WP Manifestindependent plugin directory
manifest / admin / admino-lite

Admino Lite WP RegistryHigh-severity findings · 2 findingsOpen the reportD+

by Shokrino · github.com/shokrino/admino-lite · website

★ 7stars
v1.1.0latest · 1 year ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/shokrino/admino-lite/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/shokrino/admino-lite ↗

Add Persian font, themes, dark mode, and custom styles to your WordPress admin panel and login page — lightweight and easy to use.

Description

After activating the plugin, go to Settings → Admino Lite to customize:

  • Persian font for admin & login
  • Admin themes (Shokrino / Dark Mode)
  • Brand color
  • Login page background & logo
  • White label admin bar & header
  • Classic editor for posts & widgets

Installation

  1. Upload admino-lite.zip to /wp-content/plugins/ directory.
  2. Extract the ZIP file.
  3. Activate Admino Lite through the 'Plugins' menu in WordPress.
  4. Go to plugin settings and customize as you wish.

Frequently Asked Questions

What is the name of the Persian font?

It is the free Shabnam font.

Does the dark mode affect the block editor?

Yes — when dark theme is active, the classic editor & block editor both get dark styling.

Screenshots

  1. Admin panel with Shokrino theme.
  2. Dark mode in WordPress admin.
  3. Custom login page with brand logo.
  4. Option settings in Admino Lite panel.

Changelog

1.1.0

  • Added enable/disable Persian font option for admin & login
  • Added Shokrino theme and Dark mode for admin panel
  • Added brand color setting (CSS variable)
  • Added custom login page options:
    • Custom logo
    • Background image or color
    • Hide back-to-blog link
    • Hide forgot password link
    • Hide WordPress language switcher
  • Added white label admin bar:
    • Remove WordPress logo
    • Add custom brand logo & link
    • Hide help & screen options
  • Added classic editor mode for posts & widgets
  • Added auto-update system for the plugin
  • Integrated Optionino Framework for modern settings panel
  • Overall code optimization

1.0.0

  • Initial release

Upgrade Notice

1.1.0

Major update with themes, dark mode, custom login options, white labeling, and more. Please review settings after updating.

Releases

3 releases.

Tag
Published
v1.1.0 latest
Aug 14, 2025 1 year ago
v1.0.1
Aug 12, 2025 1 year ago
v1.0.0
Apr 15, 2024 2 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

Admino Lite 1.1.0 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
1.1.0
Findings
2
Worst severity
high
Content hash
3b860fee0615b067063d88c3…

Findings

  • high AJAX settings save lacks capability check and is registered for unauthenticated users

    missing_capability

    OPTNNO_Ajax_Handler registers both wp_ajax_save_optionino_data and wp_ajax_nopriv_save_optionino_data to the same handler. save_optionino_data only calls check_ajax_referer('optionino_nonce') then update_option($dev_name, $saved_data) for configured fields (admnl_option). There is no current_user_can('manage_options') (or any capability) check. Anyone who can supply a valid optionino_nonce can change login/admin branding options that are echoed into public login CSS and admin head styles.

    inc/optionino-framework/inc/classes/ajax.class.php:48-133

    Recommendation

    Remove the nopriv hook. Require current_user_can matching page_capability (manage_options) after the nonce check before saving.

  • medium Stored option values echoed unsafely into login/admin CSS

    missing_escaping

    admin_logo, admin_bg, and admin_color from admnl_option are printed into <style> blocks on the login and admin screens without esc_url/esc_attr. Image fields are stored via sanitize_text_field+esc_html (not esc_url). Combined with a below-admin write path this enables CSS injection on the public login page.

    admino-lite.php:61-168

    Recommendation

    Escape colors with sanitize_hex_color and URLs with esc_url when echoing into CSS; prefer esc_attr for style attribute contexts.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →