.1.0 or 6.1.3 (stable); 6.2.0-beta.8 is an explicitly experimental compatibility target. Other unverified versions fail closed.
  • Logged-in user with manage_options by default

The required capability can be changed with oxy_html_converter_required_capability.

Open Core Model

This repo contains only the public Core.

  • Core owns conversion, builder-safe serialization, editability, and baseline parity
  • Pro should extend Core through hooks, not patch Core files
  • Core must not require Pro for the import/editability guarantee

More detail:

Project Docs

Installation

  1. Download the plugin ZIP attached to the latest GitHub release.
  2. In WordPress admin, go to Plugins -> Add New -> Upload Plugin.
  3. Upload the ZIP and activate it.
  4. Ensure a supported Oxygen Builder version is installed and active.

Do not install GitHub's automatically generated “Source code” archives as the WordPress plugin package. Use the attached oxygen-html-converter-*.zip artifact, which is built and verified by the repository release tooling.

Testing

  • Canonical reproducible inputs and their stable contract: fixtures/html/fixture-index.json
  • Fast gate: npm run check
  • PHP unit gate: composer test
  • JS tests: npm run test:js
  • Hermetic fixture gate: npm run test:fixtures:local
  • Build and hash the exact release artifact: npm run build:zip
  • Install that explicit ZIP on the maintained SSH staging target using the commands in docs/RELEASE_CHECKLIST.md
  • Focused staging fixture gate: npm run test:fixtures -- --ssh-host=oxyconvo.lab --wordpress-root=/var/www/wordpress
  • Staging browser round-trip: npm run test:staging:browser -- --base-url=https://oxyconvo.lab --page-id=<id>
  • Docker-only legacy live helpers remain available for isolated local debugging; they are not the canonical release target
  • Release verification: npm run release:verify
  • Build release ZIP: npm run build:zip

Extension Hooks

Core exposes versioned extension points for add-ons, including Pro:

  • oxy_html_converter_before_boot
  • oxy_html_converter_core_init
  • oxy_html_converter_loaded
  • oxy_html_converter_feature_flags
  • oxy_html_converter_builder_script_data
  • oxy_html_converter_after_enqueue_builder_scripts
  • oxy_html_converter_convert_options
  • oxy_html_converter_required_capability
  • oxy_html_converter_preview_options
  • oxy_html_converter_batch_options
  • oxy_html_converter_tree_builder
  • oxy_html_converter_conversion_result
  • oxy_html_converter_convert_response
  • oxy_html_converter_batch_response
  • oxy_html_converter_preview_response
  • oxy_html_converter_expose_error_details

API compatibility is versioned via OXY_HTML_CONVERTER_API_VERSION.

License

GPL-2.0-or-later. See LICENSE.

Support And Security

  • Read SUPPORT.md before opening a question or bug report.
  • Use the structured GitHub issue forms for reproducible bugs and feature requests.
  • Follow SECURITY.md and report vulnerabilities privately.

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v0.9.0-beta.1 latest
Jul 23, 2026 3mo ago
oxygen-html-converter-0.9.0-beta.zip
11
Feb 21, 2026 8mo ago
oxygen-html-converter-v0.8.0-beta.1.zip
14
B grade

Security

Oxygen HTML Converter 0.9.0-beta · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
0.9.0-beta
Findings
1
Worst severity
medium
Content hash
a64c55b6f45a4c99bab500b7…

Findings

  • medium Stored XSS via imported CSS style-tag breakout (unfiltered_html bypass)

    xss_stored

    Imported CSS is stored unsanitized and printed into frontend <style> elements. Plugin.php only runs a case-sensitive str_replace('</style', '<\/style', $css) before echoing page-scoped CSS; HTML tokenizers close </style> case-insensitively, so </STYLE><script>…</script> (or </Style) breaks out and executes for every visitor. Global CSS from oxy_html_converter_global_styles is attached with wp_add_inline_style(); core's stripos('</style') warning only strips a wrapping <style>…</style> pair and still emits a leftover </STYLE><script> payload inside the printed tag. The plugin's own executable-code gates (Ajax::cssCodeContainsExecutableMarkers, OxygenPageImporter::cssContainsUnsafeExecutableMarkers, currentUserCanUseExecutableImport requiring unfiltered_html) do not treat style-tag breakout as executable, so a manage_options user who lacks unfiltered_html (WordPress multisite site admin, or a custom role granted only manage_options) can persist the payload via wp_ajax_oxy_html_import_page importPayload.pageCss / styleRouting.pageCss / globalCss without allowExecutableCode. Write sinks: PageStyleRepository::saveForPost → _oxy_html_converter_page_styles; GlobalStyleRepository::saveFromPayload → oxy_html_converter_global_styles. On requests where get_queried_object_id() is 0, resolveCurrentPostId() also accepts raw $_GET post/post_id/id/page_id with no post_status or capability check, so draft/private imported CSS can be forced onto a public page. Subscriber-or-equivalent cannot write these stores on a default install.

    src/Plugin.php:112-127

    Recommendation

    Treat any '</style' sequence as executable content regardless of case (stripos / regex with the i flag) and reject it unless the user has unfiltered_html and has opted into allowExecutableCode. Neutralize breakouts by stripping or encoding all case variants of </style, </Style, etc., including whitespace/newline before '>'. Do not echo unpublished post CSS from unauthenticated query args; resolve the current public queried object only. Mirror the same check on global CSS before wp_add_inline_style().

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.