WP Manifestindependent plugin directory
manifest / content / tscf

TSCF - Tarosky Custom Filed manager WP RegistryMedium-severity findings · 2 findingsOpen the reportB

Tarosky's Custom Field Manager for WordPress. You will get smooth UI and maintenable custom fields.

by TAROSKY INC. · github.com/tarosky/tscf · website

★ 9stars
228release downloads
≈90active sites
2.1.0latest · 3mo ago

Install

Download tscf.zip From the 2.1.0 release on GitHub, Jul 7, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/tarosky/tscf/releases/download/2.1.0/tscf.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/tarosky/tscf ↗

TSCF - Tarosky Custom Field manager

Contributors: Takahashi_Fumiki, tarosky
Tags: custom field
Tested up to: 6.5
Stable tag: 1.2.0
License: GPLv3 or later
License URI: http://www.gnu.org/licenses/gpl-3.0.txt

TaroSky's Custom Field manager. Scalable, Well-Structured and Maintainable. Requires PHP5.4 or later.

Description

Custom fields are stuff box for WordPress. They can store almost everything. Number, Date, CSV and nested array.

Besides that, custom fields can be used for many purpose.

  • To display extra information for posts.
  • To sort posts by their event date.
  • To hide posts from unregistered user.

Thus, they can be easily uncontrollable.

TSCF provides scalable way. A JSON file indicates what custom fields should be and you can get their value.

You can maintain it on VCS like git or svn.

Additional features:

  • Supports child theme. you can override config file.
  • JSON editor. But we don't recommend it. Don't edit it directly on production environment.

Installation

  1. Upload the plugin files to the /wp-content/plugins/tscf directory, or install the plugin through the WordPress plugins screen directly.
  2. Activate the plugin through the 'Plugins' screen in WordPress
  3. If JSON doesn't exist, put it or create from Appearance > Custom Fields Config.

We also host this plugin on github, build like below. composer and npm are required.

# Move to your plugin directory.
cd wp-content/plugins
# Clone repo.
git clone git@github.com:tarosky/tscf.git
# Buidl plugin.
cd tscf
composer install
npm install
npm run package
# If you want watch assets, run watch.
npm run watch

Of course, any pull requests are welcomed :)

Frequently Asked Questions

I founded a bug.

Please make issue on github.

Screenshots

W.I.P

Changelog

2.1.0

  • Add support for term meta fields. Taxonomy edit screens (e.g. category, tag) can now show and save TSCF fields, selectable as "term" type from Custom Field Config.
  • Add support for nested (repeater) iterator fields. Iterators can now contain other iterators, with no nesting limit.
  • Fix: the options editor UI (checkbox/radio/select) was not shown for iterator child fields.
  • Fix: incremental search results for "select from posts" fields were cached for several minutes, showing stale/empty results after a no-hit search.
  • Add a note about theme write permissions affecting the "Custom Field Config" menu.

1.1.1

  • Fix fatal error on composer loading.

1.1.0

  • Composer ready.

1.0.0

  • Initial release.

Releases

4 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
2.1.0 latest
Jul 7, 2026 3mo ago
tscf.zip
6
2.0.2
Feb 14, 2025 1 year ago
tscf.zip
85
2.0.1
Jul 16, 2024 2 years ago
tscf.zip
97
2.0.0
Apr 25, 2024 2 years ago
tscf.zip
40

Active-site estimate ≈90 comes from the median of recent superseded releases. Method.

B grade

Security

TSCF - Tarosky Custom Filed manager 1.2.0 · audited by WP Registry

Medium-severity findings.

2 medium
Audited release
1.2.0
Findings
2
Worst severity
medium
Content hash
d07aa592b129b9adcf19bd6c…

Findings

  • medium REST post search lists private/draft posts for any user with edit_posts

    information_disclosure

    register_rest_route('tscf/v1','/posts') admits anyone with edit_posts (Contributor, Author, Editor, shop_manager) and then runs WP_Query with post_status=any, post_type=explode(',', $request['post_type']), s=$request['q']. The post_type validator explicitly allows 'any' and otherwise only post_type_exists(), so a Contributor can request post_type=any (or shop_order, page, attachment, etc.) and receive titles plus tscf_post_status() of other users' drafts, private posts, pending, trash, and private custom types. Results are not filtered with current_user_can('read_post', $id) or the post type's edit_posts/read_private_posts caps. Core /wp/v2/posts would hide those rows from a Contributor. Observable: GET /wp-json/tscf/v1/posts?q=a&post_type=any&_wpnonce=<wp_rest nonce> returns {"posts":[{"id":N,"text":"Secret draft(Draft)"}],"total":…}. The wp_rest nonce is localized on every admin screen including pages Contributors can open. Subscriber is blocked by the permission_callback.

    src/Tarosky/TSCF/Rest.php:17-72

    Recommendation

    Require the post type's edit_posts (or read) capability for each requested type, not the global edit_posts cap. Force perm=readable or post_status values the user may list, and drop rows failing current_user_can('read_post', $post->ID). Disallow post_type=any unless the user can edit others' posts. Return only posts the current user could already see in wp-admin.

  • medium URL field live preview concatenates unsanitized href into jQuery HTML

    xss_stored

    Url fields save raw $_POST via Input::save_data() with no esc_url_raw. On the post/term editor, tscf-helper.js copies that value into .tscf-preview-button href and initializes jquery-live-preview, which on click does jQuery append of an HTML string with src="'+href+'". Breaking out of the attribute (payload "><img src=x onerror=alert(1)>) executes in wp-admin as the user who clicks Preview (typically Editor/Admin reviewing a Contributor's post). The consumer is jQuery HTML parsing (img onerror fires); this is not innerHTML-of-<script>. Preconditions: tscf.json defines a url field on a post type the attacker can edit. Default install with no config has no URL fields, but url is a first-class built-in type and the preview is always wired when it is used. Url extends Text (input type=text), so the browser does not apply type=url constraints.

    assets/js/src/tscf-helper.js:285-333

    Recommendation

    Sanitize on save with esc_url_raw() and reject javascript:/data: URLs. When setting href use a sanitized absolute http(s) URL only. In the live-preview library, never concatenate href into HTML; set iframe.src via the DOM API after encoding. Bind preview to a safe allowlisted URL, not the raw field value.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →