WP Manifestindependent plugin directory
manifest / users / virtual-member

Virtual Member WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

Add virtual member to WordPress.

★ 0stars
390release downloads
12kcomposer installs
1.4.2latest · 1 year ago

Install

Download virtual-member.zip From the 1.4.2 release on GitHub, Jun 26, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/kuno1/virtual-member/releases/download/1.4.2/virtual-member.zip

On Packagist as kunoichi/virtual-member:

composer require kunoichi/virtual-member
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Virtual Member is a WordPress plugin that creates a custom post type called "member" to represent authors who are not WordPress users. This allows you to assign virtual members as authors to your posts, which is particularly useful when the actual content creator is different from the person who publishes it in WordPress.

Description

Virtual Member provides a solution for websites that need to display content from authors who don't have WordPress user accounts. Instead of creating WordPress user accounts for every author, you can create "member" posts that contain author information such as name, profile picture, biography, and contact methods.

Key Features

  • Create virtual members with profile pictures, descriptions, and contact information
  • Assign virtual members as authors to any post type
  • Support for single or multiple authors per post
  • Group members using taxonomies
  • Customize the member post type label and URL structure
  • Set a default member for posts without specified authors
  • Designate members as organizations or site representatives
  • Automatic Open Graph Protocol metadata for virtual members
  • Compatible with both classic editor and block editor

Use Cases

  • Publishing content from guest authors without creating WordPress user accounts
  • Managing content where the actual author is different from the WordPress user who publishes it
  • Creating bylines for organizations rather than individuals
  • Maintaining a staff directory with author archives

Installation

  1. Upload the virtual-member folder to the /wp-content/plugins/ directory
  2. Activate the plugin through the 'Plugins' menu in WordPress
  3. Go to "Member Setting" under the "Member" menu to configure the plugin

Customization

Basic Settings

  1. Navigate to "Member" > "Member Setting" in your WordPress admin
  2. Under "Basic Setting", select which post types should have virtual members as authors
  3. Optionally set a default member for posts without specified authors
  4. Choose whether the member post type should be public (have its own permalink)
  5. Configure the URL prefix for member archives (default is "member")
  6. Save your changes

Creating Virtual Members

  1. Go to "Member" > "Add New" in your WordPress admin
  2. Enter the member's name in the title field
  3. Add a description in the content editor
  4. Set a profile picture using the featured image
  5. Add contact information in the "Contact Methods" meta box
  6. Optionally mark the member as an organization or site representative
  7. Assign the member to groups using the "Group" taxonomy
  8. Publish the member

Assigning Members to Posts

  1. Edit a post of a type that you've enabled for virtual members
  2. Look for the "Member" meta box in the sidebar
  3. Select a member from the dropdown (single author mode) or use the search field to add multiple members (multiple author mode)
  4. Update the post

Advanced Settings

Multiple Authors

  1. Go to "Member" > "Member Setting"
  2. Under "Basic Setting", select "Multiple Authors" in the "Allow Multiple Assign" option
  3. Save your changes
  4. When editing posts, you can now add multiple members as authors

Custom Contact Methods

  1. Go to "Member" > "Member Setting"
  2. Find the "Contact Methods" field
  3. Enter custom contact methods in CSV format (e.g., facebook,Facebook)
  4. Save your changes
  5. These contact methods will appear in the member editor

Member Groups

  1. Go to "Member" > "Groups"
  2. Create groups to categorize your members (e.g., "Staff", "Contributors", "Editors")
  3. When creating or editing members, assign them to these groups

Frontend Display

When a post has a virtual member assigned as its author:

  • The author name will display the member's name instead of the WordPress user
  • The author link will point to the member's page or archive
  • The author avatar will use the member's profile picture
  • Author description and contact information will come from the member post

FAQ

Can I use this plugin alongside co-authors?

Yes, Virtual Member can be used alongside other author management plugins, but you may need to ensure compatibility through custom code.

How do I display custom contact methods on the frontend?

The plugin automatically hooks into WordPress's author template functions. You can use standard WordPress functions like get_the_author_meta('facebook') to display custom contact methods.

Can I change the URL structure for member archives?

Yes, go to "Member" > "Member Setting" and change the "URL Prefix" setting. After changing this setting, remember to flush your permalinks by going to Settings > Permalinks and clicking "Save Changes".

How do I set a member as the default author for all posts?

  1. Create a member that will serve as the default
  2. Go to "Member" > "Member Setting"
  3. Select this member in the "Default Author" dropdown
  4. Save your changes

Can I use this plugin with custom post types?

