WP Manifestindependent plugin directory
manifest / content / oes-core

OES Core WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

OES is a WordPress plugin. It is a standardized web-based open source platform for building and maintaining scientific online encyclopedias, publicly available, free of charge on the internet and accessible worldwide.

★ 9stars
3.0.1latest · 22d ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/open-encyclopedia-system/oes-core/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Open Encyclopedia System

Building and maintaining online encyclopedias.

Description

The Open Encyclopedia System (OES) is a modular and configurable software for creating, publishing and maintaining online encyclopedias in the humanities and social sciences that are accessible worldwide via Open Access. OES adds a web-based open source software for article-based publication formats to already available options for electronic publishing and thus closes existing gaps in the Open Access publishing landscape.

The development of the Open Encyclopedia System Software was funded by the German Research Foundation (DFG) from 2016-2020 as part of the project From 1914-1918-online to the Open Encyclopedia System (see GEPRIS entry). For more information about the project and existing OES applications please visit our website.

Features

  • Publish citable articles
  • Manage version control for articles
  • Define and edit relationships between entities
  • Integrate Linked Open Data (LOD) APIs
  • Manage users, posts, entities, access rights, and roles
  • Customize article display via the configuration interface

Dependencies

An OES installation typically includes:

  • OES Core plugin – foundational functionality
  • OES Project plugin – application-specific features
  • OES Theme (optional) – for custom front-end display

Required Plugin:

Installation

  1. Download the OES Core plugin from GitHub and add it to your WordPress plugin directory.
  2. Install and activate required dependencies (e.g., ACF).
  3. Activate the OES Core plugin.
  4. Install a project-specific OES plugin or use the OES Demo plugin (see its documentation).
  5. (Optional) Install and activate an OES-compatible theme.

Support

This repository is not suitable for support. Support is currently provided via our email help desk info@open-encyclopedia-system.org. We answer questions related to the OES plugin and its usage. For further information about online encyclopaedias and possible customization please visit our website.

Documentation

A user and technical manual for the Open Encyclopedia System is available online at:
https://manual.open-encyclopedia-system.org/

The manual is actively being expanded and updated.
If you have questions or need help with specific features, feel free to contact our help desk:
info@open-encyclopedia-system.org

Demo Version

You can experience the frontend and editorial layer of an exemplary application. This application includes a basic online encyclopedia and a WordPress theme. Download the OES Demo plugin and the OES theme from github (https://github.com/open-encyclopedia-system/). Activate plugin and theme and start creating content or import demo data.

Contributing

If you want to contribute to OES please contact the help desk info@open-encyclopedia-system.org.

Credits

Developed by the Digitale Infrastrukturen, Freie Universität Berlin FUB IT, with support from the German Research Foundation (DFG).

Licencing

Copyright (C) 2025 Freie Universität Berlin, FUB IT, Digitale Infrastrukturen This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

Releases

3 releases.

Tag
Published
3.0.1 latest
Oct 1, 2026 22d ago
Sep 21, 2026 1mo ago
Dec 10, 2025 10mo ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

OES Core 3.0.0 · audited by WP Registry

High-severity findings.

2 high
Audited release
3.0.0
Findings
2
Worst severity
high
Content hash
979a4603804cd818918f0cea…

Findings

  • high Unauthenticated post export by ID discloses non-public content

    information_disclosure

    Multiple oes/v1/export/* routes use permission_callback __return_true. The Export helper instantiates OES\Rest\Post with get_post($postID) and serializes fields without verifying the post is publicly viewable or that the requester can read it. Enumerating IDs yields draft/private/password-protected encyclopedia content.

    includes/rest/register.php:22-70

    Recommendation

    Require current_user_can('read_post', $id) or only export posts with post_status publish (and honor password/private rules).

  • high Unauthenticated post export by ID discloses non-public content

    information_disclosure

    Multiple oes/v1/export/* routes use permission_callback __return_true. Export::prepare_post_data instantiates OES\Rest\Post (or format subclass) which loads get_post($postID) and serializes fields without verifying the post is publicly viewable or that the requester can read_post. Enumerating numeric IDs yields draft, private, and password-protected encyclopedia content to unauthenticated callers.

    includes/rest/register.php:22-70

    Recommendation

    Require current_user_can('read_post', $id) or only export posts that are publicly viewable (is_post_publicly_viewable / publish status with password rules).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.