GalleryNFT WordPress

WordPress plugin for creating, managing, and embedding GalleryNFT on-chain curated galleries.

This is an early public release intended for testing on staging or development WordPress installations before production use.

Current Scope

• Admin settings for an EVM RPC URL/Alchemy key, chain ID, factory address, and default Gallery Collection Contract.
• Browser wallet tools for creating a Gallery Collection, minting a Gallery, and adding, editing, or removing gallery items.
• Explicit ERC-4906 marketplace metadata refresh from the connected wallet.
• Saved gallery references by collection contract + gallery ID.
• Generated shortcodes for saved references.
• Direct shortcode support:

[gallerynft id="homepage_gallery"]
[gallerynft contract="0x..." token_id="1"]
[gallerynft contract="0x..." token_id="1" layout="plain" columns="4"]

• Frontend rendering as Bootstrap 5 card grid by default.
• Plain layout mode for theme/template customisation.
• Reads GalleryNFT data from the configured RPC.
• Resolves referenced NFT metadata for EVM tokenURI and Tezos/TzKT metadata where possible.
• Built-in EVM metadata RPC support includes Ethereum, Sepolia, Base, Polygon, and Abstract (2741).
• Abstract can use Alchemy (https://abstract-mainnet.g.alchemy.com/v2/<key>) or the public RPC (https://api.mainnet.abs.xyz).

Install

1. Download the repository and copy gallerynft-wordpress to wp-content/plugins/gallerynft-wordpress, or upload a ZIP of the plugin folder in WordPress admin.
2. Activate GalleryNFT WordPress in WordPress admin.
3. Open GalleryNFT in the admin menu.
4. Configure RPC URL and optionally factory/default Gallery Collection Contract.
5. Add a GalleryNFT reference and copy the shortcode.

Requirements

• WordPress 6.4 or newer.
• PHP 8.1 or newer.
• HTTPS for browser-wallet use outside local development.
• An EVM RPC endpoint or Alchemy API key.
• A browser wallet such as MetaMask for on-chain writes.

Notes

• The plugin never asks for or stores a private key.
• Wallet writes happen in the browser via MetaMask or another injected EVM wallet.
• The shortcode cache uses WordPress transients for 10 minutes.
• Bootstrap markup is emitted, but Bootstrap itself is not enqueued. This is intentional for LiveCanvas/Bootstrap themes.
• Interactive HTML and SVG media are sandboxed when rendered.
• The optional public media proxy does not permanently store NFT media. It streams remote media with browser cache headers and rejects unsafe URLs using WordPress URL validation.
• Treat RPC and Alchemy credentials saved in WordPress as server-side secrets. They are used by WordPress and are not intentionally included in frontend JavaScript.

Security

Please report security issues privately using the process in SECURITY.md, rather than opening a public issue.

Future Work

• Admin-side event/index cache for faster gallery browsing.
• Template override files for theme developers.
• Optional custom IPFS and Arweave gateway settings.