WP Manifestindependent plugin directory
manifest / seo / go-organic-wp-plugin

Go/Organic WP Plugin WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

★ 0stars
657release downloads
≈10active sites
v0.14.0latest · 9mo ago

Install

Download release.zip From the v0.14.0 release on GitHub, Jan 26, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/vooyee/go-organic-wp-plugin/releases/download/v0.14.0/release.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

Go/Organic WordPress Plugin

A powerful WordPress plugin designed to bulk-create posts via a REST API and manage integration credentials for external SEO content generation services.

Description

The Go/Organic WP Plugin provides a seamless integration between WordPress and external content generation services. It allows you to bulk-create posts through a REST API endpoint and automatically manages authentication credentials for secure API access.

Features

  • Bulk Post Creation: Create multiple WordPress posts in a single API call
  • Posts Export: Export posts in JSON or CSV format with filtering options
  • Automatic Category Management: Create categories on-the-fly or assign posts to existing ones
  • Flexible Slug Handling: Support for category-based URL structures (e.g., category/post-slug)
  • Secure Authentication: Application Password-based authentication for API access
  • Custom Role System: Fine-grained permissions with custom capabilities
  • Dynamic API Users: Unique API usernames per installation
  • Admin Interface: Easy-to-use admin panel for managing integration credentials
  • Automatic Updates: Built-in update checker for seamless plugin updates

Installation

  1. Download the plugin files to your WordPress /wp-content/plugins/ directory
  2. Activate the plugin through the 'Plugins' menu in WordPress
  3. Navigate to the 'Go/Organic' menu in your WordPress admin panel to configure credentials

API Usage

Bulk Create Posts Endpoint

Endpoint: POST /wp-json/seo-gen/v1/posts

Authentication: Basic Authentication using Application Password

Export Posts Endpoint

Endpoint: GET /wp-json/seo-gen/v1/posts/export

Authentication: Basic Authentication using Application Password

Query Parameters:

  • format - Export format: json (default) or csv
  • category - Filter by category slug
  • status - Filter by post status (default: publish)
  • author - Filter by author ID
  • date_from - Filter posts from date (Y-m-d)
  • date_to - Filter posts to date (Y-m-d)
  • per_page - Posts per page (default: 50)
  • page - Page number (default: 1)

Headers:

Content-Type: application/json
Authorization: Basic [base64_encoded_credentials]

Request Format

{
  "posts": [
    {
      "id": "external_id_1",
      "title": "Your Post Title",
      "content": "<p>Your post content here...</p>",
      "slug": "category/post-slug",
      "excerpt": "Optional post excerpt",
      "status": "publish",
      "date": "2024-01-01 12:00:00",
      "author": 1,
      "comment_status": "open",
      "ping_status": "open"
    }
  ]
}

Request Parameters

Field Type Required Description
id string No External reference ID for tracking
title string Yes Post title
content string No Post content (HTML allowed)
slug string Yes Post slug, supports category/slug format
excerpt string No Post excerpt
status string No Post status (default: publish)
date string No Post date in MySQL format
author integer No Author user ID
comment_status string No Comment status (open, closed)
ping_status string No Ping status (open, closed)

Response Format

{
  "created_posts": [
    {
      "new_id": 123,
      "source_id": "external_id_1",
      "url": "https://yoursite.com/category/post-slug/",
      "title": "Your Post Title",
      "slug": "post-slug",
      "category": "category"
    }
  ],
  "errors": [
    {
      "source_id": "external_id_2",
      "title": "Failed Post",
      "message": "Error description"
    }
  ]
}

Configuration

Setting Up API Credentials

  1. Go to WordPress Admin > Go/Organic
  2. Click "Generate New Application Password"
  3. Copy the generated password immediately (it won't be shown again)
  4. Use the provided username and password for API authentication

Authentication Details

  • Username: Dynamic per installation (e.g., go_organic_yoursite_com)
  • Password: Application Password (generated through admin interface)
  • User Role: Editor with custom Go/Organic capabilities
  • Permissions:
    • go_organic_manage_posts - Create/import posts
    • go_organic_export_posts - Export posts
    • go_organic_manage_settings - Manage plugin settings (admin only)

Slug Formats

The plugin supports two slug formats:

  1. Simple Slug: my-post-title

    • Assigns post to the default category
  2. Category/Slug Format: category-name/my-post-title

    • Creates the category if it doesn't exist
    • Assigns the post to the specified category

Error Handling

The API provides detailed error information for failed post creations:

  • Missing title or slug
  • Invalid slug format
  • Category creation failures
  • Post insertion errors

Requirements

  • WordPress 5.0 or higher
  • PHP 7.4 or higher
  • Application Passwords enabled
  • User with custom Go/Organic capabilities for API access
  • User with go_organic_manage_settings capability for admin configuration

Security

  • Uses WordPress Application Passwords for secure API authentication
  • Custom role system with fine-grained permissions
  • Dynamic API usernames unique per installation
  • Sanitizes all input data
  • Validates user permissions
  • Prevents direct file access

Version Information

  • Current Version: 0.8.0
  • Author: Purple Box AI
  • Update Server: Automatic updates via built-in update checker

Support

For support and updates, the plugin automatically checks for new versions from the configured update server. Make sure your WordPress installation can make outbound HTTP requests for automatic updates to work.

License

This plugin includes the Plugin Update Checker library, which has its own licensing terms. Please refer to the plugin-update-checker/license.txt file for details.

Changelog

Version 0.8.0

  • NEW: Posts export endpoint with JSON/CSV support
  • NEW: Custom role system with fine-grained permissions
  • NEW: Dynamic API usernames per installation
  • IMPROVED: Better security with custom capabilities
  • IMPROVED: Enhanced filtering options for export

Version 0.7.0

  • Major code organization and cleanup
  • Separated functionality into focused modules
  • Enhanced documentation and maintainability

Version 0.3.0

  • Initial release with bulk post creation functionality
  • Admin interface for credential management
  • Automatic category creation
  • Flexible slug handling
  • Built-in update checker

Releases

11 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v0.14.0 latest
Jan 26, 2026 9mo ago
release.zip
58
Oct 30, 2025 11mo ago
release.zip
9
Oct 30, 2025 11mo ago
release.zip
500
Oct 30, 2025 11mo ago
release.zip
2
Oct 29, 2025 11mo ago
release.zip
9
Oct 10, 2025 1 year ago
release.zip
79
Oct 10, 2025 1 year ago
go-organic-wp-plugin-v0.9.6.zip
0
Oct 10, 2025 1 year ago
tag only
—
Oct 9, 2025 1 year ago
tag only
—
Oct 1, 2025 1 year ago
tag only
—
Oct 1, 2025 1 year ago
tag only
—

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

D+ grade

Security

Go/Organic WP Plugin 0.14.0 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
0.14.0
Findings
2
Worst severity
high
Content hash
4d44b70f995d12e7dc7f9e44…

Findings

  • high JSON-LD schema is echoed with JSON_UNESCAPED_SLASHES, enabling stored XSS

    xss_stored

    go_organic_output_seo_meta() prints _schema_markup inside a <script type="application/ld+json"> tag using wp_json_encode(..., JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE). PHP’s default slash-escaping that would turn </script> into <\/script> is disabled, so a string value containing </script><script>alert(1)</script> breaks out of the script element and executes on every singular view. go_organic_sanitize_schema_markup() json_decodes and re-encodes without JSON_HEX_TAG, so it does not neutralize the sequence. Write path below admin: register_post_meta('_schema_markup', show_in_rest, auth_callback = current_user_can('edit_posts')) lets Contributor/Author set the field on posts they can edit (Author can publish; Contributor XSS fires when the draft is previewed/published). The leaked Editor application password (see other finding) also writes this key via seo-gen/v1/posts. Title/description meta are esc_attr’d; schema is not.

    inc/tracking/frontend.php:132-138

    Recommendation

    Encode JSON-LD with JSON_HEX_TAG | JSON_HEX_AMP (or wp_json_encode without JSON_UNESCAPED_SLASHES) so < becomes \u003C and </script> cannot break the HTML parser. Keep outputting via echo only after that encoding. Tighten auth_callback to user_can($user_id, 'edit_post', $object_id) rather than a global edit_posts check.

  • medium Tracking event REST route allows any logged-in user to append unbounded data to wp-content/tracking.log

    missing_capability

    POST /wp-json/tracking-system/v1/event is registered with permission_callback is_user_logged_in() || check_ajax_referer('ts_nonce', 'nonce', false). No current_user_can check. wp_create_nonce('ts_nonce') is never called or localized anywhere in the plugin, so the nonce branch is dead; the is_user_logged_in() branch admits Subscriber and every other role (cookie + valid wp_rest nonce, which same-origin WP REST requests have). go_organic_log_individual_event() json_encodes the request body and file_put_contents(..., FILE_APPEND) to WP_CONTENT_DIR.'/tracking.log' with no size cap, rate limit, or directory protection. Observable: a Subscriber can fill the disk and, on default configs that serve files under wp-content, leave a world-readable log next to uploads. The sibling tracking/v1/batch endpoint does the same write after the leaked x-wp-key check.

    inc/tracking/frontend.php:72-97

    Recommendation

    Do not write raw request bodies under wp-content. Drop the public log file; if logging is required, use a non-web-accessible location with rotation/quotas. Gate the route with a real capability or a per-request REST nonce plus rate limiting; remove the unused ts_nonce branch or actually localize and verify a wp_rest nonce only for the intended caller.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.