WP Manifestindependent plugin directory
manifest / social / bluesky-feed-for-wordpress

Bluesky Feed for WordPress® WP RegistryHigh-severity findings · 1 findingOpen the reportC- #7 in Social & Sharing

by Robert DeVore · github.com/webdevstudios/bluesky-feed-for-wordpress · website

★ 8stars
157release downloads
≈30active sites
1.2.0latest · 1 year ago

Install

Download bluesky-feed-for-wordpress.zip From the 1.2.0 release on GitHub, Jun 5, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/webdevstudios/bluesky-feed-for-wordpress/releases/download/1.2.0/bluesky-feed-for-wordpress.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.
Readme github.com/webdevstudios/bluesky-feed-for-wordpress ↗

Showcase your recent Bluesky posts on your WordPress® website in a variety of ways. Display your Bluesky feed using a widget, shortcode, preview the feed in the admin settings, with customizable themes and display styles.

Features

  • Widget Integration: Easily add your Bluesky feed to your website's sidebar or footer.
  • Shortcode Support: Place the feed anywhere on your site with [bluesky_feed display="list|grid"].
  • Admin Preview: See how your feed will look directly in the plugin settings page.
  • Customizable Themes: Choose from light, dim, or dark themes.
  • Grid or List Layouts: Choose between a list display or a grid layout with 3-4 posts per row.
  • Real-Time Fetching: Fetch your latest Bluesky posts via the official API.
  • Pin Filtering: Optionally include or exclude pinned posts.
  • Responsive Design: Feed styles adapt seamlessly across devices.
  • Translation Ready: Currently translated into Spanish, French, Italian, Afrikaans, and Hindi

Installation

  1. Download the Plugin
    Clone or download the plugin from the GitHub repository.

  2. Upload to WordPress

    • Navigate to Plugins > Add New in your WordPress admin.
    • Click Upload Plugin and select the downloaded ZIP file.
    • Click Install Now and Activate.

  3. Configure Settings

    • Go to Settings > Bluesky Feed.
    • Enter your Bluesky username and adjust display options.

Usage

1. Widget

Add the Bluesky Feed Widget from the Appearance > Widgets section. Customize global settings in the plugin options.

2. Shortcode

Use the [bluesky_feed] shortcode in any post or page.
Available attributes:

  • display: Choose between list (default) or grid.
  • post_count: Control how many posts shall be displayed. If not provided the number from the app settings will be used.

Example:

[bluesky_feed display="grid" post_count="10"]

If you want to load the dependencies outside of a widget or a content shortcode (eg. echo do_shortcode("[bluesky_feed display='grid']")) set the global variable $loadBlueSkyApp to true.

Example:

function loadBlueSkyApp() {
    if(is_front_page()) {
        global $loadBlueSkyApp;
        $loadBlueSkyApp = true;
    }
}
add_action( 'wp', 'loadBlueSkyApp' );

3. Admin Preview

Preview your feed directly in the settings page under Settings > Bluesky Feed.

License

This plugin is licensed under the GPL-2.0+.
See the LICENSE file for details.

Acknowledgments

Releases

4 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.2.0 latest
Jun 5, 2025 1 year ago
bluesky-feed-for-wordpress.zip
52
1.1.1
Feb 25, 2025 1 year ago
bluesky-feed-for-wordpress.zip
78
1.1.0
Feb 2, 2025 1 year ago
bluesky-feed-for-wordpress.zip
27
1.0.0
Dec 2, 2024 1 year ago
tag only
—

Active-site estimate ≈30 comes from the median of recent superseded releases. Method.

C- grade

Security

Bluesky Feed for WordPress® 1.2.0 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.2.0
Findings
1
Worst severity
high
Content hash
acb3dbdad30e55d3a62fdd34…

Findings

  • high Unescaped Bluesky API fields assigned to innerHTML on the frontend and in wp-admin preview

    xss_stored

    renderFeed() in assets/js/feed-renderer.js builds post HTML with JavaScript template literals and writes it via postElement.innerHTML (and container.innerHTML). Fields taken from the live GET https://public.api.bsky.app/xrpc/app.bsky.feed.getAuthorFeed response are not HTML-escaped: post.record.text (only newline → <br>, a greedy https?://[^\s]+ → <a href="$1"> replace, and hashtag wrapping), author displayName (text and img alt), author.avatar (img src), author.handle (interpolated into https://bsky.app/profile/${handle}/post/${postId}), embed image fullsize/thumb URLs, embed.external uri/title/description/thumb (link-card markup), and repost reason.by.displayName. innerHTML does not run <script> tags but does run event handlers and complete img/svg markup, so a payload such as <img src=x onerror=alert(document.domain)> in post text or an OG title, or https://example.com" onclick=alert(1) via the URL rewriter, executes in the WordPress origin. getAuthorFeed with filter=posts_no_replies still includes reposts (item.reason $type reasonRepost) and link cards, so the configured account need not author the payload itself. widget.js runs this for every unauthenticated visitor of a page with [bluesky_feed] or the Bluesky Feed widget. admin.js runs the same function on #bluesky-feed-preview when an administrator opens Settings → Bluesky Feed, so a payload in the preview is wp-admin XSS (session theft, new admin, plugin upload). PHP only stores bluesky_username (manage_options + sanitize_text_field) and prints it as JSON in data-settings / wp_localize_script; it never sanitizes the API body the browser later paints.

    assets/js/feed-renderer.js:121-175

    Recommendation

    Never assign API strings to innerHTML. Escape every Bluesky field (text, names, handles, URLs, OG title/description) before interpolation, or build nodes with textContent/createElement and setAttribute. Allowlist http(s) URLs for img src and a href (reject javascript:, data:, and attribute-breaking quotes). If line breaks or hashtags need markup, escape first then insert <br>/spans. Prefer DOMPurify only as a defense-in-depth layer after escaping. Apply the same treatment to the admin preview path.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →