WP Manifestindependent plugin directory
manifest / builders / bbclassdropdown

Beaver Builder Class Dropdown WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

Adds user defined CSS classes (utility classes) to a dropdown below the Beaver Builder class input in the Advanced tab

★ 10stars
1.0.10latest · 1mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/zackpyle/bbclassdropdown/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

This plugin adds the ability to have user predefined CSS classes (aka utility classes) in a dropdown below the Beaver Builder class input in the Advanced tab.

The settings for this plugin are located inside of Beaver Builder's settings, under the new Utility Classes tab.

utility-class-settings

The groups and classes you define in the settings panel will then be displayed inside the builder in a dropdown below the Class input in the Advanced tab.

The little = icon next to the groups and classes let you drag/drop to reorder your groups and classes for your convenience.

Below the utility classes in the admin panel, there is a section called 'Import/Export Settings'. It is useful when you have a default list of classes you like to use on every site (or as a starting point) - so you can create them once and import them into sites as you need.

The last and what I think is the best feature is you also have the ability to select if a group is a 'Single Class Group' - meaning, you can only select one class out of the group at a time. If you check this setting for the group, then in the dropdown, it will give you radio button looking symbols to let you know which class has been added aready. If you select another class, it will swap it for you. This is useful for things like background-color or font-size where you wouldn't have more than one of those classes at a time.

frontend-dropdown

Changelog

v1.0.8 - 7/25/25

  • Now compatible with Beaver Builder v2.10+ Components

v1.0.7 - 3/24/25

  • Fixed Fatal Error in GitHub Updater in some versions of PHP

v1.0.6 - 12/10/24

  • Updated README for clarity
  • Updated the term 'Predefined' to 'Utility'

v1.0.5 - 12/19/23

  • Fix allows &, <, >, ", and ' characters in label field

v1.0.4 - 8/25/23

  • Remove select2 as it was causing a scrolling bug in the settings modal (issue #23)

v1.0.3 - 8/24/23

  • Split up the plugin in functional classes and made it namespaced
  • An autoloader takes care of loading/include_once/require_once the files
  • Load admin script on fl-builder-settings page
  • Fixed fatal error on plugins page (issue #19) - Updater fixed with wp_tempnam and unlink method
  • Fixed reorder class bug (issue #21) - Couldn't reorder classes on new groups before hitting save

v1.0.2 - 8/21/23

  • Fix error when opening other settings panels
  • Moved all functions to BBClassDropdown

v1.0.1 - 8/20/23

  • WP Updater connected so you can get the latest version pushed from Github straight to your WP install

v0.7.0-beta - 8/19/23

  • Previously you could only clear existing classes/settings manually via a url query param. Now there is a new Reset button in the settings section at the bottom of the page
  • After reset (and on initial activation), a new blank group is added so you don't have to click Add Group to get started

v0.6.1-beta - 8/19/23

  • Fixed - v0.5.2 patch forgot to include rows and columns in the 'secondary modal' fix

v0.6.0-beta - 8/19/23

  • New Import/Export Settings feature

v0.5.2-beta - 8/18/23

  • Opening a secondary BB modal (like Post Module -> Custom Layout) would throw an error as the second modal assumed it was a module settings modal. Added more strict logic to look for the module settings modal

v0.5.1-beta - 8/18/23

  • JS refactoring by badabingbreda

v0.5.0-beta - 8/12/23

  • Drag and Drop reorder functionality for both Groups and Classes inside of Groups
  • New table layout / styles
  • Made the code more DRY
  • First class or group can now be deleted if not only-child
  • Don't need to confirm to delete an empty group
  • Bug fixes

v0.4.0-beta - 8/10/23

  • Feature - On groups with single selection substitute previous selected classname from optgroup with selection
  • Feature - Fix for insertion of classes that are prefix of other classes. eg. if uk-flex-center already exists, you couln't add uk-flex later with callback handled by BB in (current) version 2.7.1.1
  • Some code cleanup
  • Renamed singleton checkbox from checkbox to singleton in all code.
  • Select2 is enabled by default

v0.3.3.0-beta - 8/7/23

  • Bug - SVG that holds symbols is taking up space on other tabs
  • Bug - Typo when linking to Select2

v0.3.2-beta - 8/7/23

  • Get rid of Remove Group on first group since you will never delete the first group

v0.3.1-beta - 8/7/23

  • Bug fixes with disabled options
  • Move Delete Group to same column as Delete Class

v0.3.0-beta - 8/7/23

  • Gray out (disable) already used classes in the dropdown
  • Add Select2 option

v0.2.0-beta - 8/7/23

  • Settings page moved to Beaver Builder settings tab

v0.1.1-beta - 8/6/23

  • Settings page saves to WP options

v0.1.0-beta - 8/6/23

  • Initial commit

Releases

12 releases.

Tag
Published
1.0.10 latest
Sep 8, 2026 1mo ago
Oct 12, 2025 1 year ago
Jul 25, 2025 1 year ago
Mar 24, 2025 1 year ago
Dec 11, 2024 1 year ago
Dec 19, 2023 2 years ago
Aug 25, 2023 3 years ago
Aug 25, 2023 3 years ago
Aug 21, 2023 3 years ago
Aug 20, 2023 3 years ago
1.0
Aug 20, 2023 3 years ago
Aug 20, 2023 3 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

Beaver Builder Class Dropdown 1.0.10 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
1.0.10
Findings
2
Worst severity
high
Content hash
3b8fdae07c05d459bcd41dae…

Findings

  • high Unauthenticated GET deletes the utility-class library (clear_bb_class_options)

    missing_auth

    AdminSettings::clear_bb_class_options is hooked to init. The only gate is is_admin(), which is true for every request under /wp-admin/ including unauthenticated ones. There is no current_user_can, is_user_logged_in, or nonce. A GET with clear_bb_class_options set (any value) calls delete_option('beaver_builder_class_dropdown_options') and then registers an admin notice. WordPress fires init inside wp-load.php/wp-settings.php before wp-admin/admin.php's auth_redirect, and wp-admin/admin-ajax.php defines WP_ADMIN and never redirects anonymous users. Observable exploit: GET /wp-admin/admin-ajax.php?clear_bb_class_options=1 as a logged-out visitor (or an <img src> on any page) wipes the site-wide class library that StyleScript localizes into the Beaver Builder editor. The in-file comment even documents navigating to ?clear_bb_class_options=1 as the reset mechanism; the admin JS reset button just adds that query arg. Subscriber and unauthenticated are equivalent here because no login is required.

    includes/classes/Helpers/AdminSettings.php:8-36

    Recommendation

    Require current_user_can('manage_options') (or Beaver Builder's admin-settings capability) and a POST + wp_verify_nonce/check_admin_referer before delete_option. Do not use a GET query arg as a state-changing trigger. Keep the reset button as a capability-checked admin-post or AJAX action.

  • medium Settings save/import on init is nonce-only (no capability) and import stores raw JSON

    missing_capability

    bb_class_dropdown_admin_settings_save is hooked to init (and again to fl_builder_admin_settings_save). After is_admin() it only calls wp_verify_nonce($_POST['bb-class-dd-nonce'], 'bb-class-dd-nonce'); there is no current_user_can sibling. A valid nonce for that action lets the current user write beaver_builder_class_dropdown_options and then FLBuilderModel::delete_asset_cache_for_all_posts() (the cache flush runs even when bb-class-action is neither update nor import). The nonce is printed on the Utility Classes form via fl_builder_admin_settings_render_forms, which on a default install is the manage_options Beaver Builder settings screen — so Subscriber cannot mint it from this plugin's UI — but nonce is not authorization: any leaked or user-specific nonce, or a lowered fl_builder_admin_settings_capability, bypasses the intended admin gate because the handler lives on init rather than behind BB's settings cap. The import branch json_decodes the uploaded file and update_option()s it with no sanitize_text_field (unlike the update branch). Those values are wp_localize_script()'d as BBClassOptions and interpolated into HTML with jQuery .append(`<option value="${cls.id}" data-label="${cls.name}">`) in the builder script (group.name is convertHTML-escaped; class id/name are not). Observable: a holder of bb-class-dd-nonce can replace the class library and flush all BB asset caches; a malicious import can store HTML/attribute breakout strings that the builder dropdown will parse as HTML.

    includes/classes/Helpers/AdminSettings.php:390-470

    Recommendation

    Add current_user_can('manage_options') (or FLBuilder's admin-settings capability) in the same handler as the nonce check. Move the callback off generic init onto fl_builder_admin_settings_save only. Sanitize imported JSON with the same group/class sanitizers as the update path, and escape class id/name before inserting them into HTML. Do not flush all BB caches unless a real settings change succeeded.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.