WP Manifestindependent plugin directory
manifest / editor / base47-html-editor

Base47 HTML Editor WP Registry grade D+. High-severity findings · 4 findingsWP RegistryHigh-severity findings · 4 findingsOpen the reportD+

Transform HTML template folders into shortcode-driven components. Includes live editing, automatic asset rewriting, preview modes, theme-set switching, and a full visual management UI inside WordPress.

★ 0stars
v2.9.9.8.1latest · 8mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/stefangoldltd-sudo/base47-html-editor/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Transform any HTML template folder into WordPress shortcodes with a professional Monaco-based live editor, theme-set manager, smart asset loading, and a beautiful Soft UI dashboard.

Description

Base47 HTML Editor allows developers and designers to use static HTML templates inside WordPress by converting them into shortcodes with controlled asset loading and a live editor.

The plugin automatically converts HTML files into shortcodes, loads their CSS/JS only when needed, and provides a full Monaco-powered live editor with real-time preview. Manage multiple template sets, special widgets, and assets with ease — all inside a modern Soft UI dashboard.

Highlights

  • Live HTML editor powered by Monaco (VS Code engine)
  • Automatic shortcode creation for every HTML file
  • Real-time live preview with responsive modes
  • Theme-set management (activate/deactivate template packs)
  • Smart asset loading (Manifest, Smart Loader++, Fallback)
  • Automatic rewriting of image/CSS/JS URLs
  • Special Widgets system with auto-discovery
  • Soft UI admin dashboard for a premium user experience
  • Clean uninstall and full logging system
  • Tested with Elementor, Bricks, Gutenberg, and WooCommerce

Main Features

Live HTML Editor

  • Monaco editor (syntax highlighting, IntelliSense, shortcuts)
  • Real-time preview inside iframe
  • Backup + restore of previous versions

Template & Shortcode System

  • Every HTML file becomes a shortcode [base47-theme-template]
  • Nested shortcodes supported
  • Works with unlimited template folders ending in -templates

Theme Manager

  • Activate/deactivate template sets
  • Set default theme
  • Per-theme asset loading mode

Smart Asset Loader

  • Loads only the CSS/JS required by the specific template
  • Manifest.json support for advanced libraries
  • Prevents conflicts between template sets and theme CSS

Special Widgets

  • Add reusable HTML components such as sliders, hero sections
  • Auto-detection from special-widgets/ folder
  • Shortcode usage: [base47_widget slug="widget-name"]

Installation

  1. Upload the plugin or install via Plugins → Add New.
  2. Activate the plugin.
  3. Place your template folders inside:
    • wp-content/uploads/base47-themes/ (recommended)
    • Or use the built-in template installer to add and manage template sets
  4. Visit Base47 → Theme Manager and activate your template sets.
  5. Use the generated shortcodes anywhere in your pages or page builders.

External Services & Privacy

This plugin does not contact any external services or APIs by default. All template processing, editing, and management happens locally on your WordPress installation.

Data Collection:

  • No personal data is collected or transmitted to external servers
  • All user data remains on your WordPress installation
  • No tracking, analytics, or phone home functionality

Third-Party Libraries: This plugin bundles the following third-party libraries (see THIRD-PARTY-LICENSES.md for full details):

  • Monaco Editor v0.45.0 (MIT License) - Code editor component
  • Font Awesome Free v6.5.1 (Font Awesome Free License) - Icon library
  • jQuery v3.7.1 (MIT License) - JavaScript library

All bundled libraries are GPL-compatible and properly licensed.

Frequently Asked Questions

Can I use my own HTML templates?

Yes. Any folder ending with -templates is detected automatically.

Do CSS and JS load automatically?

Yes. Assets inside assets/css/ and assets/js/ load only when the shortcode is used.

Can I edit templates?

Yes. The built-in Monaco editor provides full live editing and preview.

Is it compatible with page builders?

Yes. Tested with Elementor, Bricks, Beaver Builder, Gutenberg, and WPBakery.

Does this plugin work with WooCommerce?

Yes. The asset loader is designed to minimize conflicts with WooCommerce styling.

Where do I find my shortcodes?

Go to Base47 → Shortcodes to browse all available shortcodes with live previews.

What are Special Widgets?

Reusable HTML components stored inside each template set under /special-widgets/. Each widget can be used with [base47_widget slug="widget-name"].

Can I manage multiple template sets?

Yes. Use the Theme Manager to activate/deactivate unlimited template sets.

Does it create backups?

Yes. The Live Editor automatically creates backups before each save. Use the "Restore" button to view previous versions.

What happens when I uninstall?

On uninstall, all plugin options and generated data are removed. Template files stored in wp-content/uploads/base47-themes/ are preserved and can be manually deleted if desired.

Screenshots

  1. Dashboard overview
  2. Live HTML Editor
  3. Theme Manager
  4. Shortcodes preview
  5. Special Widgets
  6. Settings panel
  7. Logs view
  8. Changelog page

Changelog

3.0.0 – February 6, 2026

  • Initial WordPress.org release
  • Complete internationalization (i18n) support with translation files
  • Enhanced security with proper escaping, sanitization, and nonce validation
  • Improved file deletion security with capability checks and path validation
  • Updated compatibility testing with WordPress 6.9.1
  • Enhanced documentation and privacy disclosures
  • Third-party library licensing documentation
  • Removed external update mechanisms for WordPress.org compliance
  • Professional Monaco-powered live HTML editor
  • Automatic shortcode generation for HTML templates
  • Smart asset loading system (Manifest, Smart Loader, Fallback modes)
  • Theme-set management with activation/deactivation
  • Special Widgets system with auto-discovery
  • Real-time preview with responsive modes
  • Backup and restore functionality
  • Soft UI admin dashboard
  • Complete WordPress coding standards compliance
  • Clean uninstall procedures
  • Comprehensive logging system
  • Mobile-responsive admin interface

Upgrade Notice

3.0.0

Initial WordPress.org release with full internationalization, enhanced security, and comprehensive HTML template management features.

License

GPL v2 or later.

Releases

Newest 25 of 60 recorded releases.

Tag
Published
v2.9.9.8.1 latest
Feb 4, 2026 8mo ago
Feb 4, 2026 8mo ago
Jan 23, 2026 9mo ago
Jan 22, 2026 9mo ago
Jan 22, 2026 9mo ago
Jan 22, 2026 9mo ago
Jan 20, 2026 9mo ago
Jan 19, 2026 9mo ago
Jan 19, 2026 9mo ago
Jan 19, 2026 9mo ago
Jan 19, 2026 9mo ago
Jan 18, 2026 9mo ago
Jan 15, 2026 9mo ago
Jan 15, 2026 9mo ago
Jan 12, 2026 9mo ago
Jan 12, 2026 9mo ago
Jan 12, 2026 9mo ago
Jan 12, 2026 9mo ago
Jan 12, 2026 9mo ago
Jan 11, 2026 9mo ago
Dec 24, 2025 10mo ago
Dec 23, 2025 10mo ago
Dec 23, 2025 10mo ago
Dec 23, 2025 10mo ago
Dec 21, 2025 10mo ago
All releases on GitHub →

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

Base47 HTML Editor 2.9.9.8.1 · audited by WP Registry

High-severity findings.

2 high 2 medium
Audited release
2.9.9.8.1
Findings
4
Worst severity
high
Content hash
ea695a3ca0bd88392582360f…

Findings

  • high Template save AJAX lacks capability check and path traversal guard

    missing_capability

    base47_he_ajax_save_template verifies nonce base47_he then builds $full = $sets[$set]['path'] . $file and file_put_contents($full, $content) with no current_user_can and no realpath prefix check. sanitize_text_field does not strip ../. Combined with admin CSRF (nonce scrapeable from manage_options pages), this is arbitrary file write under the web root.

    inc/ajax/editor.php:49-74

  • high Path traversal in template read/preview handlers

    information_disclosure

    get_template, preview, and lazy_preview likewise concatenate set path with user-supplied file. Can read files outside the template set if they exist (e.g. ../../../wp-config.php) when a valid nonce is presented.

    inc/ajax/preview.php:65-107

  • medium Nopriv preview endpoints rely solely on nonce

    missing_auth

    wp_ajax_nopriv_base47_he_preview/lazy_preview only check_ajax_referer. Nonce is intended for admin UI; if leaked, unauthenticated callers can read template files (and with traversal, more).

    inc/ajax/preview.php:59-111

  • medium Marketplace-local install AJAX missing capability check

    missing_capability

    base47_he_ajax_install_marketplace_template_local only checks nonce then writes theme directories under themes root and updates options — no manage_options.

    inc/ajax/marketplace-local.php:32-84

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.