WP Manifestindependent plugin directory
manifest / utilities / super-star-chore-chart

Super Star Chore Chart WP Registry grade B-. Medium-severity findings · 3 findingsWP RegistryMedium-severity findings · 3 findingsOpen the reportB-

A real‑time, family‑synced chore chart for WordPress. Super Star Chore Chart lets families manage weekly chores together across multiple devices with instant updates. Each family gets shared kid tabs, paid/unpaid tasks, daily checkboxes, weekly earnings summaries, templates, archives, and a clean print mode — all backed by server‑side storage

★ 0stars
3release downloads
v2.4.8latest · 4mo ago

Install

Download super-star-chore-chart.zip From the v2.4.8 release on GitHub, Jun 23, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/qrussell/super-star-chore-chart/releases/download/v2.4.8/super-star-chore-chart.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

A SaaS-Style WordPress Plugin for Family Chore Management

Super Star Chore Chart is a family‑friendly, server‑synced chore management system built as a WordPress plugin. It helps families organize daily responsibilities, track paid and unpaid tasks, and keep everyone in sync across multiple devices.

With recent updates, it now functions as a standalone Progressive Web App (PWA) with isolated user accounts, meaning your family members never have to see or interact with the WordPress dashboard!


✨ New in Version 2.4+

📱 Progressive Web App (PWA)

  • Installable: Users can install the chore chart directly to their iOS or Android home screens for a native full-screen app experience.
  • Smart Prompts: Native Android install prompts and custom iOS Safari instructions.

🔐 Isolated App Authentication

  • No WP Accounts Needed: Uses a custom, secure cookie-based login system. Users don't need WordPress subscriber accounts.
  • Self-Serve Password Resets: Built-in "Forgot Password" flow sends a secure, time-limited reset link via email.

🔗 Magic Link Invites

  • One-Click Joins: Family admins can generate a secure "Invite Link."
  • Frictionless: When clicked, family members are instantly logged in via a guest account and added to the family chart—no passwords required!

🌗 Light / Dark Mode

  • System-Aware: Automatically detects the user's OS preference (Dark or Light mode).
  • Manual Toggle: A simple toggle switch in the app header allows users to override the theme, saving their preference instantly.

👨‍👩‍👧 Core Features

Family System & Live Sync

  • Create a family with a shared name and password (or use Magic Links).
  • All members see and update the same chore chart.
  • Changes sync automatically across all devices via background server polling.

🧒 Per‑Kid Chore Tabs

  • Add, rename, or remove kids easily.
  • Each kid gets their own chore list with daily checkboxes (Mon–Sun).
  • Real-time per‑task totals and weekly earnings summaries.
  • Clean black‑and‑white Print Mode for pinning to the fridge.

🧹 Chore Categories & Pay

Organized into intuitive groups (Personal Care, Kitchen Crew, Brain Gigs, etc.). Supports:

  • Unpaid Team Duties - Paid Gigs (Choose between Flat Rate or Per-Day pay structures)

🛠️ Edit Mode & Archives

  • Easily rename tasks, adjust pay rates, or toggle paid/unpaid status.
  • Save a Default Template to quickly reset the board every Sunday.
  • Automatically archive completed weeks to review past performance and earnings.

📦 Installation

  1. Download the latest plugin ZIP from the Releases page.
  2. In your WordPress Admin, go to Plugins → Add New → Upload Plugin.
  3. Upload super-star-chore-chart.zip and click Install Now, then Activate.
  4. A Chore Chart page is automatically created for you at /chore-chart/.
  5. Use the shortcode [chore_chart] on any page to render the app.

(Note: Ensure your WordPress Permalinks are set to "Post name" for Magic Links and Password Resets to route correctly).


🧰 How to Use

  1. Create an Account: Visit the page where your shortcode is located and create an account with your email.
  2. Create a Family: Create a new family name and secure password.
  3. Invite Members: Click the "🔗 Invite Link" button to copy a magic URL. Text it to your kids or spouse to let them join instantly!
  4. Customize: Click "⚙ Edit Settings" to set up your default tasks.
  5. Track Progress: Kids check off tasks daily. Earnings calculate automatically.
  6. Archive: At the end of the week, click "🗄 Archive & New Week" to save the history and reset the board!

🗂️ Folder Structure

super-star-chore-chart/
├── super-star-chore-chart.php  # Main plugin & URL router
├── readme.txt                  # WP repository readme
├── assets/                     
│   ├── app.js                  # Frontend logic (PWA, Theme, App State)
│   ├── app.css                 # UI Styling (CSS Variables for Dark Mode)
│   ├── sw.js                   # Service Worker for PWA installation
│   └── icon.png                # PWA App Icon
├── includes/                   
│   ├── ajax.php                # Backend endpoints (Saves, Syncs, Emails)
│   ├── db.php                  # Database table creation
│   ├── login.php               # Auth handlers
│   └── shortcode.php           # Renders the Login/App UI
└── admin/                      
    └── settings.php            # WP Admin dashboard settings

🤝 Contributing

Contributions, issues, and feature requests are always welcome!

Fork the repository

Create your feature branch (git checkout -b feature/AmazingFeature)

Commit your changes (git commit -m 'Add some AmazingFeature')

Push to the branch (git push origin feature/AmazingFeature)

Open a Pull Request

📝 License

This project is open source and available under the GPLv2 or later License.

❤️ Credits

Created by Quentin to help families build responsibility, independence, and teamwork through a fun, structured, and modern chore system.

Releases

7 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v2.4.8 latest
Jun 23, 2026 4mo ago
super-star-chore-chart.zip
2
Jun 19, 2026 4mo ago
super-star-chore-chart.zip
0
Jun 13, 2026 4mo ago
super-star-chore-chart.zip
1
Jun 12, 2026 4mo ago
super-star-chore-chart.zip
0
Jun 9, 2026 4mo ago
super-star-chore-chart.zip
0
Jun 9, 2026 4mo ago
super-star-chore-chart.zip
0
Jun 7, 2026 4mo ago
super-star-chore-chart.zip
0
B- grade

Security

Super Star Chore Chart 2.4.8 · audited by WP Registry

Medium-severity findings.

2 medium 1 low
Audited release
2.4.8
Findings
3
Worst severity
medium
Content hash
2646197bb884d80cd5ab436e…

Findings

  • medium Family password change allowed for any member role

    missing_capability

    sscc_ajax_sscc_change_family_password only requires sscc_check_family_auth (any membership). A member-role user can reset the family join password, locking out the family admin or facilitating unauthorized joins.

    includes/ajax.php:396-403

    Recommendation

    Require family role === 'admin' before changing the family password.

  • medium Missing nonce on unauthenticated register/login AJAX

    missing_nonce

    sscc_user_register and sscc_user_login are exposed via wp_ajax_nopriv without check_ajax_referer. Attackers can CSRF victims into creating chore-chart accounts or flood registrations on the custom sscc_users table.

    includes/login.php:7-82

    Recommendation

    Require a nonce on register/login and consider rate limiting.

  • low Password-reset cookie uses raw user id instead of HMAC token

    insecure_config

    After sscc_save_new_password, setcookie stores the numeric user id, but sscc_get_auth_user expects base64(uid|hmac). Reset leaves users unauthenticated until they log in again; inconsistent auth cookie formats increase future footgun risk (magic-link path similarly sets raw id).

    includes/ajax.php:426-435

    Recommendation

    Issue the same HMAC cookie format as login/register after password reset.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.