WP Manifestindependent plugin directory
manifest / builders / pagex

Pagex WP RegistryHigh-severity findings · 3 findingsOpen the reportD+

Pagex - Theme Builder for WordPress

by YumeCommerce · github.com/yumecommerce/pagex · website

★ 12stars
v0.3latest · 6 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/yumecommerce/pagex/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/yumecommerce/pagex ↗

Pagex is a visual theme builder. It takes control over all theme templates and lets you create not only standard content layouts but also dynamic templates for any type of pages including archives, search results, single post types, taxonomies, 404, coming soon, and etc. Plus header and footer layouts now fully under your control. Pagex supports custom post types including WooCommerce products and custom meta fields, so no more limits of predefined options and design settings.

Features

  • 100% responsive design based on Bootstrap 4
  • Header and Footer builder
  • Post preview (excerpt) builder for Blog/Shop or any custom archive
  • Theme and WooCommerce templates builder
  • Front-end and back-end visual builders
  • Works with Classic and Gutenberg editors
  • Built-in features:
    • One click demo import (for theme developers)
    • Coming soon mode
    • Mega-menu (with horizontal or vertical layouts)
    • Page preloader
    • GDPR notices
  • WooCommerce support
  • 100% WPML support
  • Support custom post types and custom meta fields
  • Layouts and Theme Templates library
  • Import/Export file layouts
  • Live custom CSS
  • Advanced Typography (Google, Adobe Fonts (TypeKit), and Custom Fonts)

Documentation

Pagex Documentation

FAQ

  • Is it compatible with my theme?

    The short answer is yes. But technically speaking theme should not interfere with the website in any way. To avoid issues with website style it must not unique any CSS/JS or add custom functions which affecting default WordPress behavior.

  • What plugins for custom content types are supported?

    Currently, only Pods plugin is supported but work in progress.

Support

Documentation and video tutorials cover all options and settings. Please don't use the issue tracker for support requests, but for core, Pagex issues only.

Contributing

Please do :thumbsup: Any help will be appreciated

Releases

3 releases.

Tag
Published
v0.3 latest
Nov 8, 2019 6 years ago
v0.2
Aug 14, 2019 7 years ago
v0.1
Mar 2, 2019 7 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

Pagex 0.3 · audited by WP Registry

High-severity findings.

1 high 2 medium
Audited release
0.3
Findings
3
Worst severity
high
Content hash
26a7d28daae4d87e1fb6babd…

Findings

  • high Unauthenticated form AJAX trusts client-controlled form_action (open email relay / Mailchimp abuse)

    unsafe_input

    pagex_form_ajax_send_form is registered for both authenticated and nopriv users. It json_decodes urldecode($_POST['form_action']) and uses attacker-supplied email_to/email_subject for wp_mail, or mailchimp_list_id with the site's stored Mailchimp API key. The hidden pagex-action field is only a convenience; nothing server-side binds the action to a published form. No nonce or capability check. Observable: unauthenticated POSTs to admin-ajax.php?action=pagex_form_ajax_send_form send arbitrary HTML email via the site or subscribe addresses into the site's Mailchimp lists.

    inc/elements/frontend/form.php:788-914

    Recommendation

    Sign form actions (HMAC of action config + form post ID), verify nonce, ignore client email_to/list_id and load them from post meta for that form only; rate-limit unauth submissions.

  • medium Login AJAX lacks nonce (login CSRF)

    csrf

    pagex_form_ajax_send_login_form is nopriv-reachable and calls wp_signon with POST log/pwd without wp_verify_nonce/check_ajax_referer. An attacker can CSRF a victim browser into authenticating to an attacker-controlled account (or attempt credential stuffing UX), and there is no anti-CSRF token on the login path.

    inc/elements/frontend/login-form.php:249-267

    Recommendation

    Require a login-specific nonce (and ideally CAPTCHA/rate limits) before calling wp_signon.

  • medium Super-admin editor/demo AJAX missing nonces (CSRF)

    missing_nonce

    State-changing editor callbacks (pagex_save_layout, pagex_save_as_layout, pagex_upload_layout, pagex_import_post_layout, pagex_export_layout, demo import, export_settings, sync_adobe_fonts) check is_super_admin() but never check_ajax_referer/wp_verify_nonce. A malicious page can CSRF a logged-in super admin into overwriting layouts or importing content.

    inc/pagex-editor-class.php:1281-1290

    Recommendation

    Add check_ajax_referer for each editor/demo AJAX action and prefer current_user_can('edit_posts')/manage_options consistently with nonce.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →