WP Manifestindependent plugin directory
manifest / developer / htmxpress

HTMXpress WP RegistryHigh-severity findings · 1 findingOpen the reportC-

WordPress plugin that adds HTMX-powered endpoints and template partials

by Sander van Dragt · github.com/svandragt/htmxpress · website

★ 139stars
0.1.1latest · 1 year ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/svandragt/htmxpress/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/svandragt/htmxpress ↗

HTMX for WordPress!

By using the Rewrite Endpoints API to create a custom endpoint; and a bit of custom template logic, we can output a serverside partial or custom theme template.

Using this setup, WordPress can leverage HTML over the wire solutions such as HTMX.

HTMX then allows us to do dynamic serverside based rendering; live search and other features without the overhead and complexity of reactive JavaScript frameworks, whilst benefiting from trusted object and full page caching solutions. This repository is exploring the opportunities.

Demo

  1. Activate plugin (or run wp-env start to spin up a WP environment with the plugin activated).
  2. go to /htmx (Endpoint test)
  3. go to /htmx/ascii and /html/partial-ascii (template loader test)
  4. Inspect html source of theme (enqueued script test)
  5. go to /htmx/demo

What else can you do?

Screencast of Demo

https://user-images.githubusercontent.com/594871/183612860-b2eb29f7-cfa0-4de1-97fc-b2a5f393cfd2.mp4

Composer install

Requires PHP >= 8.0. For composer.json-based WordPress projects, install HTMXpress as a VCS dependency:

composer config repositories.htmxpress vcs git@github.com:svandragt/htmxpress.git
composer require svandragt/htmxpress:dev-main --no-update
composer update svandragt/htmxpress --prefer-source

Project use

  1. By default HTMX is loaded from an external CDN. While the CDN approach is extremely simple, you may want to consider not using CDNs in production: Download a minified copy of htmx and put it into the mytheme/third-party/ folder so WordPress can find it, updating the version number.
# mytheme/functions.php
const PRIORITY_AFTER_HTMX = 20;
add_action( 'wp_enqueue_scripts', function() {
    wp_dequeue_script( 'htmx');
    wp_enqueue_script( 'htmx', trailingslashit( dirname( __FILE__ ) ) . 'third-party/htmx.min.js', '', '1.9.2' );
}, PRIORITY_AFTER_HTMX );
  1. Add your own templates to the htmx endpoint: Here's how to add to the template paths to point to your site's templates. The demo HTMXpress templates are only registered if the filter is unused:
# mytheme/functions.php
add_filter( 'htmx.template_paths', static function ( $paths ) {
    $paths[] = __DIR__ . '/templates';

    return $paths;
} );

# A template mytheme/templates/example.php will then be accessible from `/htmx/example`

See Also

Releases

2 releases.

Tag
Published
0.1.1 latest
Jun 4, 2025 1 year ago
0.1.0
Jun 23, 2023 3 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

HTMXpress 0.1.1 · audited by WP Registry

High-severity findings.

1 high
Audited release
0.1.1
Findings
1
Worst severity
high
Content hash
08a031f0c4e3d8789380aa35…

Findings

  • high Global HTMX enqueue turns kses-allowed data-hx-* post HTML into stored XSS for Author+

    xss_stored

    Assets\register() unconditionally wp_enqueue_script()'s htmx 1.9.10 (unpkg, no SRI) on wp_enqueue_scripts, so every front-end response processes hx-* / data-hx-* attributes. WordPress $allowedposttags adds data-* as a global attribute via _wp_add_global_attributes; users without unfiltered_html still pass through wp_kses_post, which keeps data-hx-on, data-hx-on-click, data-hx-on-error, data-hx-get, data-hx-trigger, and data-hx-vals (confirmed with wp_kses_post on this machine). HTMX 1.9.10 defaults are allowEval true, allowScriptTags true, selfRequestsOnly false, and getAttributeValue() reads the data- prefix. processHxOnWildcard maps data-hx-on-click to addEventListener('click', new Function('event', code)); trigger filters compile load[alert(1)] via Function(); hx-vals js: is eval'd; a CORS-enabled data-hx-get to an attacker origin swaps HTML that executes <script>. Authors can publish this without approval; Contributors can plant it for admin/editor preview. hx-get attributes are not in the kses allowlist, so the bypass is specifically the data-hx-* spelling HTMX documents as equivalent. The plugin never sets htmx.config.allowEval=false, never wraps the_content in hx-disable, and never strips data-hx-* from post HTML.

    inc/assets.php:22-39

    Recommendation

    Do not enqueue HTMX on every page; load it only where a trusted template needs it. On pages that must run HTMX, wrap untrusted HTML (the_content, comments, widgets) in an element with hx-disable, and add a wp_kses_allowed_html filter that removes data-hx-* / hx-* from the post/comment allowlists. Set htmx.config.allowEval = false, allowScriptTags = false, and selfRequestsOnly = true unless a specific feature requires otherwise. Bundle a local minified copy with an integrity hash instead of unpkg.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →