WP Manifestindependent plugin directory

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/wenderhost/nccagent-extras/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Helper code for the NCC website.

Description

I've built the NCC website using Elementor and the Hello Elementor theme. This is where I add additional code and CSS.

Changelog

4.6.1

  • Dequeuing global.js as it only contains deprecated/unused JavaScript.
  • Disabling enqueue_cleanup(). Restores "X" icon in social media icons widget.

4.6.0

  • Adding Elementor Cloudflare Turnstile integration.

4.5.0

  • Adding ACF Local JSON.
  • Setting FROM address via ACF Field.

4.4.0

  • Removing Product Finder.

4.3.0.1

  • Lowercasing name in composer.json.

4.3.0

  • Updating composer.json to allow for deploying via Composer inside the new Bedrock boilerplate version of the NCC Agent website.

4.2.1.2

  • Updating Invalid Carrier Name alert email to go to hard-coded email address.

4.2.1.1

  • BUGFIX: Checking for array before running usort() in acf_get_product_carriers().

4.2.1

  • Moving additional Carrier content behind "Requires Authentication" option (i.e. "Request a Product Information Kit", "Contract Online", Document Library link, and "Quick Links").

4.2.0

  • Adding "Requires Authentication" option for viewing Carrier Products.
  • Adding inline CSS to alert generated by ncc_get_alert().

4.1.1

  • BUGFIX: Updating Team Member bio in [team_member_list] 9to use wpautop instead of apply_filters( 'the_content', ... ).
  • Updating Product Description in acf_get_carrier_products() to use wpautop instead of apply_filters( 'the_content', ... ).

4.1.0

  • Adding Marketer's calendar link to [team_member_list].
  • Removing link to Marketer's page from [team_member_list].
  • Removing link to Marketer's page from "My Marketer" widget.

4.0.3

  • Adding ActiveCampaign JS tracking code.

4.0.2

  • Disabling "HubSpot Marketer Chat" in the REST API.

4.0.1

  • Adding validation for wordpress_and_activecampaign_registration form.
  • Disabling HubSpot integrations. Specifically, we're removing the HubSpot tracking code from the footer by not including lib/fns/hubspot.php in nccagent-extras.php.

4.0.0

  • Adding creation of ActiveCampaign contacts from new user registration.
  • Adding ncc_get_state_name() for retrieving a state name given a two letter state abbreviation.

3.9.0

  • Updating Product Finder product listings by changing "State Availability > Current as of" to "Last review date:" and removing the "Current as of" date for "Plan Information".

3.8.4

  • Disabling gform_confirmation hook because having this hook enabled was preventing a page redirect confirmation for the "Online Contracting" form.

3.8.3

  • Checking HubSpot chat status before attempting to open.
  • Adding Marketer Chat to Product Finder.
  • Adding Marketer Chat to [marketer_contact_details] shortcode.

3.8.2

  • Updating "Chat with..." link in [mymarketer] to use the Marketer's first name.

3.8.1

  • Updating "Schedule a Meeting" link in [mymarketer] to include the Marketer's first name.

3.8.0

  • Initial HubSpot chat setup for Marketers.
  • Adding "Chat Now" link to the [mymarketer] shortcode used on the Agent Dashboard.

3.7.7

  • Adding .BambooHR-ATS-Jobs-List to exclusions in CSS for list item bullets.

3.7.6

  • Adding .BambooHR-ATS-Department-List to exclusions in CSS for list item bullets.

3.7.5

  • Adding trailing slashes to URLs.

3.7.4

  • Setting GravityForms submit buttons to #fe0000.

3.7.3

  • Disabling "Close All" when opening accordion sections in accordion.js.

3.7.2

  • Updating ncc_is_elementor() to ncc_is_elementor_edit_mode(). The function was previously reporting whether or not the current page was built with Elementor. What we want to know is if we are editing inside Elementor, and now the renamed function correctly reports that information.

3.7.1

  • Adding Elementor display for [contracting_confirmation] shortcode.
  • Adding ncc_is_elementor() to lib/fns/utilities.php for detecting if the view is from inside the Elementor Editor.

3.7.0

  • Adding [contracting_confirmation] shortcode which displays the "Thank You" page information found in "NCC Settings > Online Contracting".

3.6.4

  • CSS Tweak: Removing NCC Dark Grey for heading color inside Beamer widget.

3.6.3

  • Adding Product Finder Help Graphic option to "Product Finder" page settings.
  • Bugfix: Product Finder Table was loading results when no fitlers were selected. To fix I added an additional condition for resetting the table when there is a saved state with empty values. Previously, I was only checking for null values.

3.6.2

  • Adding Issue Dates to Carrier > Product pages.

3.6.1

  • Updating invalid Carrier > Products redirect to a 301 Redirect.
  • Disabling .fa-home in cache-busters.css.

3.6.0

  • Saving Product Finder DataTables data in a single location so that the saved state for the finder carries over between different pages (e.g. settings on /product-finder/ will carry over to /plans/).

3.5.3

  • Adding a 302 Redirect for invalid Carrier > Products so that we'll redirect back to the parent Carrier.

3.5.2

  • Loading .fa-bars and .fa-home via inline CSS to avoid "FLUC" ("Flash of Unstyled Content") due to Font Awesome being cached and deferred.

3.5.1

  • Adjusting plan-by-state-selector.js to dynamically reference the proper browser Local Storage path based on the page slug for the Product Selector.

3.5.0

  • Rewriting Product Import/Export for better CSV handling.

3.4.1

  • Only load products-import-export.js on "Carriers > Import/Export" and "Products > Import/Export".

3.4.0

  • GUI for Import/Export of Carrier > Products.
  • Adding required permission_callback for nccagent/v1/products and nccagent/v1/verifyAccount.

3.3.0

  • Adding "Plan Year" to Carrier > Products.
    • "Plan Year" displays in the Product Finder, individual Product pages, and Carrier > Product pages.
    • "Plan Year" is included in wp ncc carriers export and wp ncc carriers export.

3.2.0

  • Adding proper user registration validation via the elementor_pro/forms/validation hook.
    • Checking user email for duplicates.
    • Checking NPN/username for duplicates.

3.1.6

  • Updating "Kit Request" text in product finder and on Carrier pages.
  • Adding background-color and padding to .kit-details in Kit Request section.

3.1.5

  • Updating VPN Link field to a text field to support VPN paths rather than full URLs.

3.1.4

  • Leaving `

Releases

6 releases.

Tag
Published
4.6.1 latest
Jan 7, 2026 9mo ago
Nov 14, 2025 11mo ago
Mar 13, 2025 1 year ago
Mar 7, 2025 1 year ago
Nov 4, 2019 6 years ago
Oct 29, 2019 6 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

NCCAgent Extras 4.6.1 · audited by WP Registry

Medium-severity findings.

1 medium 1 low
Audited release
4.6.1
Findings
2
Worst severity
medium
Content hash
df3eda0e36552b169ebd590d…

Findings

  • medium Public verifyAccount endpoint enables user enumeration and password oracle

    information_disclosure

    nccagent/v1/verifyAccount is permission_callback true and accepts email/password over GET/POST. Distinct error messages for invalid email vs invalid password enable account enumeration and offline credential stuffing against the WP user database. Intended for a mobile app but exposes a password-check oracle without rate limiting or auth.

    lib/fns/csg.php:19-66

  • low Authenticated SSRF-style dirlister fetches remote VPN paths

    ssrf

    dirlister REST requires current_user_can('read') then file_get_contents() against a path-derived URL on vpn.ncc-agent.com. Host is fixed; path param is attacker-influenced for any logged-in subscriber. Limited blast (directory listing proxy).

    lib/fns/rest-api.php:10-110

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.