WP Manifestindependent plugin directory
manifest / content / clipit-coupons

ClipIt Coupons WP RegistryHigh-severity findings · 3 findingsOpen the reportD+

ClipIt Coupons is a basic but powerful plugin that uses to create, upload and preview coupons for your visitors to print, view or use directly on your website or blog. With a few words and and even fewer clicks you will be on your way to displaying awesome coupons on your website or blog.

by LeadsNearby · github.com/leadsnearby/clipit-coupons · website

★ 0stars
3.0.2latest · 2mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/leadsnearby/clipit-coupons/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/leadsnearby/clipit-coupons ↗

ClipIt Coupons uses CPT to create coupons for your visitors to print, view or use directly on your website or blog.

Filters

clipit_logo_url

Filters the logo used on the coupon. Use case would be, client has a white logo or logo that contains white and it needs to be visible on a white background.

Shortcodes

[clipit_coupons]

Attributes

  • post_id: Specify a specific coupon to be displayed. No default
  • number_posts: Specify number of coupons to be displayed. Default is 15
  • tag: Pull coupons in by tag slug, e.g., monthly-deals. No default
  • category: Pull coupons in by display category slug, e.g., website. No default

[clipit_rotator]

Attributes

  • tag: Pull coupons in by tag slug, e.g., monthly-deals. No default
  • auto_play: Boolean - Auto play coupon rotator. Default is true
  • duration: Coupon rotator timing in milliseconds. Default is 3500

Releases

Newest 25 of 53 recorded releases.

Tag
Published
3.0.2 latest
Jul 30, 2026 2mo ago
3.0.1
Jul 30, 2026 2mo ago
2.9
Jun 1, 2024 2 years ago
2.7
Sep 26, 2023 3 years ago
2.6
Feb 14, 2023 3 years ago
2.5
Dec 5, 2022 3 years ago
2.4
Nov 22, 2022 3 years ago
2.3
Mar 16, 2021 5 years ago
2.2.14
Mar 15, 2021 5 years ago
2.2.13
Feb 18, 2021 5 years ago
2.2.12
Aug 28, 2020 6 years ago
2.2.11
Aug 28, 2020 6 years ago
2.2.10
Aug 28, 2020 6 years ago
2.2.9
Jul 1, 2020 6 years ago
2.2.7
Feb 19, 2020 6 years ago
2.2.6
Jan 27, 2020 6 years ago
2.2.5
Jan 23, 2020 6 years ago
2.2.4
Oct 2, 2019 7 years ago
2.2.2
Sep 26, 2019 7 years ago
2.2.1
Sep 13, 2019 7 years ago
2.2.0
Sep 12, 2019 7 years ago
2.1.0
Sep 11, 2019 7 years ago
2.0.4
Aug 22, 2019 7 years ago
2.0.3
Aug 22, 2019 7 years ago
2.0.2
Aug 19, 2019 7 years ago
All releases on GitHub →

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

ClipIt Coupons 3.0.2 · audited by WP Registry

High-severity findings.

2 high 1 medium
Audited release
3.0.2
Findings
3
Worst severity
high
Content hash
0114cbe045ec55cd368ebf74…

Findings

  • high Unauthenticated store_client_id writes and echoes client_id

    missing_auth

    store_client_id is nopriv with no auth/nonce. Attacker can update_option('gbp_client_id') and the value is echoed unsanitized (reflected XSS in AJAX response if consumed as HTML).

    lib/admin/admin-functions.php:222-228

  • high Unauthenticated save_location updates gbp_selected_location

    missing_auth

    save_location is nopriv with no auth/nonce; POSTed location_value array is written to gbp_selected_location.

    lib/admin/admin-functions.php:145-157

  • medium Settings save on admin_menu lacks nonce and capability check

    csrf

    clipit_settings_page processes $_POST['clipit_settings'] during admin_menu without check_admin_referer or current_user_can. Any logged-in user who can trigger admin_menu (or CSRF against an admin) can update clipit_* options including css_styling.

    lib/admin/admin-functions.php:7-22

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →