WP Manifestindependent plugin directory
manifest / media / invintus-wp-plugin

Invintus Media WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

A WordPress plugin for integrating Invintus video content into your WordPress site.

★ 0stars
39release downloads
v2.0.14latest · 20d ago

Install

Download invintus-wp-plugin.zip From the v2.0.14 release on GitHub, Oct 2, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/tvwit/invintus-wp-plugin/releases/download/v2.0.14/invintus-wp-plugin.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Invintus WordPress Plugin

WordPress plugin that integrates the Invintus video platform. Registers an invintus_video custom post type, a Gutenberg block for embedding events, an admin settings page for API credentials and player preferences, and webhook routes that keep videos in sync with the Invintus API.

Features

  • invintus_video CPT with invintus_category / invintus_tag taxonomies
  • Gutenberg block (taproot/invintus) with live editor preview
  • Settings UI for API key, client ID, default player preference, and watch redirect path
  • REST endpoints under invintus/v2/ for webhook upserts and player preferences
  • invintus/... filters for extending almost everything (see Extension points below)

Installation

Most installs pull from the release dist (see Repository layout).

  1. Download the latest ZIP from the dist repo releases page.
  2. WP Admin > Plugins > Add New > Upload Plugin > choose the ZIP > Install + Activate.
  3. Configure under Invintus Videos > Settings, or define the constants in wp-config.php:
    define( 'INVINTUS_API_KEY',   'your-api-key'   );
    define( 'INVINTUS_CLIENT_ID', 'your-client-id' );

Constants take precedence over the UI when defined.

Requirements

  • WordPress 5.8+
  • PHP 7.4+
  • Node.js 16+ and Composer (development only)

Development

Two ways to run the plugin locally. Pick one.

Quickstart with wp-env (recommended)

Spins up a Dockerized WP at http://localhost:8888, mounts this repo as a plugin, and gives you wp / composer / phpcs inside the container. No host PHP needed.

npm install
npm run dist:build
npm run env:start

Then visit http://localhost:8888/wp-admin (login: admin / password).

To run the plugin the way it actually ships to users (compiled build/, vendored vendor/, no dev tooling), build a dist candidate and tell wp-env to mount that instead:

npm run dist:build   # writes .dist-candidate/invintus/

Then create .wp-env.override.json (gitignored) at the repo root:

{
  "plugins": ["./.dist-candidate/invintus"],
  "config": {
    "INVINTUS_API_KEY":   "your-key",
    "INVINTUS_CLIENT_ID": "your-client-id"
  }
}

npm run env:start again to pick up the override.

Other env scripts: env:stop, env:destroy, env:clean, env:logs, env:wp (wp-cli passthrough), env:composer, env:phpcs.

One-time bootstrap after a fresh env:start

After every env:destroy + env:start, WP boots with Plain permalinks and no .htaccess. Pretty REST URLs (/wp-json/...) return Apache 404s until both are fixed. The "Save Permalinks in wp-admin" trick reports success but doesn't actually write .htaccess -- /var/www/html is owned by root inside the wp-env container so the www-data PHP process can't write there. Do it from the host instead:

# 1. set a non-plain permalink structure
npx wp-env run cli -- wp rewrite structure '/%postname%' --hard

# 2. write the standard WP .htaccess (as root, via the cli container)
npx wp-env run cli -- bash -c 'cat > /var/www/html/.htaccess <<EOF
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\\.php\$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
EOF'

After this the Settings page can save, REST routes resolve, and the block editor works normally. The file persists for the life of the env -- only re-run after a destroy.

To do the whole "wipe everything and start over" cycle in one shot (destroy + rebuild dist + start + bootstrap):

npm run env:reset

That runs scripts/reset-env.sh. It destroys the wp-env database, rebuilds build/ and .dist-candidate/, brings the env back up, and applies the bootstrap above. Use it to verify the "fresh clone" recipe end-to-end or when env state is the suspected cause of a bug. Does not touch node_modules -- delete that manually first if you also want a fresh npm install.

Traditional setup

Clone into an existing WP install:

cd wp-content/plugins
git clone https://github.com/TVWIT/invintus-wp-plugin invintus
cd invintus
composer install
npm install
npm run start   # watch-mode dev build

Build, lint, format

Script What it does
npm run start Watch-mode webpack build (also copies render.php)
npm run build Production build into build/
npm run lint:js ESLint on JS sources
npm run lint:css Stylelint on SCSS sources
npm run format Prettier across the tree
composer php:lint PHPCS (WordPress Coding Standards + PHPCompat)
composer php:lint:autofix PHPCBF
composer php:lint:changed PHPCS on unstaged changes only

Overriding the player URL

The player script source is filterable. Drop a must-use plugin at wp-content/mu-plugins/invintus-player.php to redirect it:

<?php
add_filter( 'invintus/player/script/url', function() {
    return 'https://player.beta.invintusmedia.com/app.js';
} );

mu-plugins load before regular plugins, can't be deactivated through the admin UI, and survive plugin updates -- ideal for "site policy" overrides that shouldn't ride with a release. Remove the file to revert.

The override is scoped to the screens that actually need the player (the Invintus settings page, the block editor, and front-end posts with the block). It does not load on unrelated wp-admin screens.

Cross-origin player builds

If the override URL points to a build that uses dynamic import() for its own chunks (some bundlers split runtime code this way), the browser will refuse to resolve the relative module specifiers unless the `

Releases

13 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v2.0.14 latest
Oct 2, 2026 20d ago
invintus-wp-plugin.zip
2
Jun 4, 2026 4mo ago
invintus-wp-plugin.zip
3
May 21, 2026 5mo ago
invintus-wp-plugin.zip
1
May 29, 2025 1 year ago
invintus-wp-plugin.zip
1
Apr 9, 2025 1 year ago
invintus-wp-plugin.zip
8
Apr 5, 2025 1 year ago
invintus-wp-plugin.zip
1
Mar 14, 2025 1 year ago
invintus.zip
5
Mar 3, 2025 1 year ago
invintus.zip
4
Feb 28, 2025 1 year ago
invintus.zip
2
Feb 28, 2025 1 year ago
invintus.zip
1
Feb 27, 2025 1 year ago
invintus.zip
4
Feb 26, 2025 1 year ago
invintus.zip
2
Feb 15, 2025 1 year ago
invintus.zip
5
D+ grade

Security

Invintus Media 2.0.14 · audited by WP Registry

High-severity findings.

1 high 1 medium 1 low
Audited release
2.0.14
Findings
3
Worst severity
high
Content hash
174c9cf35285943c615bb7bd…

Findings

  • high Plugin settings (incl. API key) readable and writable by Authors via REST

    missing_capability

    The invintus/v2/settings GET and POST routes use a permission_callback of current_user_can('publish_posts'), which Authors hold. GET returns the full invintus_video_settings option including invintus_api_key and invintus_client_id. POST overwrites apiKey, clientId, watchRedirectPath, enablePublicEvents, enableLogs and logRetention. Setting watchRedirectPath to 'wp-login.php' or 'wp-admin' makes create_watch_redirect() (hooked on init) intercept those paths and redirect to the home page, locking administrators out of the dashboard. The admin settings page itself is restricted to manage_options, so this is an unintended privilege gap.

    inc/API.php:403-479

    Recommendation

    Require current_user_can('manage_options') for the settings and player_prefs routes; never return the stored API key in REST responses; validate watchRedirectPath against reserved paths (wp-login.php, wp-admin, wp-json).

  • medium Authors can permanently delete any Invintus video post via events/crud

    missing_capability

    process_payload() is reachable by any publish_posts user. delete_events() only checks the generic delete_posts capability and upsert_data()'s private branch performs no capability check at all before calling wp_delete_post() on every invintus_video whose invintus_event_id matches the supplied eventID. Because invintus_video is not post/page, wp_delete_post() bypasses trash and deletes permanently, so an Author can wipe other users' published video posts.

    inc/API.php:547-568

    Recommendation

    Restrict the webhook route to manage_options or a shared-secret header from Invintus, and check current_user_can('delete_post', $post_id) per post (also in the private branch of upsert_data).

  • low Global https_ssl_verify filter disabled in local/development environments

    insecure_config

    Invintus::maybe_verify_ssl() is attached to the global https_ssl_verify filter and returns false when wp_get_environment_type() is local or development, disabling TLS verification for every HTTP request made by WordPress and all plugins, not just Invintus calls.

    inc/Invintus.php:386-405

    Recommendation

    Pass sslverify only in the plugin's own wp_remote_* args instead of filtering globally.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.