Yes, you can enable virtual members for any public post type in the plugin settings.

How do I display multiple authors on the frontend?

If you've enabled multiple authors, you'll need to use custom code to display all authors. You can use the get_members() function from the CommonMethods trait to retrieve all members assigned to a post.

// Example code to display all authors of a post
$public_screen = \Kunoichi\VirtualMember\Ui\PublicScreen::get_instance();
$members = $public_screen->get_members(get_the_ID());
foreach ($members as $member) {
    echo get_the_title($member);
    // Display other member information
}

Is this plugin compatible with the block editor?

Yes, Virtual Member works with both the classic editor and the block editor (Gutenberg).

Can I designate a member as an organization?

Yes, when editing a member, check the "This is organization" option in the Organization meta box. This will also affect the schema.org markup generated for the member.

Releases

25 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.4.2 latest
Jun 26, 2025 1 year ago
virtual-member.zip
161
Jun 24, 2025 1 year ago
virtual-member.1.4.1.zip
2
Jun 24, 2025 1 year ago
virtual-member.1.4.0.zip
1
May 15, 2025 1 year ago
virtual-member.zip
10
May 15, 2025 1 year ago
virtual-member.zip
2
May 8, 2025 1 year ago
virtual-member.zip
6
Mar 19, 2025 1 year ago
virtual-member.zip
54
Oct 31, 2024 1 year ago
virtual-member.zip
35
Oct 30, 2024 1 year ago
virtual-member.zip
0
Jul 11, 2024 2 years ago
virtual-member.zip
6
Jul 11, 2024 2 years ago
virtual-member.zip
7
Apr 23, 2024 2 years ago
virtual-member.zip
2
Apr 15, 2024 2 years ago
virtual-member.zip
1
Apr 15, 2024 2 years ago
virtual-member.zip
1
Sep 1, 2023 3 years ago
virtual-member.zip
23
Dec 5, 2022 3 years ago
virtual-member.zip
17
Dec 2, 2022 3 years ago
virtual-member.zip
5
Jan 18, 2022 4 years ago
virtual-member.zip
9
Jan 17, 2022 4 years ago
virtual-member.zip
3
Jan 17, 2022 4 years ago
virtual-member.zip
5
Dec 29, 2021 4 years ago
virtual-member.zip
11
Nov 1, 2021 4 years ago
virtual-member.zip
9
Sep 15, 2021 5 years ago
virtual-member.zip
8
Sep 14, 2021 5 years ago
virtual-member.zip
6
Sep 14, 2021 5 years ago
virtual-member.zip
6
C- grade

Security

Virtual Member 1.4.2 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.4.2
Findings
1
Worst severity
high
Content hash
ac64f444ab9ebcaa3f2e1a92…

Findings

  • high Author+ stored XSS via JSON-LD script breakout in member contact methods

    xss_stored

    Member contact methods are stored unsanitized and later emitted in a JSON-LD script tag without HTML-tag encoding. MemberEditor::save_member() writes each contact-method field with raw filter_input(INPUT_POST, $key) (no sanitize_text_field/esc_url_raw/kses). The member CPT is registered without a custom capability_type, so it inherits 'post': an Author can create and publish members. StructuredDataProvider::display_json_ld() runs on is_singular('member') (the documented public member profile), json_encodes the profile with JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE (no JSON_HEX_TAG), and printf()s it into <script type="application/ld+json">. get_profile_schema() copies any contact-method value matching ^https?:// into mainEntity.sameAs. A payload such as https://evil.example/</script><script>alert(document.domain)</script> therefore appears as a literal </script> in the page source; the HTML parser terminates the JSON-LD script and executes the following script in the site origin for every visitor. Empirically, json_encode(..., JSON_UNESCAPED_SLASHES) leaves </script> intact; JSON_HEX_TAG encodes it as \u003C/script\u003E and stops the breakout. sameAs is filled from wp_get_user_contact_methods() (kvm_contact_methods CSV and other user_contactmethods filters), which is the plugin's own staff-directory feature. Name/jobTitle are kses/sanitize_text_field for Authors, so contact methods are the Author-level vector; users with unfiltered_html can also break out via the member title in the same script tag.

    src/Kunoichi/VirtualMember/Services/StructuredDataProvider.php:49-50,86-93

    Recommendation

    Encode JSON-LD with JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT (or wp_json_encode with those flags) so </script> cannot break out of the script element. Sanitize contact-method values on save with esc_url_raw() for URL fields and sanitize_text_field() otherwise, and do not put non-URL values into sameAs.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.