WP Manifestindependent plugin directory
manifest / themes / zappbar

ZappBar WP RegistryHigh-severity findings · 2 findingsOpen the reportD+

Automagically adds responsive, customizable mobile UI to (almost) any WordPress theme.

by K.M. Hansen · github.com/kmhcreative/zappbar · website

★ 1stars
0.3.0latest · never

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/kmhcreative/zappbar/archive/refs/heads/master.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.
From the readme github.com/kmhcreative/zappbar ↗
ZappBar Automagically adds responsive, customizable mobile UI to (almost) any WordPress theme. Version: 0.3.0 Requires WordPress Version: 4.9 or higher, PHP 7.4+ Compatible up to: 6.7.1 Beta Version Disclaimer This plugin is still being tested. Do not use it in production unless you are willing to accept the possibility that it could screw up your website while activated. The alterations are non-destructive, so if it causes problems for you deactivating this plugin should restore your site to the way it was. Description I got tired of making the same responsive layout modifications to different WordPress themes over and over again and I wanted an easy way to create and modify a custom interface for mobile devices. So I rolled all the stuff I was doing manually into a single plugin! ZappBar adds highly configurable mobile app style button bars to the top and bottom of any WordPress theme. You can decide at what screen/browser widths they activate (so you can show them only for phones or tablets without altering your site for desktop users). This plugin can also try to convert non-responsive themes to responsive layouts that auto-adjust for mobile devices and it can try

Releases

11 releases.

Tag
Published
0.3.0 latest
Dec 8, 2024 1 year ago
0.2.9
Nov 28, 2022 3 years ago
0.2.8
Nov 22, 2022 3 years ago
0.2.7
Jul 13, 2022 4 years ago
0.2.6
Sep 6, 2020 6 years ago
0.2.5
Sep 18, 2019 7 years ago
0.2.4
Sep 2, 2018 8 years ago
0.2.3
Jun 2, 2018 8 years ago
0.2.2
Jul 22, 2017 9 years ago
0.2
Oct 10, 2015 11 years ago
0.1
Sep 12, 2015 11 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

ZappBar 0.3.0 · audited by WP Registry

High-severity findings.

1 high 1 low
Audited release
0.3.0
Findings
2
Worst severity
high
Content hash
c1e1c3cdb220682b11eb8418…

Findings

  • high reset_zappbar_options runs zb_activate(reset) when nonce verification FAILS

    csrf

    On init, if $_POST['zappbar_reset'] is set, the code calls zb_activate($reset=true) inside the branch where !wp_verify_nonce(...). Valid nonce returns false without resetting. No current_user_can check. Any visitor can POST zappbar_reset=1 (no/invalid nonce) and restore all ZappBar option groups to defaults, disrupting the mobile bar configuration.

    functions/admin_functions.php:9-18

    Recommendation

    Invert the nonce check; require current_user_can('manage_options'); only reset on successful verification.

  • low create_function used in settings API section callbacks

    outdated_software

    class.settings-api.php uses deprecated create_function with section description embedded in generated PHP. Descriptions come from plugin config (admin), not request input, but create_function is removed in PHP 8+ and is unnecessary attack surface.

    functions/class.settings-api.php:112-116

    Recommendation

    Replace with a proper closure or named callback.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →