WP Manifestindependent plugin directory
manifest / ecommerce / woocommerce-subscriptions-custom-price-string

WooCommerce Subscriptions - Custom Price String WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Customize the price displayed to your customers for subscription products (or non-subscription product).

★ 68stars
1.0.6latest · 2 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/woocommerce/woocommerce-subscriptions-custom-price-string/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

WooCommerce Subscriptions - Custom Price String is an experimental mini-extension for WooCommerce Subscriptions that allows you to customize the following default strings from WooCommerce and WooCommerce Subscriptions:

  • Simple product price
  • Variable product price
  • Subscription product price
  • Subscription Variation price
  • Variable product From price
  • Bookable product price

Installation

To install:

  1. Download the latest version of the plugin here
  2. Go to Plugins > Add New > Upload administration screen on your WordPress site
  3. Select the ZIP file you just downloaded
  4. Click Install Now
  5. Click Activate

How-to

Set Product Custom Price String for a Simple Subscription Product

Edit the product and go to its General tab. There you'll find a new field named "Custom price string". By default it will display the current price string (f.e: "$10 on the 1st of each month with a 30-day free trial"). Use this field to change this string to whatever you want (f.e: "$10 each month").

Custom simple Product price string

Set Product Custom Price String for a Variable Subscription Product

Edit the product and go to its Variations tab. Expand any of the existing variations and there you'll find the "Custom price string". Again, you can use this field to change this string to whatever you want (f.e: "$10 each month"). Each variation can have a different custom price string.

Custom variation price string

Set Product Custom From String for a Variable Subscription Product

By default, on each variable product page (frontend), a "From" sting is displayed, showing the minimal starting price of the product. If you edit a variable product and go to its Variations tab, you'll find a new field named "Custom Fom String" that you can can use to customize this string (f.e: "Starting at $10").

Custom variable product From string

  • NOTE: The 'From:' custom price string is located in the 'Advanced' tab for WC versions 3.3.5 and before.

Custom variable product From string WC 3.4+

  • NOTE: The 'From:' custom price string is located in the 'Variations' tab for WC versions 3.4+.

Result on the Frontend

Product with custom From and Price string

Set Product Custom Price String for a Bookable product

If you're using WooCommerce Bookings, you may also like to customize the price string of a bookable product in some situations. In these cases, you can find the "Custom price string" field located in the Advanced tab. This field will replace the main price string of the bookable product, located below its title.

image

image

Updates

To keep the plugin up-to-date, use the GitHub Updater.

Reporting Issues

If you find an problem or would like to request this plugin be extended, please open a new Issue.

Releases

4 releases.

Tag
Published
1.0.6 latest
Mar 19, 2024 2 years ago
Feb 20, 2019 7 years ago
Nov 8, 2018 7 years ago
Aug 6, 2018 8 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

WooCommerce Subscriptions - Custom Price String 1.0.6 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.0.6
Findings
1
Worst severity
medium
Content hash
76755458344d7270ba555d99…

Findings

  • medium Authenticated (Shop Manager+) stored XSS via unsanitized custom price / from strings

    xss_stored

    Custom price and “from” strings are stored from $_REQUEST/$_POST with only wp_unslash/stripslashes — no wp_kses_post, sanitize_text_field, or unfiltered_html check — then returned verbatim from get_post_meta into woocommerce_get_price_html and woocommerce_subscriptions_product_price_string. WooCommerce prints get_price_html() as HTML on the catalog and product page; Subscriptions reuses the price string in cart/subscription UI. Shop Manager can edit products but lacks unfiltered_html, so this bypasses the kses applied to product content and can inject <script> or HTML event handlers into storefront price output. The admin form runs wp_strip_all_tags only when rendering the input value (wcs_custom_price_string_value), not on save or frontend echo, so a payload can persist while the product editor shows an empty field. save_post is not limited to product post types and has no local nonce/capability check; on default WooCommerce that does not let customers write these keys onto products (checkout writes the same meta onto the order CPT instead, which this plugin never reads).

    woocommerce-subscriptions-custom-pricestring.php:226-338

    Recommendation

    Save via woocommerce_process_product_meta / woocommerce_save_product_variation only after verifying the product post type, current_user_can('edit_post', $post_id), and the WooCommerce meta nonce. Sanitize with wp_kses_post (or sanitize_text_field if HTML is not required) on write, and pass the stored string through wp_kses_post again before returning it from woocommerce_get_price_html / woocommerce_subscriptions_product_price_string. Do not read these keys from $_REQUEST on generic save_post (avoids checkout/order contamination).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.