WP Manifestindependent plugin directory
manifest / themes / syntekpro-animations

Syntekpro Animations WP RegistryHigh-severity findings · 2 findingsOpen the reportD+

Animate Your WordPress Website With SyntekPro Animations Plugin

by Syntekpro · github.com/syntekpro/syntekpro-animations · website

★ 0stars
9release downloads
v1.5.0latest · 6mo ago

Install

Download syntekpro-animations-1.5.0.zip From the v1.5.0 release on GitHub, Apr 1, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/syntekpro/syntekpro-animations/releases/download/v1.5.0/syntekpro-animations-1.5.0.zip
Updates itself. It ships its own updater, so new versions appear under Dashboard → Updates.
Readme github.com/syntekpro/syntekpro-animations ↗

Version: 1.5.0 Requires: WordPress 5.8+, PHP 7.4+

Professional animation and slider toolkit for WordPress with visual builders, presets, timeline controls, and flexible frontend runtime features. As of 1.5.0, SyntekPro Slider is merged as an internal module.

Highlights

  • 50+ animation presets with free and Get+ tiers
  • Visual builders for animations, timelines, and slider content
  • Embedded SyntekPro Slider module with shared runtime inside Animations
  • Shortcodes for animation wrappers, sequences, and sliders
  • GitHub release update notifications for installed plugin sites
  • License-aware Get+ feature controls

Quick Start

  1. Activate the plugin.
  2. Go to WP Admin > SyntekPro Animations > Settings.
  3. Enable Animation Engine and Scroll Animations.
  4. Add your first shortcode:
[sp_animate type="fadeIn"]Your content here[/sp_animate]

Core Shortcodes

[sp_animate type="fadeInUp" duration="1"]Content[/sp_animate]
[sp_timeline auto="yes"]...[/sp_timeline]
[sp_sequence type="fadeInUp" stagger="0.15"]...[/sp_sequence]
[sp_hover_effect type="scale" scale="1.1"]...[/sp_hover_effect]
[sp_slider id="123"]

Admin Areas

  • Settings: engine and runtime options
  • Presets: browse free/locked animation presets
  • Builder: visual animation builder
  • Timeline: sequence builder
  • Patterns: insert ready-made sections
  • Animations+: license key and validation
  • System Status: environment and license diagnostics

GitHub Updates

The plugin now checks GitHub Releases for new versions and surfaces WordPress-native update notifications across installed sites.

To publish an update:

  1. Update version metadata in plugin files.
  2. Commit and push to main.
  3. Create and push a version tag (example: v1.5.0).
  4. Publish a GitHub Release with a plugin zip asset named like syntekpro-animations-1.5.0.zip.

Installed sites will detect the release during routine WordPress update checks.

Documentation

Support

Releases

4 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.5.0 latest
Apr 1, 2026 6mo ago
syntekpro-animations-1.5.0.zip
9
v2.4.3
Mar 30, 2026 6mo ago
syntekpro-animations-2.4.3.zip
0
v2.4.1
Mar 30, 2026 6mo ago
syntekpro-animations-2.4.1.zip
0
v2.4.0
Mar 30, 2026 6mo ago
syntekpro-animations-2.4.0.zip
0
D+ grade

Security

Syntekpro Animations 1.5.0 · audited by WP Registry

High-severity findings.

2 high
Audited release
1.5.0
Findings
2
Worst severity
high
Content hash
07a41277f8a228856a34232b…

Findings

  • high REST slider write/delete allowed to any user with edit_posts

    missing_capability

    can_edit_sliders() returns true for any user with edit_posts when the optional role allow-list option is empty (default). The DELETE handler then calls wp_trash_post() on the request ID with no post-type check, so a Contributor can trash arbitrary posts/pages/products. PUT writes _sp_slider_settings and _sp_slider_slides, which the public slider renders (stored XSS/defacement).

    includes/class-slider-advanced.php:713-740,953-979

    Recommendation

    Require manage_options (or a dedicated slider cap) on all write/delete routes. In rest_delete_slider/rest_update_slider, verify the post is syntekpro_slider and current_user_can('delete_post'/'edit_post', $id).

  • high Unauthenticated REST GET discloses unpublished slider HTML and settings

    information_disclosure

    GET /wp-json/syntekpro/v1/sliders/{id} uses permission_callback __return_true and returns post title plus _sp_slider_settings, _sp_slider_slides, and _sp_slider_snapshot_html with no post_status/post_type check. An unauthenticated visitor can enumerate IDs and read draft/private slider markup intended for the editor.

    includes/class-slider-advanced.php:590-595,934-950

    Recommendation

    Restrict GET to published sliders of the correct post type, or require a public token. Do not return snapshotHtml for unpublished posts. Consider a dedicated public payload that omits editor-only fields.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →