{ "version": "https://jsonfeed.org/version/1.1", "user_comment": "This feed allows you to read the posts from this site in any feed reader that supports the JSON Feed format. To add this feed to your reader, copy the following URL -- https://wptavern.com/category/plugins/feed/json -- and add it your reader.", "next_url": "https://wptavern.com/category/plugins/feed/json?paged=2", "home_page_url": "https://wptavern.com/category/plugins", "feed_url": "https://wptavern.com/category/plugins/feed/json", "language": "en-US", "title": "Plugins – WP Tavern", "description": "WordPress News \u2014 Free as in Beer.", "icon": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2021/12/cropped-tavern-favicon.png", "items": [ { "id": "https://wptavern.com/?p=149460", "url": "https://wptavern.com/matthaus-klute-acquires-social-link-pages-plugin", "title": "Matthaus Klute Acquires Social Link Pages Plugin", "content_html": "\n
WordPress developer Corey Maass has sold his Social Link Pages plugin to Matthaus Klute, an independent WordPress consultant and developer with Alpha Particle. It’s another story of small plugins changing hands, where developers get the opportunity to test ideas and business models. Even the most modest creations have value in a thriving marketplace where business owners are willing to invest in these types of assets to expand their own offerings.
\n\n\n\nIn 2019, Maass created Social Link Pages after taking a course on how to market himself as a musician and DJ. The course required him to sign up for\u00a0Linktr.ee, a popular “link in bio” landing page service.
\n\n\n\n“In typical developer fashion, instead of paying $8 a month, I thought ‘I should build this,'” Maass said. “So I spent hundreds of hours building Social Link Pages for WordPress.”
\n\n\n\nInitially, Maass built the free version with most of the basic bells and whistles found in other link-in-bio page builders. After getting some pushback from the Plugin Review team, who Maass said were “skeptical about why we needed a ‘mini WordPress inside WordPress,’ the Social Link Pages plugin was approved for the directory.
\n\n\n\nOver the next year he added features that he needed while figuring out the right extras for a Pro version.
\n\n\n\n“Along the way, a user contacted me, asking if the plug-in could be white-labeled and used to build her own SaaS,” Maass said. “Shortly thereafter I released the Pro and Community (i.e. SaaS) versions of the plugin.
\n\n\n\n“Then I took a day job and stopped working on it for about a year and a half. I took the commercial versions offline. I barely looked at the plugin because there were almost no support requests.”
\n\n\n\nWhen Maass’ day job ended 18 months later, he went back to the plugin and was pleasantly surprised to find it had 1,000 active installs. This encouraged him to make some major updates and add new features.
\n\n\n\nThe first marketing effort he made was to put Social Link Pages on AppSumo. At that time they were just opening up their marketplace.
\n\n\n\n“In the marketplace, you don’t benefit from AppSumo’s larger email campaigns, but I think Social Link Pages got a lot of eyes from people looking for good lifetime deals,” Maass said. “I sold about 80-lifetime licenses and was surprised to find that only two or three were ever actually claimed. I’ve since heard of other plugin developers who have had the same experience. Apparently, a lot of people collect lifetime deals, but never actually use them. So in the end it was free money.”
\n\n\n\nOver the next few years, Maass continued to add features but his interest was waning.
\n\n\n\n“The plugin did what I needed on my own sites, so I was not inspired to keep adding features just because I could,” he said. “I also saw a lot of new link-in-bio apps come online, though none were specific to WordPress. And I wanted to move on to new ideas.”
\n\n\n\nAt the beginning of 2023, while considering all of his projects, Maass said he “could not find the willpower to market Social Link Pages as it should be.” He knew he was no longer the best owner for the plugin, so he listed it on a couple of sites dedicated to selling small software products.
\n\n\n\n“I’d always heard the correct pricing for a software product is 12-18 months of revenue,” Maass said. “Social Link Pages was only making about $125 per month at the time, but I was selling a complete business, already set up with e-commerce, multiple products, email automation, and more.
\n\n\n\n“I listed it at $5000. I heard from a dozen or so potential buyers, all of whom asked for charts and spreadsheets I did not have. I’m a developer and guilty of ignoring a lot of the standard sales and ‘biz dev’ practices. As I was asking too much based on what was ‘on paper,’ I did not find a buyer. I unlisted Social Link Pages, figuring I’d try again in the future.”
\n\n\n\nMaass tried again in the summer, listing the plugin in Post Status and a couple of other solopreneur-focused communities. He also dropped the price to $3,000.
\n\n\n\n“Immediately I heard from a number of interested buyers who saw the value in what I was selling,” Maass said.” I probably could’ve brought the price back up to $5000 again, but I wanted to see the plugin go to a new, better owner.”
\n\n\n\nTwo years ago, Maass sold his Kanban for WordPress plugin to Keanan Koppenhaver at Alpha Particle. After discussing with Matthaus Klute, a developer who works with Koppenhaver, Maass knew he had found the right buyer.
\n\n\n\n“He’s a thoughtful developer with WordPress experience interested in building a product business,” Maass said. “We met up in person at WordCamp US in DC in August 2023, and spent a few hours moving all accounts to his name and getting him set up. It was a fun experience to do in person.”
\n\n\n\nKlute said Maass came to him highly recommended from others who had purchased plugins from him in the past. After he spoke with his lawyer, they proceeded to do an in-person asset transfer at WordCamp US (WCUS).
\n\n\n\n“I wasn\u2019t actively shopping for a plugin, however I\u2019ve always had a passing interest in asset and/or small businesses acquisitions,” Klute said. “Corey’s plugin caught my attention for several reasons. It fit well within my budget, boasted an active user base, and generated consistent recurring revenue.
\n\n\n\n“With my 9 -5 spent coding, the prospect of having an existing solution that I could focus on marketing rather than building was enticing. Lastly, I wanted to gain a deeper understanding of the plugin ecosystem.”
\n\n\n\nKlute said Maass’s experience played a crucial role in ensuring a smooth transfer. He had all the plugin’s accounts and services separated from his other entities, making it easily transferable. While at WCUS, they conducted a few Zoom sessions to explore the plugin’s codebase in-depth.
\n\n\n\n“Despite the focus on marketing, I do have a few ideas for the plugin roadmap,” Klute said. “I’m looking at the possibility of a digital business card functionality similar to Blinq and also exploring ways to enhance the plugin\u2019s compatibility with WooCommerce for my dynamic shop functionality for e-commerce businesses.”
\n", "content_text": "WordPress developer Corey Maass has sold his Social Link Pages plugin to Matthaus Klute, an independent WordPress consultant and developer with Alpha Particle. It’s another story of small plugins changing hands, where developers get the opportunity to test ideas and business models. Even the most modest creations have value in a thriving marketplace where business owners are willing to invest in these types of assets to expand their own offerings.\n\n\n\nIn 2019, Maass created Social Link Pages after taking a course on how to market himself as a musician and DJ. The course required him to sign up for\u00a0Linktr.ee, a popular “link in bio” landing page service.\n\n\n\n“In typical developer fashion, instead of paying $8 a month, I thought ‘I should build this,'” Maass said. “So I spent hundreds of hours building Social Link Pages for WordPress.”\n\n\n\nInitially, Maass built the free version with most of the basic bells and whistles found in other link-in-bio page builders. After getting some pushback from the Plugin Review team, who Maass said were “skeptical about why we needed a ‘mini WordPress inside WordPress,’ the Social Link Pages plugin was approved for the directory.\n\n\n\nOver the next year he added features that he needed while figuring out the right extras for a Pro version. \n\n\n\n“Along the way, a user contacted me, asking if the plug-in could be white-labeled and used to build her own SaaS,” Maass said. “Shortly thereafter I released the Pro and Community (i.e. SaaS) versions of the plugin.\n\n\n\n“Then I took a day job and stopped working on it for about a year and a half. I took the commercial versions offline. I barely looked at the plugin because there were almost no support requests.”\n\n\n\nWhen Maass’ day job ended 18 months later, he went back to the plugin and was pleasantly surprised to find it had 1,000 active installs. This encouraged him to make some major updates and add new features.\n\n\n\nThe first marketing effort he made was to put Social Link Pages on AppSumo. At that time they were just opening up their marketplace.\n\n\n\n“In the marketplace, you don’t benefit from AppSumo’s larger email campaigns, but I think Social Link Pages got a lot of eyes from people looking for good lifetime deals,” Maass said. “I sold about 80-lifetime licenses and was surprised to find that only two or three were ever actually claimed. I’ve since heard of other plugin developers who have had the same experience. Apparently, a lot of people collect lifetime deals, but never actually use them. So in the end it was free money.”\n\n\n\nOver the next few years, Maass continued to add features but his interest was waning. \n\n\n\n“The plugin did what I needed on my own sites, so I was not inspired to keep adding features just because I could,” he said. “I also saw a lot of new link-in-bio apps come online, though none were specific to WordPress. And I wanted to move on to new ideas.”\n\n\n\nAt the beginning of 2023, while considering all of his projects, Maass said he “could not find the willpower to market Social Link Pages as it should be.” He knew he was no longer the best owner for the plugin, so he listed it on a couple of sites dedicated to selling small software products.\n\n\n\nSocial Links Plugin Sells for $3K\n\n\n\n“I’d always heard the correct pricing for a software product is 12-18 months of revenue,” Maass said. “Social Link Pages was only making about $125 per month at the time, but I was selling a complete business, already set up with e-commerce, multiple products, email automation, and more.\n\n\n\n“I listed it at $5000. I heard from a dozen or so potential buyers, all of whom asked for charts and spreadsheets I did not have. I’m a developer and guilty of ignoring a lot of the standard sales and ‘biz dev’ practices. As I was asking too much based on what was ‘on paper,’ I did not find a buyer. I unlisted Social Link Pages, figuring I’d try again in the future.”\n\n\n\nMaass tried again in the summer, listing the plugin in Post Status and a couple of other solopreneur-focused communities. He also dropped the price to $3,000. \n\n\n\n“Immediately I heard from a number of interested buyers who saw the value in what I was selling,” Maass said.” I probably could’ve brought the price back up to $5000 again, but I wanted to see the plugin go to a new, better owner.”\n\n\n\nTwo years ago, Maass sold his Kanban for WordPress plugin to Keanan Koppenhaver at Alpha Particle. After discussing with Matthaus Klute, a developer who works with Koppenhaver, Maass knew he had found the right buyer. \n\n\n\n“He’s a thoughtful developer with WordPress experience interested in building a product business,” Maass said. “We met up in person at WordCamp US in DC in August 2023, and spent a few hours moving all accounts to his name and getting him set up. It was a fun experience to do in person.”\n\n\n\nKlute said Maass came to him highly recommended from others who had purchased plugins from him in the past. After he spoke with his lawyer, they proceeded to do an in-person asset transfer at WordCamp US (WCUS).\n\n\n\n“I wasn\u2019t actively shopping for a plugin, however I\u2019ve always had a passing interest in asset and/or small businesses acquisitions,” Klute said. “Corey’s plugin caught my attention for several reasons. It fit well within my budget, boasted an active user base, and generated consistent recurring revenue. \n\n\n\n“With my 9 -5 spent coding, the prospect of having an existing solution that I could focus on marketing rather than building was enticing. Lastly, I wanted to gain a deeper understanding of the plugin ecosystem.”\n\n\n\nKlute said Maass’s experience played a crucial role in ensuring a smooth transfer. He had all the plugin’s accounts and services separated from his other entities, making it easily transferable. While at WCUS, they conducted a few Zoom sessions to explore the plugin’s codebase in-depth.\n\n\n\n“Despite the focus on marketing, I do have a few ideas for the plugin roadmap,” Klute said. “I’m looking at the possibility of a digital business card functionality similar to Blinq and also exploring ways to enhance the plugin\u2019s compatibility with WooCommerce for my dynamic shop functionality for e-commerce businesses.”", "date_published": "2023-09-25T13:44:34-04:00", "date_modified": "2023-09-25T13:44:36-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2023/09/social-link-pages-plugin.jpeg", "tags": [ "News", "Plugins" ] }, { "id": "https://wptavern.com/?p=149369", "url": "https://wptavern.com/block-visibility-3-1-0-adds-woocommerce-and-easy-digital-downloads-controls", "title": "Block Visibility 3.1.0 Adds WooCommerce and Easy Digital Downloads Controls", "content_html": "\nWhen WordPress contributor and developer Nick Diego\u00a0released version 3.0 of his Block Visibility plugin earlier this year in March, he made all the Pro features available in the free version, with the exception of a few that would take more time. The plugin, which is used on more than 10,000 WordPress sites, allows users to conditionally display blocks based on specific user roles, logged in/out, specific users, screen sizes, query strings, ACF fields, and more.
\n\n\n\nIn the latest 3.1.0 update Block Visibility has added the missing WooCommerce and Easy Digital Downloads (EDD) controls. These features were originally planned to be merged into the free version in April but required more development to improve how they work on sites with large product/download catalogs.
\n\n\n\nThe WooCommerce controls include 18 conditional visibility rules with full support for products with variable pricing. It allows users to show or hide blocks based on products, cart contents, customer purchase history, and more.
\n\n\n\n“There is one notable change to the product-based rules,” Diego said. “Previously, you had to select which product you wanted to target with the visibility conditions. While this is still possible, Block Visibility can now detect the current product.
\n\n\n\n“This functionality is extremely useful on product pages, single product templates, and product grids (Query blocks).”
\n\n\n\n\n\n\n\nThe EDD controls allow users to show or hide blocks based on downloads, cart contents, customer purchase history, and more. Since EDD doesn’t have as many block-powered layouts as WooCommerce, Diego did not include the “Detect current product” feature.
\n\n\n\n“The EDD visibility control currently has no product-based rules,” he said. “If greater block support is added to EDD in the future, such as an EDD Products block that supports inner blocks, expect more functionality.”
\n\n\n\nBlock Visibility 3.1.0 also adds a new Command Palette command to “Manage Visibility Presets,” which requires WordPress 6.3+.
\n\n\n\n\n\n\n\nDiego said he doesn’t plan on adding any new integrations to the plugin but will continue improving existing controls. Now that all the features from the Pro version have been merged into the free plugin, users who have the Pro version installed can deactivate it after upgrading to version 3.1.0.
\n", "content_text": "When WordPress contributor and developer Nick Diego\u00a0released version 3.0 of his Block Visibility plugin earlier this year in March, he made all the Pro features available in the free version, with the exception of a few that would take more time. The plugin, which is used on more than 10,000 WordPress sites, allows users to conditionally display blocks based on specific user roles, logged in/out, specific users, screen sizes, query strings, ACF fields, and more. \n\n\n\nIn the latest 3.1.0 update Block Visibility has added the missing WooCommerce and Easy Digital Downloads (EDD) controls. These features were originally planned to be merged into the free version in April but required more development to improve how they work on sites with large product/download catalogs.\n\n\n\nThe WooCommerce controls include 18 conditional visibility rules with full support for products with variable pricing. It allows users to show or hide blocks based on products, cart contents, customer purchase history, and more.\n\n\n\n“There is one notable change to the product-based rules,” Diego said. “Previously, you had to select which product you wanted to target with the visibility conditions. While this is still possible, Block Visibility can now detect the current product.\n\n\n\n“This functionality is extremely useful on product pages, single product templates, and product grids (Query blocks).”\n\n\n\n\n\n\n\n\n\n\n\nThe EDD controls allow users to show or hide blocks based on downloads, cart contents, customer purchase history, and more. Since EDD doesn’t have as many block-powered layouts as WooCommerce, Diego did not include the “Detect current product” feature.\n\n\n\n“The EDD visibility control currently has no product-based rules,” he said. “If greater block support is added to EDD in the future, such as an EDD Products block that supports inner blocks, expect more functionality.”\n\n\n\nBlock Visibility 3.1.0 also adds a new Command Palette command to “Manage Visibility Presets,” which requires WordPress 6.3+.\n\n\n\n\n\n\n\nimage credit: Block Visibility repository – PR #84\n\n\n\nDiego said he doesn’t plan on adding any new integrations to the plugin but will continue improving existing controls. Now that all the features from the Pro version have been merged into the free plugin, users who have the Pro version installed can deactivate it after upgrading to version 3.1.0.", "date_published": "2023-09-22T22:07:22-04:00", "date_modified": "2023-09-22T22:07:24-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2023/09/Screen-Shot-2023-09-22-at-10.01.39-PM.png", "tags": [ "News", "Plugins" ] }, { "id": "https://wptavern.com/?p=149346", "url": "https://wptavern.com/wordpress-plugin-review-team-onboards-new-members-releases-plugin-to-flag-common-errors", "title": "WordPress Plugin Review Team Onboards New Members, Releases Plugin to Flag Common Errors", "content_html": "\nWordPress’ Plugin Review Team continues to dig out from under a massive backlog that has grown to 1,260 plugins awaiting review. Developers submitting new plugins can expect to wait at least 91 days, according to the notice on the queue today.
\n\n\n\n“Currently there are 1,241 plugins awaiting review,” Automattic-sponsored Plugin Review team member Alvaro G\u00f3mez said earlier this week.
\n\n\n\n“We are painstakingly aware of this. We check that number every day and realize how this delay is affecting\u00a0plugin\u00a0authors.”
\n\n\n\nAlthough the backlog seems to be getting worse, G\u00f3mez published an update outlining new systems the team is putting in place to get the situation under control. He likened it to patching a hole in a boat, as opposed to simply prioritizing bailing out the water.
\n\n\n\n“During the last six months, the Plugin review team has worked on documenting its processes, training new members, and improving its tools,” he said. “Now, thanks to your patience and support, the tide is about to turn.”
\n\n\n\nThe team has now onboarded two rounds of new members, with three more reviewers added recently, and has a system in place to make this easier in the future. After receiving more than 40 applications to join the team, the form will be closing at the end of September.
\n\n\n\nThey also sent plugin authors still waiting in the queue an email asking them to self-check their plugins to meet basic security standards, as another effort to mitigate the growing backlog.
\n\n\n\n“We find ourselves correcting the same three or four errors on +95% of plugins and this is not a good use of our time,” G\u00f3mez said. “Once authors confirm that their plugins meet these basic requirements, we will proceed with the review.”
\n\n\n\nA new plugin called Plugin Check has just been published to WordPress.org for plugin authors to self-review for common errors, which will eventually be integrated into the plugin submission process.
\n\n\n\n“Once the PCP is merged with\u00a0this other plugin that the Performance team has been working on, it will provide\u00a0checks for a lot of other things,” G\u00f3mez said. “When this is completed, we will be in a better spot to take in feedback and make improvements.
\n\n\n\n“In the short term, we are going to ask authors to test their plugins using the PCP before submitting them, but our goal is to integrate the plugin as\u00a0part of the submission process\u00a0and run automated checks.”
\n\n\n\nSo far plugin authors have reported a few bugs and issues with the plugin not recognizing files or giving unintelligible errors. These issues can be reported on the GitHub repo, which is temporarily hosted on the 10up GitHub account but will be moving to WordPress.org in the near future.
\n", "content_text": "WordPress’ Plugin Review Team continues to dig out from under a massive backlog that has grown to 1,260 plugins awaiting review. Developers submitting new plugins can expect to wait at least 91 days, according to the notice on the queue today. \n\n\n\n“Currently there are 1,241 plugins awaiting review,” Automattic-sponsored Plugin Review team member Alvaro G\u00f3mez said earlier this week.\n\n\n\n“We are painstakingly aware of this. We check that number every day and realize how this delay is affecting\u00a0plugin\u00a0authors.” \n\n\n\nAlthough the backlog seems to be getting worse, G\u00f3mez published an update outlining new systems the team is putting in place to get the situation under control. He likened it to patching a hole in a boat, as opposed to simply prioritizing bailing out the water.\n\n\n\n“During the last six months, the Plugin review team has worked on documenting its processes, training new members, and improving its tools,” he said. “Now, thanks to your patience and support, the tide is about to turn.”\n\n\n\nThe team has now onboarded two rounds of new members, with three more reviewers added recently, and has a system in place to make this easier in the future. After receiving more than 40 applications to join the team, the form will be closing at the end of September.\n\n\n\nThey also sent plugin authors still waiting in the queue an email asking them to self-check their plugins to meet basic security standards, as another effort to mitigate the growing backlog.\n\n\n\n“We find ourselves correcting the same three or four errors on +95% of plugins and this is not a good use of our time,” G\u00f3mez said. “Once authors confirm that their plugins meet these basic requirements, we will proceed with the review.”\n\n\n\nA new plugin called Plugin Check has just been published to WordPress.org for plugin authors to self-review for common errors, which will eventually be integrated into the plugin submission process.\n\n\n\n“Once the PCP is merged with\u00a0this other plugin that the Performance team has been working on, it will provide\u00a0checks for a lot of other things,” G\u00f3mez said. “When this is completed, we will be in a better spot to take in feedback and make improvements.\n\n\n\n“In the short term, we are going to ask authors to test their plugins using the PCP before submitting them, but our goal is to integrate the plugin as\u00a0part of the submission process\u00a0and run automated checks.”\n\n\n\nSo far plugin authors have reported a few bugs and issues with the plugin not recognizing files or giving unintelligible errors. These issues can be reported on the GitHub repo, which is temporarily hosted on the 10up GitHub account but will be moving to WordPress.org in the near future.", "date_published": "2023-09-22T13:51:11-04:00", "date_modified": "2023-09-22T13:51:13-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2023/09/cHJpdmF0ZS9sci9pbWFnZXMvd2Vic2l0ZS8yMDIyLTA1L3N2MTk5NDM5LWltYWdlLWt3dnVnNzFmLmpwZw.jpg", "tags": [ "plugin review", "News", "Plugins" ] }, { "id": "https://wptavern.com/?p=149118", "url": "https://wptavern.com/wordpress-com-plugin-pages-add-download-link-for-using-plugins-on-self-hosted-sites", "title": "WordPress.com Plugin Pages Add Download Link for Using Plugins on Self-Hosted Sites", "content_html": "\nWordPress.com plugin pages have been updated to include a download link for WordPress.org plugins listed in the .com directory. These are the listings that are scraped from WordPress.org. The plugins are available for free on WordPress.org for self-hosted sites but can only be used on WordPress.com with a paid subscription.
\n\n\n\n\n\n\n\nThe text in the sidebar includes a link to an article explaining the difference between WordPress.org and WordPress.com. It appears on both the logged-out and logged-in views:
\n\n\n\n\n\n\n\n\nThis plugin is available for download to be used on your\u00a0WordPress self-hosted\u00a0installation.
\n
Themes hosted on WordPress.com have a similar notice with a link to download the theme and use it on a self-hosted site.
\n\n\n\nThis change comes as the result of developers raising concerns about WordPress.com plugin listings outranking WordPress.org on Google Search in some instances. During that discussion, many developers were surprised to learn that their plugins created for WordPress.org were also listed on WordPress.com as only available with a paid subscription. Patchstack responded by updating its readme file\u00a0to ensure that WordPress.com users and visitors are made aware that the plugin is available for free in the official WordPress plugin repository. This response may not be necessary now, unless developers want to include a direct link to their plugins.
\n\n\n\nIn a discussion on Post Status Slack, some plugin developers said they would prefer a link to the actual plugin page where they can see and participate in reviews. The omission of a link back to WordPress.org may be intentional, as it would take users off of the .com site, which does not facilitate customers upgrading to paid plans in order to use plugins.
\n\n\n\nSome developers had also asked Automattic CEO Matt Mullenweg to noindex those pages, but he said that WordPress.com users should also be able to search Google for the listings.
\n\n\n\nSome developers have asked to know what percentage of their active installs come from WordPress.com vs. WordPress.org, or other hosting platforms. Mullenweg said there are currently no reports for this but that the data could be interesting.
\n\n\n\n“If people are providing more distribution to unaltered plugins, I think that’s great,” Mullenweg said during the discussion last week. “Happy for all our plugins to be duplicated and distributed by every host and site on the planet.”
\n\n\n\nWhen asked if WordPress.org could extract the data for known plugin distributors, like WordPress.com, Mullenweg said, “.com or any other host could share plugin info if it\u2019s allowed by their privacy policy. Also it\u2019s fairly trivial to get plugin info from crawling sites.”
\n", "content_text": "WordPress.com plugin pages have been updated to include a download link for WordPress.org plugins listed in the .com directory. These are the listings that are scraped from WordPress.org. The plugins are available for free on WordPress.org for self-hosted sites but can only be used on WordPress.com with a paid subscription.\n\n\n\n\n\n\n\nLogged out view of WordPress.com plugin pages\n\n\n\n\n\n\n\nThe text in the sidebar includes a link to an article explaining the difference between WordPress.org and WordPress.com. It appears on both the logged-out and logged-in views:\n\n\n\n\nThis plugin is available for download to be used on your\u00a0WordPress self-hosted\u00a0installation.\n\n\n\n\nThemes hosted on WordPress.com have a similar notice with a link to download the theme and use it on a self-hosted site.\n\n\n\nThis change comes as the result of developers raising concerns about WordPress.com plugin listings outranking WordPress.org on Google Search in some instances. During that discussion, many developers were surprised to learn that their plugins created for WordPress.org were also listed on WordPress.com as only available with a paid subscription. Patchstack responded by updating its readme file\u00a0to ensure that WordPress.com users and visitors are made aware that the plugin is available for free in the official WordPress plugin repository. This response may not be necessary now, unless developers want to include a direct link to their plugins.\n\n\n\nIn a discussion on Post Status Slack, some plugin developers said they would prefer a link to the actual plugin page where they can see and participate in reviews. The omission of a link back to WordPress.org may be intentional, as it would take users off of the .com site, which does not facilitate customers upgrading to paid plans in order to use plugins.\n\n\n\nSome developers had also asked Automattic CEO Matt Mullenweg to noindex those pages, but he said that WordPress.com users should also be able to search Google for the listings.\n\n\n\n\nI think it should show up for .com users who are Googling, and Google appears smart enough prioritize correctly. That\u2019s a SEO benefit, and not at the expense of any plugin authors.— Matt Mullenweg (@photomatt) September 19, 2023\n\n\n\n\nSome developers have asked to know what percentage of their active installs come from WordPress.com vs. WordPress.org, or other hosting platforms. Mullenweg said there are currently no reports for this but that the data could be interesting. \n\n\n\n\nThere are no reports currently for plugin installs by web host. I could see that being interesting, though, especially with how some hosts bundle.— Matt Mullenweg (@photomatt) September 18, 2023\n\n\n\n\n“If people are providing more distribution to unaltered plugins, I think that’s great,” Mullenweg said during the discussion last week. “Happy for all our plugins to be duplicated and distributed by every host and site on the planet.”\n\n\n\nWhen asked if WordPress.org could extract the data for known plugin distributors, like WordPress.com, Mullenweg said, “.com or any other host could share plugin info if it\u2019s allowed by their privacy policy. Also it\u2019s fairly trivial to get plugin info from crawling sites.”", "date_published": "2023-09-20T16:27:33-04:00", "date_modified": "2023-09-20T16:28:36-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2023/09/Screen-Shot-2023-09-20-at-2.41.03-PM.png", "tags": [ "News", "Plugins" ] }, { "id": "https://wptavern.com/?p=148756", "url": "https://wptavern.com/new-plugin-adds-citations-and-bibliography-block-to-wordpress-editor", "title": "New Plugin Adds Citations and Bibliography Block to WordPress Editor", "content_html": "\nCitations is a new plugin created by WP Munich\u00a0and the team at\u00a0Luehrsen // Heinrich, a German WordPress agency. It makes it easy to create in-text citations and assign them a specific source. Most of the existing plugins that do this are for older versions of WordPress. This one is created specifically for those using the block editor.
\n\n\n\nCitations introduces a new menu item to the rich text formatting toolbar. Users can highlight the text they want to cite, click ‘Cite’ in the toolbar, and then define the source in the pop-up by inputting the source information into the fields provided.
\n\n\n\n\n\n\n\nThe Citations plugin includes one Bibliography block, which will be automatically populated with all the sources of the in-text citations added in the content. Citations are linked to the corresponding source inside the Bibliography block. The block can be positioned anywhere in the document, although readers likely expect it at the bottom.
\n\n\n\n\n\n\n\nUsers can edit the citations and the sources in the Bibliography block by clicking on them.
\n\n\n\nWhat’s the difference between citations and WordPress’ core Footnotes block? Although both are used in academic and scholarly writing to provide references and additional information about sources used in a document, there are a few key differences.
\n\n\n\nCitations credit the original source of the information with all the source details in the bibliography at the end of the document. Footnotes are more flexible in that they can include additional context or comments at the bottom of the document, to keep the text from becoming too cluttered with explanatory notes. They may also be used to source citations with the author, title, and publication details, but do not always follow the bibliography format.
\n\n\n\nThe Citations plugin also includes a pattern that will insert some Lorem Ipsum paragraphs with citations and a sample bibliography with sources at the bottom. This gives users an idea of how the plugin can be used to structure a document for citing sources, if they are just getting started. Users can search for “Citations Demo” in the pattern search bar to find it.
\n\n\n\nDownload the plugin for free from WordPress.org, or give it a test drive using WordPress Playground.
\n", "content_text": "Citations is a new plugin created by WP Munich\u00a0and the team at\u00a0Luehrsen // Heinrich, a German WordPress agency. It makes it easy to create in-text citations and assign them a specific source. Most of the existing plugins that do this are for older versions of WordPress. This one is created specifically for those using the block editor.\n\n\n\nCitations introduces a new menu item to the rich text formatting toolbar. Users can highlight the text they want to cite, click ‘Cite’ in the toolbar, and then define the source in the pop-up by inputting the source information into the fields provided.\n\n\n\n\n\n\n\n\n\n\n\nThe Citations plugin includes one Bibliography block, which will be automatically populated with all the sources of the in-text citations added in the content. Citations are linked to the corresponding source inside the Bibliography block. The block can be positioned anywhere in the document, although readers likely expect it at the bottom.\n\n\n\n\n\n\n\n\n\n\n\nUsers can edit the citations and the sources in the Bibliography block by clicking on them.\n\n\n\nWhat’s the difference between citations and WordPress’ core Footnotes block? Although both are used in academic and scholarly writing to provide references and additional information about sources used in a document, there are a few key differences. \n\n\n\nCitations credit the original source of the information with all the source details in the bibliography at the end of the document. Footnotes are more flexible in that they can include additional context or comments at the bottom of the document, to keep the text from becoming too cluttered with explanatory notes. They may also be used to source citations with the author, title, and publication details, but do not always follow the bibliography format.\n\n\n\nThe Citations plugin also includes a pattern that will insert some Lorem Ipsum paragraphs with citations and a sample bibliography with sources at the bottom. This gives users an idea of how the plugin can be used to structure a document for citing sources, if they are just getting started. Users can search for “Citations Demo” in the pattern search bar to find it.\n\n\n\nDownload the plugin for free from WordPress.org, or give it a test drive using WordPress Playground.", "date_published": "2023-09-18T13:43:08-04:00", "date_modified": "2023-09-18T13:43:10-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2023/09/citations-plugin.png", "tags": [ "News", "Plugins" ] }, { "id": "https://wptavern.com/?p=148817", "url": "https://wptavern.com/activitypub-1-0-0-released-introducing-blog-wide-accounts-and-new-blocks", "title": "ActivityPub 1.0.0 Released, Introducing Blog-Wide Accounts and New Blocks", "content_html": "\nVersion 1.0.0 of the ActivityPub plugin was released this week with major updates that make it possible to have a blog-wide account, instead of just individual author accounts, where followers receive updates from all authors. This new feature allows people to follow blogs on decentralized platforms like Mastodon (and many others) with replies automatically published back to the blog as comments.
\n\n\n\nIn the ActivityPub plugin settings, users can check “Enable blog” to have the blog become an ActivityPub profile. Authors can be enabled at the same time as a blog-wide profile.
\n\n\n\n\n\n\n\nActivities originating from a Blog profile can be further customized through the existing post content and image settings. Users can also set the activity object type to default, article, or WordPress post format which maps the post format to the ActivityPub object type. Supported post types include posts, pages, and media. Note that the blog-wide profile only works with sites that have rewrite rules enabled.
\n\n\n\nAn experimental hashtags setting is also available, which adds hashtags in the content as native tags and replaces the #tag with the tag link. Users should be aware that it may still produce HTML or CSS errors.
\n\n\n\nActivityPub 1.0.0 introduces two new blocks – one for displaying Fediverse Followers and the other for displaying a “Follow” button to allow people to follow the blog or author on the Fediverse. The Follower system has also gotten a complete rewrite based on Custom Post Types.
\n\n\n\n\n\n\n\nOther notable updates in this release include the following:
\n\n\n\nAutomattic acquired the plugin in March 2023 from German developer\u00a0Matthias Pfefferle, who joined the company to continue improving support for federated platforms. Next on the roadmap for the ActivityPub plugin is threaded comments support and replacing shortcodes with blocks for layout.
\n", "content_text": "Version 1.0.0 of the ActivityPub plugin was released this week with major updates that make it possible to have a blog-wide account, instead of just individual author accounts, where followers receive updates from all authors. This new feature allows people to follow blogs on decentralized platforms like Mastodon (and many others) with replies automatically published back to the blog as comments. \n\n\n\nIn the ActivityPub plugin settings, users can check “Enable blog” to have the blog become an ActivityPub profile. Authors can be enabled at the same time as a blog-wide profile.\n\n\n\n\n\n\n\n\n\n\n\nActivities originating from a Blog profile can be further customized through the existing post content and image settings. Users can also set the activity object type to default, article, or WordPress post format which maps the post format to the ActivityPub object type. Supported post types include posts, pages, and media. Note that the blog-wide profile only works with sites that have rewrite rules enabled. \n\n\n\n\n\n\n\nAn experimental hashtags setting is also available, which adds hashtags in the content as native tags and replaces the #tag with the tag link. Users should be aware that it may still produce HTML or CSS errors.\n\n\n\nActivityPub 1.0.0 introduces two new blocks – one for displaying Fediverse Followers and the other for displaying a “Follow” button to allow people to follow the blog or author on the Fediverse. The Follower system has also gotten a complete rewrite based on Custom Post Types.\n\n\n\n\n\n\n\n\n\n\n\nOther notable updates in this release include the following: \n\n\n\n\nSignature Verification: https://docs.joinmastodon.org/spec/security/\n\n\n\nSimple caching\n\n\n\nCollection endpoints for Featured Tags and Featured Posts\n\n\n\nBetter handling of Hashtags in mobile apps\n\n\n\nUpdate: Improved linter (PHPCS)\n\n\n\nFixed: Load the plugin later in the WordPress code lifecycle to avoid errors in some requests\n\n\n\nFixed: Updating posts\n\n\n\nFixed: Hashtag now support CamelCase and UTF-8\n\n\n\n\nAutomattic acquired the plugin in March 2023 from German developer\u00a0Matthias Pfefferle, who joined the company to continue improving support for federated platforms. Next on the roadmap for the ActivityPub plugin is threaded comments support and replacing shortcodes with blocks for layout.", "date_published": "2023-09-14T18:43:20-04:00", "date_modified": "2023-09-14T18:43:22-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2023/03/Screen-Shot-2023-03-13-at-2.08.21-PM.png", "tags": [ "activitypub", "News", "Plugins" ] }, { "id": "https://wptavern.com/?p=148759", "url": "https://wptavern.com/developers-raise-concerns-about-wordpress-com-plugin-listings-outranking-wordpress-org-on-google", "title": "Developers Raise Concerns About WordPress.com Plugin Listings Outranking WordPress.org on Google Search", "content_html": "\nWordPress core developer John Blackbourn sparked a heated discussion yesterday when he posted an image of his WordPress User Switching plugin ranking higher for the WordPress.com listing than the page on WordPress.org.
\n\n\n\nBlackbourn later apologized for the inflammatory wording of the original post, but maintains that .com plugin listings being displayed higher in search results is not healthy for the open source project.
\n\n\n\n“This was a frustrated 2AM tweet so I could have worded it better, but the point still stands,” he said. “The plugin pages on dotcom are little more than marketing landing pages for the dotcom service and they’re strongly competing with the canonical dotorg pages. That’s not healthy.”
\n\n\n\nSeveral others commented about having similar experiences when searching for plugins, finding that the WordPress.com often ranks higher, although many others still see WordPress.org pages ranked highest.
\n\n\n\nBlackbourn said his chief concern “is the process that introduced the directory clone on .com either disregarded its potential impact on .org in favor of inbounds or never considered it in the first place – both very concerning given the ranking power of .com.”
\n\n\n\nThe tweet highlighted the frustration some members of the open source community feel due to the perennial branding confusion between WordPress.com and WordPress.org. Nothing short of renaming WordPress.com will eliminate the longstanding confusion, but this is unlikely as Automattic benefits from tightly coupling its products to WordPress\u2019 name recognition.
\n\n\n\n“Duplicate content confuses the human + search engines,” SEO consultant Rebecca Gill said. “Search engines won’t like it, nor will humans trying to find solutions to their problems. There is already enough confusion w/ .org + .com for non-tech folks. This amplifies it. Noindex .com content or canonical it to .org.”
\n\n\n\nParticipants in the discussion maintain that the duplication of the open source project’s plugin directory “creates ambiguity and confusion” but WordPress co-creator and Automattic CEO Matt Mullenweg contends it also gives plugin authors greater distribution.
\n\n\n\n“It’s providing distribution to the plugin authors, literally millions and millions of installs,” Mullenweg said. He elaborated on how the cloned plugin directory is integrated with Calypso, WordPress.com’s admin interface:
\n\n\n\n\n\n\n\n\n.com has its own plugin directory which includes the .org one, it provides more installs and distribution to the plugin authors, which helps their usage and for commercial ones gets them more sales. The plugins are not altered. .com takes no cut for the distribution.
\n
When participants in the discussion suggested that other hosts doing the same thing would create a wild west situation for plugin rankings, Mullenweg said he would not mind if the plugins were “duplicated and distributed by every host and site on the planet,” as they are all licensed under the GPL.
\n\n\n\nOutrage against distributing WordPress.org plugins in this fashion was not universal in the discussion. A few commenters support this strategy and see it as beneficial for the long-term health of the open source project.
\n\n\n\n“I’m all for it to be honest,” WordPress developer Cristian Raiber said. “Anyone could scrape those pages but not everyone gives back to WordPress and makes sure it’s here to stay for the next decades. Controversial, I know. But I prefer we build together instead of alone.
\n\n\n\n“I fail to see how this is not an advantage to anyone who hosts their plugins (for FREE) on w[dot]org ?” Raiber continued in a separate response. “Is it about being outranked in Google’s SERPs for brand kws? Why has this generated so much outcry when the intent is clearly beneficial?
\n\n\n\n“This FINALLY solves a friction point for potential buyers. Streamlined plugin installation and usage vs ‘here’s a list of 55 steps you have to take to install my plugin.’ Users want options, different uses cases and all. I want wp.com to make money so they keep growing this product.”
\n\n\n\nXWP\u00a0Director of Engineering\u00a0Francesca Marano suggested that WordPress.com has benefitted from the branding and reputation of .org, which is built by volunteers. She also proposed that Automattic “has the resources to do a whole rebranding which would ultimately benefit both projects.”
\n\n\n\nMullenweg responded to these comments, defending WordPress.com’s efforts in fending off early WordPress competitors and cited Automattic’s preeminence in contributing back to core, despite taking in less revenue than some larger companies making money from the software:
\n\n\n\n\n\n\n\n\nSince its foundation, .org has benefitted from the branding and reputation of having a robust SaaS version available from .com, including a free version, something basically no other host does. Over 200M people have used it, and countless started on .com and then migrated to another host. The shared branding made it very difficult for services like Typepad to compete. You want to see what WP would look like without it? Go to Joomla.
\n\n\n\n.com has also been the source of countless performance improvements, we deploy pre-release versions of core to millions of sites to find bugs and do testing, making WP releases way more stable for regular users and hosts. No company contributes more, even though many make more from WP than .com’s revenue. It would have been way easier to fork the software, not merge MU. Most hosts (and many community members) bad-mouth .com while not contributing a fraction back to core. Hosts spend tens of millions a year on ads against .com. I get attacked constantly.
\n
In 2010, when the WordPress Foundation was created, Automattic transferred the WordPress trademarks to the Foundation, after having been the temporary custodian of the trademarks until that time. As part of the transfer, the Foundation granted Mullenweg use of the WordPress trademark for WordPress.com.
\n\n\n\nThis trademark was deliberately secured, and the company does not appear to be open to renaming the platform. This doesn’t mean WordPress.com can’t do anything to mitigate the confusion that scraping the WordPress.org plugin directory creates. Participants in the discussion suggested that WordPress.com forego indexing the pages they created for plugins that developers submitted to the open source project.
\n\n\n\n“You can control SEO by telling search engines to not index those pages of open source software developed for .org on the .com domain,” WordPress plugin developer Marco Almeida said.
\n\n\n\n“I have 20 free plugins on the repository and I don’t see how my plugins will benefit if we open this pandora box and normalize cloning these pages and diluting the WordPress.org importance on search engines.”
\n\n\n\nDevelopers who are just now discovering their WordPress.org plugins cloned to WordPress.com listings are also wanting to know how many of their installs come from WordPress.com so they can better understand their user bases. Mullenweg suggested developers who want a different listing for WordPress.com users can sign up for the .com marketplace.
\n\n\n\nTensions remained high as the heated discussion continued throughout the day and into the evening with criticism flowing across X (Twitter), Post Status Slack, and other social channels, as many developers learned for the first time that their plugin listings have been cloned on WordPress.com. As long as a commercial entity shares the open source project’s branding, these types of clashes and friction will continue popping up.
\n\n\n\n“Personally, I can\u2019t help but empathize with plugin authors that chose to support OSS and find the directory cloned in a commercial service, albeit free, with no access to stats,” Francesca Marano said. “As I mentioned before, the main issue is the confusion around the two projects.”
\n", "content_text": "WordPress core developer John Blackbourn sparked a heated discussion yesterday when he posted an image of his WordPress User Switching plugin ranking higher for the WordPress.com listing than the page on WordPress.org.\n\n\n\n\nWhy has @wordpressdotcom replicated the entire https://t.co/oTA9NDVkFk plugin directory on its .com domain name? Searching for some plugin names now results in the .com page ranking higher than .org. Fuck the long term health of the FOSS project, let's make some money, right? pic.twitter.com/UD40BN3Z6g— John Blackbourn (@johnbillion) September 13, 2023\n\n\n\n\nBlackbourn later apologized for the inflammatory wording of the original post, but maintains that .com plugin listings being displayed higher in search results is not healthy for the open source project.\n\n\n\n“This was a frustrated 2AM tweet so I could have worded it better, but the point still stands,” he said. “The plugin pages on dotcom are little more than marketing landing pages for the dotcom service and they’re strongly competing with the canonical dotorg pages. That’s not healthy.”\n\n\n\nSeveral others commented about having similar experiences when searching for plugins, finding that the WordPress.com often ranks higher, although many others still see WordPress.org pages ranked highest. \n\n\n\nBlackbourn said his chief concern “is the process that introduced the directory clone on .com either disregarded its potential impact on .org in favor of inbounds or never considered it in the first place – both very concerning given the ranking power of .com.”\n\n\n\nThe tweet highlighted the frustration some members of the open source community feel due to the perennial branding confusion between WordPress.com and WordPress.org. Nothing short of renaming WordPress.com will eliminate the longstanding confusion, but this is unlikely as Automattic benefits from tightly coupling its products to WordPress\u2019 name recognition.\n\n\n\n“Duplicate content confuses the human + search engines,” SEO consultant Rebecca Gill said. “Search engines won’t like it, nor will humans trying to find solutions to their problems. There is already enough confusion w/ .org + .com for non-tech folks. This amplifies it. Noindex .com content or canonical it to .org.”\n\n\n\nParticipants in the discussion maintain that the duplication of the open source project’s plugin directory “creates ambiguity and confusion” but WordPress co-creator and Automattic CEO Matt Mullenweg contends it also gives plugin authors greater distribution.\n\n\n\n“It’s providing distribution to the plugin authors, literally millions and millions of installs,” Mullenweg said. He elaborated on how the cloned plugin directory is integrated with Calypso, WordPress.com’s admin interface:\n\n\n\n\n.com has its own plugin directory which includes the .org one, it provides more installs and distribution to the plugin authors, which helps their usage and for commercial ones gets them more sales. The plugins are not altered. .com takes no cut for the distribution.\n\n\n\n\nWhen participants in the discussion suggested that other hosts doing the same thing would create a wild west situation for plugin rankings, Mullenweg said he would not mind if the plugins were “duplicated and distributed by every host and site on the planet,” as they are all licensed under the GPL.\n\n\n\n\nIf people are providing more distribution to unaltered plugins, I think that's great. Happy for all our plugins to be duplicated and distributed by every host and site on the planet.— Matt Mullenweg (@photomatt) September 13, 2023\n\n\n\n\nOutrage against distributing WordPress.org plugins in this fashion was not universal in the discussion. A few commenters support this strategy and see it as beneficial for the long-term health of the open source project.\n\n\n\n“I’m all for it to be honest,” WordPress developer Cristian Raiber said. “Anyone could scrape those pages but not everyone gives back to WordPress and makes sure it’s here to stay for the next decades. Controversial, I know. But I prefer we build together instead of alone.\n\n\n\n“I fail to see how this is not an advantage to anyone who hosts their plugins (for FREE) on w[dot]org ?” Raiber continued in a separate response. “Is it about being outranked in Google’s SERPs for brand kws? Why has this generated so much outcry when the intent is clearly beneficial?\n\n\n\n“This FINALLY solves a friction point for potential buyers. Streamlined plugin installation and usage vs ‘here’s a list of 55 steps you have to take to install my plugin.’ Users want options, different uses cases and all. I want wp.com to make money so they keep growing this product.”\n\n\n\nXWP\u00a0Director of Engineering\u00a0Francesca Marano suggested that WordPress.com has benefitted from the branding and reputation of .org, which is built by volunteers. She also proposed that Automattic “has the resources to do a whole rebranding which would ultimately benefit both projects.”\n\n\n\nMullenweg responded to these comments, defending WordPress.com’s efforts in fending off early WordPress competitors and cited Automattic’s preeminence in contributing back to core, despite taking in less revenue than some larger companies making money from the software:\n\n\n\n\nSince its foundation, .org has benefitted from the branding and reputation of having a robust SaaS version available from .com, including a free version, something basically no other host does. Over 200M people have used it, and countless started on .com and then migrated to another host. The shared branding made it very difficult for services like Typepad to compete. You want to see what WP would look like without it? Go to Joomla. \n\n\n\n.com has also been the source of countless performance improvements, we deploy pre-release versions of core to millions of sites to find bugs and do testing, making WP releases way more stable for regular users and hosts. No company contributes more, even though many make more from WP than .com’s revenue. It would have been way easier to fork the software, not merge MU. Most hosts (and many community members) bad-mouth .com while not contributing a fraction back to core. Hosts spend tens of millions a year on ads against .com. I get attacked constantly.\n\n\n\n\nIn 2010, when the WordPress Foundation was created, Automattic transferred the WordPress trademarks to the Foundation, after having been the temporary custodian of the trademarks until that time. As part of the transfer, the Foundation granted Mullenweg use of the WordPress trademark for WordPress.com.\n\n\n\nThis trademark was deliberately secured, and the company does not appear to be open to renaming the platform. This doesn’t mean WordPress.com can’t do anything to mitigate the confusion that scraping the WordPress.org plugin directory creates. Participants in the discussion suggested that WordPress.com forego indexing the pages they created for plugins that developers submitted to the open source project.\n\n\n\n“You can control SEO by telling search engines to not index those pages of open source software developed for .org on the .com domain,” WordPress plugin developer Marco Almeida said.\n\n\n\n“I have 20 free plugins on the repository and I don’t see how my plugins will benefit if we open this pandora box and normalize cloning these pages and diluting the WordPress.org importance on search engines.”\n\n\n\n\nDotcom can help by using schema markup that points to dotorg as the authority (using the "about" and/or "sameAs" properties). The dotorg pages already have the schema markup in place, you'll just need to point to it from dotcom.This is helpful for dotcom too. Although Google\u2026— Jeff Matson (@TheJeffMatson) September 13, 2023\n\n\n\n\nDevelopers who are just now discovering their WordPress.org plugins cloned to WordPress.com listings are also wanting to know how many of their installs come from WordPress.com so they can better understand their user bases. Mullenweg suggested developers who want a different listing for WordPress.com users can sign up for the .com marketplace.\n\n\n\n\nwell, this could be true, but as plugin author I don\u2019t know how many installations are on .com or .org, or how to show the plugin description/features in a different way to a .com user. I think that the main issue here is the directory cloning— Simone Maranzana (@simo_m) September 13, 2023\n\n\n\n\nTensions remained high as the heated discussion continued throughout the day and into the evening with criticism flowing across X (Twitter), Post Status Slack, and other social channels, as many developers learned for the first time that their plugin listings have been cloned on WordPress.com. As long as a commercial entity shares the open source project’s branding, these types of clashes and friction will continue popping up.\n\n\n\n“Personally, I can\u2019t help but empathize with plugin authors that chose to support OSS and find the directory cloned in a commercial service, albeit free, with no access to stats,” Francesca Marano said. “As I mentioned before, the main issue is the confusion around the two projects.”", "date_published": "2023-09-14T00:05:39-04:00", "date_modified": "2023-09-14T08:00:47-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2014/12/plugin.jpg", "tags": [ "wordpress.com", "News", "Plugins" ] }, { "id": "https://wptavern.com/?p=148726", "url": "https://wptavern.com/wordpress-org-plugin-developers-renew-demands-for-better-plugin-metrics", "title": "WordPress Plugin Developers Renew Demands for Better Plugin Metrics", "content_html": "\nIt has be nearly one year since WordPress silently turned off active install growth data for plugins hosted in the official plugin repository, a key metric that many developers rely on for accurate tracking and product decision-making. \u201cInsufficient data obfuscation\u201d was cited as the reason for the charts\u2019 removal, but this opaque decision landed without any communication from those who had made the call in a private discussion.
\n\n\n\nIn a ticket originally titled \u201cBring back the active install growth chart,\u201d RebelCode CEO Mark Zahra made the opening plea for thousands of plugin developers who were asking for the return of this data. From those who simply host hobby plugins and enjoy the thrill of watching people use software they made to business owners who need this data to make critical decisions, the overwhelming consensus was that this data is valuable and should be available to those who are contributing to WordPress through plugins.
\n\n\n\nIn an appearance on the WPwatercooler podcast last year, Audrey Capital-sponsored meta contributor Samuel “Otto” Wood confirmed the decision was made through private channels via Slack DMs in a discussion initiated by Matt Mullenweg. He also revealed that the active install growth chart was removed because it was giving inaccurate data and that the data one could derive from it was inaccurate:
\n\n\n\n\n\n\n\n\nI read through all that discussion and we worked, they worked on it for a long, Scott and several people tried various things before removing it. They adjusted the values, they adjusted numbers. They, they went through a ridiculous amount of iteration and in the end, none of it worked. People were still using it even though it was giving them basically garbage. So finally removing it was the only thing to do. We did have a plan for replacing it. We just didn\u2019t have a plan for replacing it immediately. Nevertheless, giving them active install count numbers that are wrong is more harmful, we felt, to both users and developers interests than simply not giving them at all.
\n
Wood offered an explanation on the podcast that should have been delivered weeks earlier by those involved in the discussion on official channels. Despite the earlier data being flawed and “insufficiently obfuscated,” developers still want access to the raw data, not interpretations of that data.
\n\n\n\nThese are the posts that track the history and development of developers’ pleas to reinstate access to the data:
\n\n\n\n\n\n\n\nDuring the height of this discussion, developers made many suggestions for different data points that would be meaningful for tracking their efforts, and Matt Mullenweg responded that he was amenable to showing more stats to plugin authors about their plugins. No progress on this effort has been reported since then.
\n\n\n\nStellarWP Product Marketing Director Taylor Waldon has reopened this discussion nearly a year later, calling on Mullenweg to stop restricting access to plugin data from people who are hosting themes and plugins on WordPress.org.
\n\n\n\n“I talked to a bunch of folks at [WCUS] contributor day,” Paid Memberships Pro co-founder and CEO Jason Coleman said in response to Waldon’s tweet. “As far as I know, there isn’t any other current effort to update or replace the install count numbers or old ‘growth’ chart.'”
\n\n\n\nColeman put together a draft proposal with some ideas from his conversations. The document describes a common scenario where plugin developers are left in the dark about the growth or decline of their plugins’ active installations:
\n\n\n\n\n\n\n\n\nImagine a developer with a plugin with 150k active installations. That developer has effectively 0 quantitative feedback on whether users of his plugin are growing or falling. The download count has a trend, but there is no separation between new downloads and updates. The download count tracks developmental pace as much as user growth. A bump in downloads could be due to a security vulnerability being patched or an influx of new users. The current active installations count is severely rounded and offers no feedback until such a plugin either gains or loses 33% of its users, which are drastically different outcomes.
\n
Coleman contends that plugins hosted outside of WordPress.org are able to gather more meaningful metrics. Popular plugins have resorted to including features in non-WordPress.org add-ons or simply removing their extensions altogether from the repository for lack of data.
\n\n\n\nHis proposal includes a few metrics that would help developers better track their plugins, even if that data is only shown to the authors themselves:
\n\n\n\nColeman’s draft is still in progress and so far he is the only one who has authored the document. If the recommended actions gain any traction, he said he hopes to be part of the contributor team that implements the changes.
\n\n\n\n“The intention was to write something that could be proposed to meta team,” Coleman said. “But honestly, I thought I would write it up, it would get shot down, and then I could move on with my life. Even if nothing got updated, it would be more clear to me and others which parts of the .org code were in public repositories and which were in the private repositories. It would be more clear what the real issues are with the active installs count.
\n\n\n\n“The communication around the removal of the active install growth chart caused many to lose trust in parts of the WordPress .org project. I thought some clarity around how things work and the real reasons around the changes would help to rebuild some of that trust that was lost.”
\n\n\n\nWordPress.org has always been the most popular distribution channel for the most widely used plugins, but the data available has not kept pace with developer and business needs. Releasing the raw data, while respecting any privacy limitations, would allow developers to extract their own interpretations of that data and allow services to present it in creative ways.
\n\n\n\nAt the very least, this data should be available to developers (even if it’s not public) to help them better track the trajectory of their plugins and the efficacy of their marketing efforts. More data can only serve to improve the WordPress ecosystem’s ability to continue powering a multi-billion dollar economy. There are undoubtedly many technical requirements for supporting the release of this data, and they need to be prioritized if WordPress.org is to continue attracting the best products for distribution.
\n\n\n\n“This is not about vanity metrics or inflating numbers for marketing purposes,” Coleman said. “This is about getting valuable feedback on the relative use of a plugin hosted in the .org repository so developers can make informed decisions and investments in those plugins.”
\n", "content_text": "It has be nearly one year since WordPress silently turned off active install growth data for plugins hosted in the official plugin repository, a key metric that many developers rely on for accurate tracking and product decision-making. \u201cInsufficient data obfuscation\u201d was cited as the reason for the charts\u2019 removal, but this opaque decision landed without any communication from those who had made the call in a private discussion.\n\n\n\nIn a ticket originally titled \u201cBring back the active install growth chart,\u201d RebelCode CEO Mark Zahra made the opening plea for thousands of plugin developers who were asking for the return of this data. From those who simply host hobby plugins and enjoy the thrill of watching people use software they made to business owners who need this data to make critical decisions, the overwhelming consensus was that this data is valuable and should be available to those who are contributing to WordPress through plugins.\n\n\n\nIn an appearance on the WPwatercooler podcast last year, Audrey Capital-sponsored meta contributor Samuel “Otto” Wood confirmed the decision was made through private channels via Slack DMs in a discussion initiated by Matt Mullenweg. He also revealed that the active install growth chart was removed because it was giving inaccurate data and that the data one could derive from it was inaccurate:\n\n\n\n\nI read through all that discussion and we worked, they worked on it for a long, Scott and several people tried various things before removing it. They adjusted the values, they adjusted numbers. They, they went through a ridiculous amount of iteration and in the end, none of it worked. People were still using it even though it was giving them basically garbage. So finally removing it was the only thing to do. We did have a plan for replacing it. We just didn\u2019t have a plan for replacing it immediately. Nevertheless, giving them active install count numbers that are wrong is more harmful, we felt, to both users and developers interests than simply not giving them at all. \n\n\n\n\nWood offered an explanation on the podcast that should have been delivered weeks earlier by those involved in the discussion on official channels. Despite the earlier data being flawed and “insufficiently obfuscated,” developers still want access to the raw data, not interpretations of that data. \n\n\n\nThese are the posts that track the history and development of developers’ pleas to reinstate access to the data:\n\n\n\n\n\n\n\n\nWordPress.org Removes Active Install Growth Data for Plugins\n\n\n\nWordPress.org Plugin Developers Demand Transparency Regarding the Removal of Active Install Growth Data\n\n\n\nDiscussion on Replacing Plugin Active Install Growth Data Continues Behind Closed Doors\n\n\n\n\nDuring the height of this discussion, developers made many suggestions for different data points that would be meaningful for tracking their efforts, and Matt Mullenweg responded that he was amenable to showing more stats to plugin authors about their plugins. No progress on this effort has been reported since then.\n\n\n\n StellarWP Product Marketing Director Taylor Waldon has reopened this discussion nearly a year later, calling on Mullenweg to stop restricting access to plugin data from people who are hosting themes and plugins on WordPress.org.\n\n\n\n\nDear @photomatt Without (real) Active Install data, we are not able to measure the success of our free product. Downloads is not the right KPI. Please bring it back. Sincerely,All WP Marketers with free products on .org. If you agree, please RT, reply, etc. #WordPress— Taylor Elizabeth Rose | Find me on Bluesky (@tElizaRose) September 5, 2023\n\n\n\n\n“I talked to a bunch of folks at [WCUS] contributor day,” Paid Memberships Pro co-founder and CEO Jason Coleman said in response to Waldon’s tweet. “As far as I know, there isn’t any other current effort to update or replace the install count numbers or old ‘growth’ chart.'”\n\n\n\nColeman put together a draft proposal with some ideas from his conversations. The document describes a common scenario where plugin developers are left in the dark about the growth or decline of their plugins’ active installations:\n\n\n\n\nImagine a developer with a plugin with 150k active installations. That developer has effectively 0 quantitative feedback on whether users of his plugin are growing or falling. The download count has a trend, but there is no separation between new downloads and updates. The download count tracks developmental pace as much as user growth. A bump in downloads could be due to a security vulnerability being patched or an influx of new users. The current active installations count is severely rounded and offers no feedback until such a plugin either gains or loses 33% of its users, which are drastically different outcomes.\n\n\n\n\nColeman contends that plugins hosted outside of WordPress.org are able to gather more meaningful metrics. Popular plugins have resorted to including features in non-WordPress.org add-ons or simply removing their extensions altogether from the repository for lack of data. \n\n\n\nHis proposal includes a few metrics that would help developers better track their plugins, even if that data is only shown to the authors themselves:\n\n\n\n\nShare a more accurate active installations count with the owners of a plugin.\n\n\n\nShare more accurate version number counts with the owners of a plugin.\n\n\n\nDifferentiate the download count by type: website downloads, dashboard installs, dashboard downloads, updates, other (hits to the zip file).\n\n\n\nAllow plugin developers to define custom event triggers to be tallied and displayed to the plugin owners on the plugins .org profile page.\n\n\n\n\nColeman’s draft is still in progress and so far he is the only one who has authored the document. If the recommended actions gain any traction, he said he hopes to be part of the contributor team that implements the changes. \n\n\n\n“The intention was to write something that could be proposed to meta team,” Coleman said. “But honestly, I thought I would write it up, it would get shot down, and then I could move on with my life. Even if nothing got updated, it would be more clear to me and others which parts of the .org code were in public repositories and which were in the private repositories. It would be more clear what the real issues are with the active installs count.\n\n\n\n“The communication around the removal of the active install growth chart caused many to lose trust in parts of the WordPress .org project. I thought some clarity around how things work and the real reasons around the changes would help to rebuild some of that trust that was lost.”\n\n\n\nWordPress.org has always been the most popular distribution channel for the most widely used plugins, but the data available has not kept pace with developer and business needs. Releasing the raw data, while respecting any privacy limitations, would allow developers to extract their own interpretations of that data and allow services to present it in creative ways.\n\n\n\nAt the very least, this data should be available to developers (even if it’s not public) to help them better track the trajectory of their plugins and the efficacy of their marketing efforts. More data can only serve to improve the WordPress ecosystem’s ability to continue powering a multi-billion dollar economy. There are undoubtedly many technical requirements for supporting the release of this data, and they need to be prioritized if WordPress.org is to continue attracting the best products for distribution.\n\n\n\n“This is not about vanity metrics or inflating numbers for marketing purposes,” Coleman said. “This is about getting valuable feedback on the relative use of a plugin hosted in the .org repository so developers can make informed decisions and investments in those plugins.”", "date_published": "2023-09-12T16:24:26-04:00", "date_modified": "2023-09-13T12:29:16-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2023/09/chart.jpeg", "tags": [ "News", "Plugins" ] }, { "id": "https://wptavern.com/?p=148573", "url": "https://wptavern.com/acfs-2023-annual-survey-results-reinforce-plugins-focus-on-improving-the-block-building-experience", "title": "ACF\u2019s 2023 Annual Survey Results Reinforce Plugin\u2019s Focus on Improving the Block Building Experience", "content_html": "\nAdvanced Custom Fields (ACF), one of the plugins WP Engine\u00a0acquired from Delicious Brains\u00a0in 2022, has published the results if its first annual survey. Although ACF reports more than 4.5 million active users, including PRO site installs, the survey only gathered feedback from 2,031 respondents.
\n\n\n\nThese results are more representative of the plugin’s developer community, as 81% of respondents are developers who maintain between 11-50 websites. 63% use version control for their codebase, and 27% manage dependencies with Composer.
\n\n\n\nThe survey showed that ACF is still an important tool for its early adopters, as 50% said they have been using it since its early days and 70% of all respondents use the plugin on all the websites they build.
\n\n\n\nWhen asked what type of sites they are building, respondents had the option to choose multiple answers. Sites using Classic WordPress themes are the most popular followed by Hybrid themes, Block themes, and page builders. Surveying those who use the block editor, 56% report that they build blocks using ACF blocks.
\n\n\n\n\n\n\n\n“It was cool to see the strong representation of hybrid and block themes,” WP Engine Product Marketing Manager Rob Stinson said. “It shows us that there is growing adoption of the modern WP editor experience amongst the PHP friendly crowd that is the ACF user base.
\n\n\n\n“We had this scoped for upcoming releases anyway, but it reinforces our focus on improving the block building experience in ACF.”
\n\n\n\nAmong those ACF users building sites with page builders, the most popular selections include Elementor, Divi, Beaver Builder, and WPBakery Page Builder. Naturally, ACF Extended is the most popular extension used with ACF, followed by Gravity Forms, Yoast SEO, and ACF Better Search.
\n\n\n\n\n\n\n\nRespondents demonstrated high confidence in those maintaining the plugin, as 98% of them are comfortable updating ACF to the latest version. They are also confident in continuing to build on top of WordPress, as 91% of survey participants said they are likely to continue with the platform. For a more detailed look at the questions and responses, check out the 2023 annual survey results on the ACF website.
\n", "content_text": "Advanced Custom Fields (ACF), one of the plugins WP Engine\u00a0acquired from Delicious Brains\u00a0in 2022, has published the results if its first annual survey. Although ACF reports more than 4.5 million active users, including PRO site installs, the survey only gathered feedback from 2,031 respondents. \n\n\n\nThese results are more representative of the plugin’s developer community, as 81% of respondents are developers who maintain between 11-50 websites. 63% use version control for their codebase, and 27% manage dependencies with Composer.\n\n\n\nThe survey showed that ACF is still an important tool for its early adopters, as 50% said they have been using it since its early days and 70% of all respondents use the plugin on all the websites they build.\n\n\n\nWhen asked what type of sites they are building, respondents had the option to choose multiple answers. Sites using Classic WordPress themes are the most popular followed by Hybrid themes, Block themes, and page builders. Surveying those who use the block editor, 56% report that they build blocks using ACF blocks.\n\n\n\n\n\n\n\n\n\n\n\n“It was cool to see the strong representation of hybrid and block themes,” WP Engine Product Marketing Manager Rob Stinson said. “It shows us that there is growing adoption of the modern WP editor experience amongst the PHP friendly crowd that is the ACF user base. \n\n\n\n“We had this scoped for upcoming releases anyway, but it reinforces our focus on improving the block building experience in ACF.”\n\n\n\nAmong those ACF users building sites with page builders, the most popular selections include Elementor, Divi, Beaver Builder, and WPBakery Page Builder. Naturally, ACF Extended is the most popular extension used with ACF, followed by Gravity Forms, Yoast SEO, and ACF Better Search.\n\n\n\n\n\n\n\n\n\n\n\nRespondents demonstrated high confidence in those maintaining the plugin, as 98% of them are comfortable updating ACF to the latest version. They are also confident in continuing to build on top of WordPress, as 91% of survey participants said they are likely to continue with the platform. For a more detailed look at the questions and responses, check out the 2023 annual survey results on the ACF website.", "date_published": "2023-09-08T13:27:52-04:00", "date_modified": "2023-09-08T13:27:54-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2022/04/ACF-logo.jpg", "tags": [ "acf", "News", "Plugins" ] }, { "id": "https://wptavern.com/?p=148460", "url": "https://wptavern.com/patchstack-reports-404-vulnerabilities-affecting-1-6m-websites-to-wordpress-org-plugins-team", "title": "Patchstack Reports 404 Vulnerabilities Affecting 1.6M+ Websites to WordPress.org Plugins Team", "content_html": "\nAfter an accumulation of undisclosed and unpatched vulnerabilities in plugins hosted on WordPress.org, Patchstack has reported 404 plugins to WordPress’ Plugin Review Team.
\n\n\n\n“This situation creates a significant risk for the WordPress community, and we decided to take action,” Patchstack researcher Darius Sveikauskas said. “Since these developers have been unreachable, we sent the full list of those 404 vulnerabilities to the plugins review team for processing.”
\n\n\n\nOrdinarily, reporting plugins to WordPress.org is a last resort for challenging cases after Patchstack fails to find a way to contact the vendors. In this case, many of these plugin authors have included zero contact information in their extensions or are not responding to communication attempts. Patchstack has characterized it as a “zombie plugins pandemic” due to the overwhelming number of abandoned plugins affecting more than 1.6 million sites.
\n\n\n\nThe WordPress.org Plugins Team has acted on the report by closing more than 70% of the plugins.\u00a0In June, the team\u00a0added six new sponsored volunteers\u00a0and opened applications for more team members but have struggled with managing a formidable backlog of plugins waiting to be reviews. The backlog is climbing higher and is now over 1,119 plugins with a 71-day wait time.
\n\n\n\n\n\n\n\nAdding plugin vulnerability issues, where hundreds have to be closed, only adds to how long developers have to wait to get new plugins reviewed.
\n\n\n\nAs of August 31, 2023, Patchstack reports the following stats associated with these reports to WordPress.org:
\n\n\n\nPatchstack is urging developers to add their contact details to their plugins’\u00a0readme.txt\u00a0and/or\u00a0SECURITY.md\u00a0files. To streamline security issue management, the company has created the Patchstack\u00a0mVDP (managed vulnerability disclosure program)\u00a0project, which is free for developers to join. Patchstack validates the reports that come through, rewards the researchers, and passes them to the vendor to be addressed.
\n\n\n\nThe company is also advocating for a dashboard alert when a plugin or theme is removed due to security reasons, as WordPress does not currently give the user this information. Their researchers will soon be submitting more reports that may result in closed extensions.
\n\n\n\n“We are preparing more similar lists for the WordPress.org themes repository and repositories focused on premium products,” Sveikauskas said. “We are currently processing about extra 200+ similar vulnerabilities.”
\n", "content_text": "After an accumulation of undisclosed and unpatched vulnerabilities in plugins hosted on WordPress.org, Patchstack has reported 404 plugins to WordPress’ Plugin Review Team. \n\n\n\n“This situation creates a significant risk for the WordPress community, and we decided to take action,” Patchstack researcher Darius Sveikauskas said. “Since these developers have been unreachable, we sent the full list of those 404 vulnerabilities to the plugins review team for processing.”\n\n\n\nOrdinarily, reporting plugins to WordPress.org is a last resort for challenging cases after Patchstack fails to find a way to contact the vendors. In this case, many of these plugin authors have included zero contact information in their extensions or are not responding to communication attempts. Patchstack has characterized it as a “zombie plugins pandemic” due to the overwhelming number of abandoned plugins affecting more than 1.6 million sites.\n\n\n\nThe WordPress.org Plugins Team has acted on the report by closing more than 70% of the plugins.\u00a0In June, the team\u00a0added six new sponsored volunteers\u00a0and opened applications for more team members but have struggled with managing a formidable backlog of plugins waiting to be reviews. The backlog is climbing higher and is now over 1,119 plugins with a 71-day wait time. \n\n\n\n\n\n\n\n\n\n\n\nAdding plugin vulnerability issues, where hundreds have to be closed, only adds to how long developers have to wait to get new plugins reviewed.\n\n\n\nAs of August 31, 2023, Patchstack reports the following stats associated with these reports to WordPress.org:\n\n\n\n\n404 vulnerabilities\n\n\n\n358 plugins affected\n\n\n\n289 plugins (71,53%) \u2013 Closed\n\n\n\n109 plugins (26,98%) \u2013 Patched\n\n\n\n6 plugins (1,49%) \u2013 Not closed / Not patched\n\n\n\nUp to 1.6 million active installs affected\n\n\n\nAverage installs per plugin 4984\n\n\n\nHighest install count 100000 (two plugins)\n\n\n\nHighest CVSS 9.1\n\n\n\nAverage CVSS 5.8\n\n\n\n\u201cOldest\u201d plugin \u2013 13 years since the last update\n\n\n\n\nPatchstack is urging developers to add their contact details to their plugins’\u00a0readme.txt\u00a0and/or\u00a0SECURITY.md\u00a0files. To streamline security issue management, the company has created the Patchstack\u00a0mVDP (managed vulnerability disclosure program)\u00a0project, which is free for developers to join. Patchstack validates the reports that come through, rewards the researchers, and passes them to the vendor to be addressed.\n\n\n\nThe company is also advocating for a dashboard alert when a plugin or theme is removed due to security reasons, as WordPress does not currently give the user this information. Their researchers will soon be submitting more reports that may result in closed extensions.\n\n\n\n“We are preparing more similar lists for the WordPress.org themes repository and repositories focused on premium products,” Sveikauskas said. “We are currently processing about extra 200+ similar vulnerabilities.”", "date_published": "2023-09-02T00:31:27-04:00", "date_modified": "2023-09-02T00:31:28-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2021/11/patchstack_logo_light.jpg", "tags": [ "security", "News", "Plugins" ] }, { "id": "https://wptavern.com/?p=147997", "url": "https://wptavern.com/new-chrome-browser-extension-enables-one-click-plugin-and-theme-testing-with-wordpress-playground", "title": "New Chrome Browser Extension Enables One-Click Plugin and Theme Testing with WordPress Playground", "content_html": "\nWordPress Playground, an experimental project that uses WebAssembly (WASM) to run WordPress in the browser, makes it possible for users to quickly test plugins and themes without having to set up a local development environment.
\n\n\n\nOrdinarily, testing a plugin or theme with Playground requires visiting playground.wordpress.net
, which will instantly create a real WordPress instance with admin access without having to install PHP, MySQL, or Apache. It runs inside the browser using a SQLite database. Adding a plugin or theme to the instance is as easy as appending the slug to the URL when creating the test site:
https://playground.wordpress.net/?plugin=gutenberg
\n\n\n\nhttps://playground.wordpress.net/?theme=lemmony-agency
\n\n\n\nA new Chrome browser extension, created by LUBUS, a development agency, makes this even easier by adding a “Playground” button to theme and plugin pages on WordPress.org. Users can fire up a sandbox instance to test drive a theme or plugin in just one click.
\n\n\n\n\n\n\n\nI tested the extension and it works as advertised. It’s a neat little shortcut for launching a Playground instance without having to remember the URL or get the plugin/theme’s slug to append to it. The video below shows a site created with a selected plugin installed in under 20 seconds.
\n\n\n\n\n\n\n\n“We have been using Playground internally a lot for testing out plugins, and quick demos for internal or client meetings,” LUBUS founder Ajit Bohra said. “We often find a plugin or theme which we would like to test drive. It involves copying the slug of the theme or plugin and using them in the URL. To make this quick we thought of building and quick browser extension to add a button on wordpress.org to quickly launch a plugin or theme in the Playground.”
\n\n\n\nBohra posted his process of creating the extension in a thread on X. He used the Plasmo framework, which offers a dedicated runtime for building browser extensions, taking the project from idea to built in approximately 30 minutes.
\n\n\n\nBohra said the browser extension is currently a proof of concept that he would like to further extend with more settings based on feedback from users. He also hopes to collaborate with the Meta team in the future to see something like this added to the plugin and theme pages on WordPress.org so that users don’t have to rely on a browser extension.
\n\n\n\nThe Chrome extension is called “Open in WordPress Playground” and is available to the public for free on the Chrome Web Store. The code is open source on GitHub and open for contribution.
\n", "content_text": "WordPress Playground, an experimental project that uses WebAssembly (WASM) to run WordPress in the browser, makes it possible for users to quickly test plugins and themes without having to set up a local development environment.\n\n\n\nOrdinarily, testing a plugin or theme with Playground requires visiting playground.wordpress.net, which will instantly create a real WordPress instance with admin access without having to install PHP, MySQL, or Apache. It runs inside the browser using a SQLite database. Adding a plugin or theme to the instance is as easy as appending the slug to the URL when creating the test site: \n\n\n\nhttps://playground.wordpress.net/?plugin=gutenberg\n\n\n\nhttps://playground.wordpress.net/?theme=lemmony-agency\n\n\n\nA new Chrome browser extension, created by LUBUS, a development agency, makes this even easier by adding a “Playground” button to theme and plugin pages on WordPress.org. Users can fire up a sandbox instance to test drive a theme or plugin in just one click. \n\n\n\n\n\n\n\n\n\n\n\nI tested the extension and it works as advertised. It’s a neat little shortcut for launching a Playground instance without having to remember the URL or get the plugin/theme’s slug to append to it. The video below shows a site created with a selected plugin installed in under 20 seconds.\n\n\n\n\n\n\n\n\n\n\n\n“We have been using Playground internally a lot for testing out plugins, and quick demos for internal or client meetings,” LUBUS founder Ajit Bohra said. “We often find a plugin or theme which we would like to test drive. It involves copying the slug of the theme or plugin and using them in the URL. To make this quick we thought of building and quick browser extension to add a button on wordpress.org to quickly launch a plugin or theme in the Playground.”\n\n\n\nBohra posted his process of creating the extension in a thread on X. He used the Plasmo framework, which offers a dedicated runtime for building browser extensions, taking the project from idea to built in approximately 30 minutes.\n\n\n\n\nFor POC code wise all we need to get the required button on the plugin page. pic.twitter.com/2lEV2H4q0K— Ajit Bohra (@ajitbohra) August 18, 2023\n\n\n\n\nBohra said the browser extension is currently a proof of concept that he would like to further extend with more settings based on feedback from users. He also hopes to collaborate with the Meta team in the future to see something like this added to the plugin and theme pages on WordPress.org so that users don’t have to rely on a browser extension.\n\n\n\nThe Chrome extension is called “Open in WordPress Playground” and is available to the public for free on the Chrome Web Store. The code is open source on GitHub and open for contribution.", "date_published": "2023-08-21T20:56:50-04:00", "date_modified": "2023-08-21T20:56:52-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2023/07/cHJpdmF0ZS9zdGF0aWMvaW1hZ2Uvd2Vic2l0ZS8yMDIyLTA0L2xyL3B4MTEzMjUzMy1pbWFnZS1rd3Z5Njh4MS5qcGc.jpg", "tags": [ "wordpress playground", "News", "Plugins", "Themes" ], "attachments": [ { "url": "https://wptavern.com/wp-content/uploads/2023/08/playground-chrome-extension.mp4", "mime_type": "video/mp4", "size_in_bytes": 1444281 } ] }, { "id": "https://wptavern.com/?p=147855", "url": "https://wptavern.com/group-one-acquires-backwpup-adminimize-and-search-replace-plugins", "title": "group.one Acquires BackWPup, Adminimize, and Search & Replace Plugins", "content_html": "\ngroup.one, a European cloud hosting and digital marketing services provider, has acquired the BackWPup,\u00a0Adminimize, and\u00a0Search & Replace\u00a0plugins from Inpsyde. Together the products have more than 1.1 million active installs and will join group.one’s growing portfolio of WordPress products, which include WP Rocket,\u00a0Imagify, and\u00a0Rank Math SEO.
\n\n\n\nInpsyde sold the plugins to focus more on its consulting and product services.
\n\n\n\n“This sale lets us concentrate on our core competencies and work more closely with our clients, like PayPal, Payoneer, and Mollie, providing the know-how to develop and reach their full potential with new avenues for advancement,” Inpsyde CEO Alex Frison said.
\n\n\n\n\u00a0The acquired plugins will be managed by the development team at WP Media, one of group.one’s brands, expanding its offerings beyond optimization and SEO to include backup and site management capabilities.
\n\n\n\n“Backup and recovery solutions are crucial to protect websites against data loss and we look forward to further developing BackWPup, along with Adminimize and Search & Replace,” group.one CEO Daniel Hagemeier said. “Together with WordPress hosting from WP.one and one.com, and our flagship products WP Rocket, Imagify, and Rank Math SEO, WordPress users can now come to group.one to optimize, secure, maintain and promote their online presence.\u201d
\n\n\n\nWhen asked what specific features are being prioritized on the immediate roadmap, group.one representative Simon Kraft said “the smooth transition over to WP Media” is their focus following the sale. He was unable to comment on whether the commercial versions of the acquired plugins would be subject to any pricing changes.
\n", "content_text": "group.one, a European cloud hosting and digital marketing services provider, has acquired the BackWPup,\u00a0Adminimize, and\u00a0Search & Replace\u00a0plugins from Inpsyde. Together the products have more than 1.1 million active installs and will join group.one’s growing portfolio of WordPress products, which include WP Rocket,\u00a0Imagify, and\u00a0Rank Math SEO.\n\n\n\nInpsyde sold the plugins to focus more on its consulting and product services.\n\n\n\n“This sale lets us concentrate on our core competencies and work more closely with our clients, like PayPal, Payoneer, and Mollie, providing the know-how to develop and reach their full potential with new avenues for advancement,” Inpsyde CEO Alex Frison said.\n\n\n\n\u00a0The acquired plugins will be managed by the development team at WP Media, one of group.one’s brands, expanding its offerings beyond optimization and SEO to include backup and site management capabilities. \n\n\n\n“Backup and recovery solutions are crucial to protect websites against data loss and we look forward to further developing BackWPup, along with Adminimize and Search & Replace,” group.one CEO Daniel Hagemeier said. “Together with WordPress hosting from WP.one and one.com, and our flagship products WP Rocket, Imagify, and Rank Math SEO, WordPress users can now come to group.one to optimize, secure, maintain and promote their online presence.\u201d\n\n\n\nWhen asked what specific features are being prioritized on the immediate roadmap, group.one representative Simon Kraft said “the smooth transition over to WP Media” is their focus following the sale. He was unable to comment on whether the commercial versions of the acquired plugins would be subject to any pricing changes.", "date_published": "2023-08-16T23:08:18-04:00", "date_modified": "2023-08-16T23:08:20-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2023/08/Screen-Shot-2023-08-16-at-11.04.58-PM.png", "tags": [ "News", "Plugins" ] }, { "id": "https://wptavern.com/?p=147639", "url": "https://wptavern.com/wordpress-plugin-review-team-addresses-backlog-of-900-plugins-implements-strategies-to-improve-approval-process", "title": "WordPress Plugin Review Team Addresses Backlog of 900+ Plugins, Implements Strategies to Improve Approval Process", "content_html": "\nWordPress’ Plugin Review team is wading through a backlog that was over 900 plugins awaiting approval earlier this week. The current count has 870 plugins sitting in the review queue, with an average wait time of 61 days before initial review.
\n\n\n\n\n\n\n\nWordPress developer Marcus Burnette drew attention to the matter on Twitter after submitting a plugin he created to display a gallery of your own WordPress Photo Directory photos on your website. Other developers commented on his post, reporting that their recently-approved plugins took two months.
\n\n\n\nWordPress Executive Director Josepha Haden Chomphosy responded with an invitation to contributors who want to learn how to review plugins and apply to join the team.
\n\n\n\nThe volunteer team responsible for reviewing plugins has undergone significant restructuring after the departure of long-time contributor Mika Epstein. In June, the team added six new sponsored volunteers and opened applications for more team members. They have selected new team reps and have more than 20 applicants who have expressed interest in volunteering.
\n\n\n\n“The first challenge we found during our onboarding was the fact that a lot of processes were not clearly documented,” newly selected team rep Francisco Torres said in a recent update. “We asked A LOT of questions during this process and ensured that all the answers Mika shared with us were added to the team\u2019s internal docs. This effort should make it a lot easier for new contributors to join the team down the road.
\n\n\n\n“We have also improved our internal tools to catch the most common coding mistakes and have built our predefined responses into the output provided by this tool. We still review this content manually before sending out replies, but by merging the two tasks into one (reviewing the code and drafting the message) we have been able to cut down review time considerably.”
\n\n\n\nIn strategizing ways to cut through the formidable plugin backlog, the team has begun speeding up the process by performing a cursory initial review, followed by a more thorough one once the plugin author has fixed the most obvious issues.
\n\n\n\n“In order to tackle the backlog faster, we\u2019re now spending less time on initial reviews,” Torres said. “We begin checking issues that take us less time, and then as soon as we spot one or two issues with the plugin that would prevent it from being approved, we email the plugin author to ask them to fix the initial issues. If the author gets back to us with those first fixes, then we proceed with an in-depth review.”
\n\n\n\nA two-month wait can be demoralizing for developers who are excited to share their open source plugins with the world. Now that the whole process is getting documented and refined to be more efficient, the Plugin Review Team will be better able to onboard new reviewers and put them in place to tackle the backlog.
\n", "content_text": "WordPress’ Plugin Review team is wading through a backlog that was over 900 plugins awaiting approval earlier this week. The current count has 870 plugins sitting in the review queue, with an average wait time of 61 days before initial review.\n\n\n\n\n\n\n\n\n\n\n\nWordPress developer Marcus Burnette drew attention to the matter on Twitter after submitting a plugin he created to display a gallery of your own WordPress Photo Directory photos on your website. Other developers commented on his post, reporting that their recently-approved plugins took two months.\n\n\n\nWordPress Executive Director Josepha Haden Chomphosy responded with an invitation to contributors who want to learn how to review plugins and apply to join the team.\n\n\n\n\nThere's an open application for anyone who wants to learn how to review these plugins and help us chip away at the backlog! https://t.co/nDF3tiOuvH https://t.co/28lrCFtx4U— Josepha Haden Chomphosy (@JosephaHaden) August 8, 2023\n\n\n\n\nThe volunteer team responsible for reviewing plugins has undergone significant restructuring after the departure of long-time contributor Mika Epstein. In June, the team added six new sponsored volunteers and opened applications for more team members. They have selected new team reps and have more than 20 applicants who have expressed interest in volunteering.\n\n\n\n“The first challenge we found during our onboarding was the fact that a lot of processes were not clearly documented,” newly selected team rep Francisco Torres said in a recent update. “We asked A LOT of questions during this process and ensured that all the answers Mika shared with us were added to the team\u2019s internal docs. This effort should make it a lot easier for new contributors to join the team down the road.\n\n\n\n“We have also improved our internal tools to catch the most common coding mistakes and have built our predefined responses into the output provided by this tool. We still review this content manually before sending out replies, but by merging the two tasks into one (reviewing the code and drafting the message) we have been able to cut down review time considerably.”\n\n\n\nIn strategizing ways to cut through the formidable plugin backlog, the team has begun speeding up the process by performing a cursory initial review, followed by a more thorough one once the plugin author has fixed the most obvious issues.\n\n\n\n“In order to tackle the backlog faster, we\u2019re now spending less time on initial reviews,” Torres said. “We begin checking issues that take us less time, and then as soon as we spot one or two issues with the plugin that would prevent it from being approved, we email the plugin author to ask them to fix the initial issues. If the author gets back to us with those first fixes, then we proceed with an in-depth review.”\n\n\n\nA two-month wait can be demoralizing for developers who are excited to share their open source plugins with the world. Now that the whole process is getting documented and refined to be more efficient, the Plugin Review Team will be better able to onboard new reviewers and put them in place to tackle the backlog.", "date_published": "2023-08-09T21:39:54-04:00", "date_modified": "2023-08-09T21:39:56-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2014/12/plugin.jpg", "tags": [ "News", "Plugins" ] }, { "id": "https://wptavern.com/?p=147644", "url": "https://wptavern.com/kadence-blocks-3-1-11-patches-critical-vulnerability", "title": "Kadence Blocks 3.1.11 Patches Critical Vulnerability", "content_html": "\nThe Kadence Blocks plugin, which is used on more than 300,000 WordPress sites, has patched a critical vulnerability in its Advanced Form Block file upload capability. Version 3.1.11, released on August 8, 2023, patches the security issue with the form uploads.
\n\n\n\nThe plugin’s development team is getting out ahead of the situation by posting an advisory on their blog, with a short description of the vulnerability and its potential for exploit.
\n\n\n\n\n\n\n\n\nThe Kadence Advanced Form Block, introduced in Kadence Blocks 3.1, offers site owners the ability to add a file upload capability to their site. The code within the Advanced Form Block had insufficient tests to limit what types of files can be uploaded. This could allow attackers to upload a file claiming to be a valid image type that actually contained malicious PHP code. That PHP code could be malicious, and in so doing, take over a vulnerable WordPress website. Exploiting this vulnerability would require a settings at the server level that would be considered insecure. Most premium hosting providers secure upload folders from PHP execution at the server level, though many budget hosting providers do not.
\n
Kadence Blocks developer Ben Ritner said sites that are not using the Advanced Form Block file upload capability are not subject to this vulnerability. At this time the vulnerability is not known to have been exploited.
\n\n\n\nKadence Blocks users are encouraged to update immediately and check for unexpected users, admin accounts, and content changes. The advisory also includes ways to make file uploads more secure, including limiting file type, adding authentication, and scanning for viruses.
\n", "content_text": "The Kadence Blocks plugin, which is used on more than 300,000 WordPress sites, has patched a critical vulnerability in its Advanced Form Block file upload capability. Version 3.1.11, released on August 8, 2023, patches the security issue with the form uploads.\n\n\n\nThe plugin’s development team is getting out ahead of the situation by posting an advisory on their blog, with a short description of the vulnerability and its potential for exploit.\n\n\n\n\nThe Kadence Advanced Form Block, introduced in Kadence Blocks 3.1, offers site owners the ability to add a file upload capability to their site. The code within the Advanced Form Block had insufficient tests to limit what types of files can be uploaded. This could allow attackers to upload a file claiming to be a valid image type that actually contained malicious PHP code. That PHP code could be malicious, and in so doing, take over a vulnerable WordPress website. Exploiting this vulnerability would require a settings at the server level that would be considered insecure. Most premium hosting providers secure upload folders from PHP execution at the server level, though many budget hosting providers do not.\n\n\n\n\nKadence Blocks developer Ben Ritner said sites that are not using the Advanced Form Block file upload capability are not subject to this vulnerability. At this time the vulnerability is not known to have been exploited.\n\n\n\nKadence Blocks users are encouraged to update immediately and check for unexpected users, admin accounts, and content changes. The advisory also includes ways to make file uploads more secure, including limiting file type, adding authentication, and scanning for viruses.", "date_published": "2023-08-09T16:36:09-04:00", "date_modified": "2023-08-09T16:36:10-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2023/08/Screen-Shot-2023-08-09-at-3.53.08-PM.png", "tags": [ "News", "Plugins" ] }, { "id": "https://wptavern.com/?p=147547", "url": "https://wptavern.com/covertkit-updates-wordpress-plugin-adds-members-only-content-newsletter-feed-and-product-embeds", "title": "ConvertKit Updates WordPress Plugin, Adds Members Only Content, Newsletter Feed, and Product Embeds", "content_html": "\nConvertKit has updated its official WordPress plugin and WooCommerce add-on to support a range of new features. More than 40,000 sites use ConvertKit’s plugin to integrate their newsletters, email campaigns, and digital products with WordPress. The service is free for the user’s first 1,000 subscribers but offers more automated features and third party integration on its paid tiers.
\n\n\n\nThe latest version of the ConvertKit plugin for WordPress brings the “Members Content” feature out of beta. It allows site owners to set up gated content for things like courses, e-books, or curated content without having to switch platforms, keeping members on the WordPress site.
\n\n\n\nIn the WordPress admin, under the ConvertKit >> Member Content settings, admins can now specify a ConvertKit Commerce product to be required in order to view a post, page, or WooCommerce product page.
\n\n\n\nThis update also adds a “Newsletter feed” that ConvertKit users can embed on their WordPress sites to display a paginated list of their public broadcast emails. It can be shown as a grid with images and descriptions or a list with subject and date.
\n\n\n\nRecent updates to the plugin also introduce product embeds, allowing site owners to create a storefront of their ConvertKit products on their WordPress sites. The styles for the embedded products can be edited inside the Site Editor.
\n\n\n\nOther notable improvements in this round of updates include the following:
\n\n\n\nMore detailed information on the settings for the new features is available in the ConvertKit documentation on customizing subscribers’ experience on WordPress websites.
\n", "content_text": "ConvertKit has updated its official WordPress plugin and WooCommerce add-on to support a range of new features. More than 40,000 sites use ConvertKit’s plugin to integrate their newsletters, email campaigns, and digital products with WordPress. The service is free for the user’s first 1,000 subscribers but offers more automated features and third party integration on its paid tiers.\n\n\n\nThe latest version of the ConvertKit plugin for WordPress brings the “Members Content” feature out of beta. It allows site owners to set up gated content for things like courses, e-books, or curated content without having to switch platforms, keeping members on the WordPress site.\n\n\n\nIn the WordPress admin, under the ConvertKit >> Member Content settings, admins can now specify a ConvertKit Commerce product to be required in order to view a post, page, or WooCommerce product page.\n\n\n\nWordPress content gated by ConvertKit subscription – image source: ConvertKit documentation\n\n\n\nThis update also adds a “Newsletter feed” that ConvertKit users can embed on their WordPress sites to display a paginated list of their public broadcast emails. It can be shown as a grid with images and descriptions or a list with subject and date.\n\n\n\nRecent updates to the plugin also introduce product embeds, allowing site owners to create a storefront of their ConvertKit products on their WordPress sites. The styles for the embedded products can be edited inside the Site Editor.\n\n\n\nOther notable improvements in this round of updates include the following: \n\n\n\n\nThe WooCommerce add-on for ConvertKit has been updated to map customer first and last names to ConvertKit custom fields\n\n\n\nNew “Form Trigger Block” creates a button that triggers a pop-up modal \n\n\n\nPHP SDK now available for building on top of the ConvertKit API\n\n\n\n\nMore detailed information on the settings for the new features is available in the ConvertKit documentation on customizing subscribers’ experience on WordPress websites.", "date_published": "2023-08-07T22:58:48-04:00", "date_modified": "2023-08-08T12:53:34-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2023/08/convertkit-logo.png", "tags": [ "News", "Plugins" ] }, { "id": "https://wptavern.com/?p=147385", "url": "https://wptavern.com/jetpack-launches-newsletter-product", "title": "Jetpack Launches Newsletter Product", "content_html": "\nJetpack 12.4 was released today, launching the plugin’s Newsletter product. It allows users to send blog posts as newsletters, without the hassle of having to copy and paste from the WordPress editor into another newsletter service’s campaign editor and reformat it for email. This launch comes seven months after WordPress.com launched its newsletter offering, which uses the same underlying infrastructure to deliver emails.
\n\n\n\nJetpack Newsletter is launching as a free product, with a percentage of fees collected from creators who choose to offer paid subscriptions:
\n\n\n\n\n\n\n\n\n\n\n\n\nFees are only collected when you accept payments. Fees are based on the Jetpack plan you have and are calculated as a percentage of your revenue from 10% on the Free plan to 2% on the Complete plan (plus Stripe fees).\u00a0
\n
Jetpack users are probably familiar with the plugin’s ability to send posts to subscribers via email. The newsletter feature uses this same infrastructure that site owners have relied on for years to allow subscribers to get updates in their inboxes when new posts are available.
\n\n\n\n\n\n\n\nNewsletters can be turned on under the Discussion tab in the Jetpack settings. Many Jetpack users likely already have this turned on.
\n\n\n\n\n\n\n\nThe Subscribe block can be placed anywhere on the site and new subscribers will be sent a confirmation email to confirm their subscription. They have the option to choose between instant, daily, or a weekly digest, as well as control the time and day they receive their digests. Subscribers can also pause or unsubscribe from the site.
\n\n\n\nSubscriber import and other features, such as newsletter stats for opens and clicks, is available via the Jetpack admin pages on WordPress.com.
\n\n\n\nAt this time, newsletter creators can only import up to 100 subscribers via CSV file. This is severely limiting for all but the smallest of newsletters, but the Jetpack team has confirmed that it is high on their list of priorities to change as it creates too much of a barrier. The limit was set for spam prevention, but it makes it nearly impossible to migrate to Jetpack Newsletter if you have a popular newsletter. Those who are on paid plans can upload unlimited subscribers.
\n\n\n\n\n\n\n\nNewsletter creators can change the site name and logo for their emails and paid users will have more customization options in the future.
\n\n\n\nOne thing that sets Jetpack Newsletter apart from the vast majority of other traditional email service providers is that it allows unlimited email sends and unlimited\u00a0subscriber lists for both free and paid users.
\n\n\n\nMost popular services like Mailchimp, Brevo, and SendGrid, allow only a few hundred emails to be sent per day or up to 1,000 per month for free users. Paid plans get expensive quickly as a newsletter’s subscriber base grows. Emails and subscriber numbers usually determine the pricing for these services, which makes Jetpack’s product stand out from the crowd, especially for those who intend to independently monetize their newsletter through ads and paid sponsorships.
\n\n\n\nJetpack Marketing Lead Rob Pugh said that although popular newsletter services are more limited in emails and subscriber numbers, they also offer a completely different feature set. The Jetpack Newsletter product is aimed at competitors like Substack.com,\u00a0Beehiiv.com,\u00a0and Ghost.org,\u00a0which also all offer unlimited email sends. On paid plans, Jetpack Newsletter’s offer beats Substack, as it collects 2% (plus Stripe fees) as compared to Substack’s take of 10% plus credit card fees.
\n\n\n\nNewsletter creators should be aware that Jetpack Newsletter’s unlimited emails and subscribers may not last forever, as the FAQ section of the product states that it is an introductory offer:
\n\n\n\n\n\n\n\n\nAs an introductory offer, we do not limit you or charge you based on your email list size. This may change in the future. Fair usage policy applies.
\n
Jetpack representatives were not able to confirm the limits of fair usage or how long the introductory period will last.
\n\n\n\n“Launching without a limit on emails isn\u2019t the most financially responsible thing, but we\u2019re most excited to get this feature into the hands of people to get feedback,” Pugh said. “We\u2019re focused on the immediate roadmap to make the product better, although there will likely be a limit at some point in the future if we see extreme use from people on free plans.”
\n\n\n\nHe said the Jetpack team goes out of its way to make pricing changes as fairly as possible “and we don\u2019t want to pull the rug out from anyone, so we\u2019ll certainly consider how people are impacted before making changes.”\u00a0
\n\n\n\nUntil the limited subscriber import issue has been solved, any pricing changes down the road are only likely to affect newsletters that are just starting out getting people signed up. Apart from this limitation, Jetpack Newsletter is making a competitive debut in the market. For those who are already using Jetpack and have an existing subscriber base, it makes it nearly effortless to add paid subscriptions. Using the block editor is far easier than most newsletter campaign editors out there, and Jetpack streamlines the sending process so creators don’t have to copy and paste between email services.
\n", "content_text": "Jetpack 12.4 was released today, launching the plugin’s Newsletter product. It allows users to send blog posts as newsletters, without the hassle of having to copy and paste from the WordPress editor into another newsletter service’s campaign editor and reformat it for email. This launch comes seven months after WordPress.com launched its newsletter offering, which uses the same underlying infrastructure to deliver emails.\n\n\n\nJetpack Newsletter is launching as a free product, with a percentage of fees collected from creators who choose to offer paid subscriptions:\n\n\n\n\nFees are only collected when you accept payments. Fees are based on the Jetpack plan you have and are calculated as a percentage of your revenue from 10% on the Free plan to 2% on the Complete plan (plus Stripe fees).\u00a0\n\n\n\n\n\n\n\n\n\n\n\n\nJetpack users are probably familiar with the plugin’s ability to send posts to subscribers via email. The newsletter feature uses this same infrastructure that site owners have relied on for years to allow subscribers to get updates in their inboxes when new posts are available. \n\n\n\n\n\n\n\n\n\n\n\nNewsletters can be turned on under the Discussion tab in the Jetpack settings. Many Jetpack users likely already have this turned on.\n\n\n\n\n\n\n\n\n\n\n\nThe Subscribe block can be placed anywhere on the site and new subscribers will be sent a confirmation email to confirm their subscription. They have the option to choose between instant, daily, or a weekly digest, as well as control the time and day they receive their digests. Subscribers can also pause or unsubscribe from the site.\n\n\n\nSubscriber import and other features, such as newsletter stats for opens and clicks, is available via the Jetpack admin pages on WordPress.com. \n\n\n\nAt this time, newsletter creators can only import up to 100 subscribers via CSV file. This is severely limiting for all but the smallest of newsletters, but the Jetpack team has confirmed that it is high on their list of priorities to change as it creates too much of a barrier. The limit was set for spam prevention, but it makes it nearly impossible to migrate to Jetpack Newsletter if you have a popular newsletter. Those who are on paid plans can upload unlimited subscribers. \n\n\n\n\n\n\n\n\n\n\n\nNewsletter creators can change the site name and logo for their emails and paid users will have more customization options in the future.\n\n\n\nOne thing that sets Jetpack Newsletter apart from the vast majority of other traditional email service providers is that it allows unlimited email sends and unlimited\u00a0subscriber lists for both free and paid users. \n\n\n\nMost popular services like Mailchimp, Brevo, and SendGrid, allow only a few hundred emails to be sent per day or up to 1,000 per month for free users. Paid plans get expensive quickly as a newsletter’s subscriber base grows. Emails and subscriber numbers usually determine the pricing for these services, which makes Jetpack’s product stand out from the crowd, especially for those who intend to independently monetize their newsletter through ads and paid sponsorships.\n\n\n\nJetpack Marketing Lead Rob Pugh said that although popular newsletter services are more limited in emails and subscriber numbers, they also offer a completely different feature set. The Jetpack Newsletter product is aimed at competitors like Substack.com,\u00a0Beehiiv.com,\u00a0and Ghost.org,\u00a0which also all offer unlimited email sends. On paid plans, Jetpack Newsletter’s offer beats Substack, as it collects 2% (plus Stripe fees) as compared to Substack’s take of 10% plus credit card fees.\n\n\n\nNewsletter creators should be aware that Jetpack Newsletter’s unlimited emails and subscribers may not last forever, as the FAQ section of the product states that it is an introductory offer:\n\n\n\n\nAs an introductory offer, we do not limit you or charge you based on your email list size. This may change in the future. Fair usage policy applies.\n\n\n\n\nJetpack representatives were not able to confirm the limits of fair usage or how long the introductory period will last.\n\n\n\n“Launching without a limit on emails isn\u2019t the most financially responsible thing, but we\u2019re most excited to get this feature into the hands of people to get feedback,” Pugh said. “We\u2019re focused on the immediate roadmap to make the product better, although there will likely be a limit at some point in the future if we see extreme use from people on free plans.”\n\n\n\nHe said the Jetpack team goes out of its way to make pricing changes as fairly as possible “and we don\u2019t want to pull the rug out from anyone, so we\u2019ll certainly consider how people are impacted before making changes.”\u00a0 \n\n\n\nUntil the limited subscriber import issue has been solved, any pricing changes down the road are only likely to affect newsletters that are just starting out getting people signed up. Apart from this limitation, Jetpack Newsletter is making a competitive debut in the market. For those who are already using Jetpack and have an existing subscriber base, it makes it nearly effortless to add paid subscriptions. Using the block editor is far easier than most newsletter campaign editors out there, and Jetpack streamlines the sending process so creators don’t have to copy and paste between email services.", "date_published": "2023-08-01T18:24:35-04:00", "date_modified": "2023-08-01T18:24:37-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2020/09/jetpack-logo.png", "tags": [ "newsletter", "News", "Plugins" ] }, { "id": "https://wptavern.com/?p=146708", "url": "https://wptavern.com/malcare-blogvault-and-wpremote-plugins-patch-vulnerabilities-allowing-site-takeover-through-stolen-api-credentials", "title": "MalCare, Blogvault, and WPRemote Plugins Patch Vulnerabilities Allowing Site Takeover Through Stolen API Credentials", "content_html": "\n\u00a0Snicco, a WordPress security services provider, has published an advisory on a vulnerability in the MalCare plugin, which is active on more than 300,000 sites.
\n\n\n\n“MalCare uses broken cryptography to authenticate API requests from its remote servers to connected WordPress sites,” WordPress security researcher Calvin Alkan said.
\n\n\n\n“Requests are authentication by\u00a0comparing a shared secret stored as plaintext in the WordPress database\u00a0to the one provided by MalCare\u2019s remote application.
\n\n\n\n“This can\u00a0allow attackers to completely take over the site\u00a0because they can impersonate MalCare\u2019s remote application and perform any implemented action.”
\n\n\n\nThese potential malicious actions include creating rogue admin users, uploading random files to the site, and installing and removing plugins.
\n\n\n\nExploitation requires a pre-condition to be met, such as a site with a SQL injection vulnerability in a plugin, theme, or WordPress core, or a database compromised at the hosting level, or subject to another vulnerability that allows the attacker to read or update WordPress options.
\n\n\n\n“MalCare has received the full details of this vulnerability\u00a0three months before this public release, and despite us offering (free) help,\u00a0they subtly dismissed\u00a0it\u00a0because ‘supposedly’ this is the industry standard for API authentication,” Alkan said.
“Furthermore, concerns were raised, because the vulnerability requires a pre-condition that on its own, would be a vulnerability.”
Two days after Snicco published the security advisory with the proof of concept, MalCare pushed a patch in version 5.16 on July 8, 2023, along with a notice on the plugin’s blog:
\n\n\n\n\n\n\n\n\nIn the rare situation, where a site has a pre-existing, high severity SQL injection vulnerability, an attacker might be able to read the MalCare key. To address such issues, we are further strengthening our authentication systems.
\n\n\n\nAuthentication is a critical system and any improvements must be done in a careful manner. We have reviewed various plugins and best practices in our ecosystem to come up with our solution.
\n\n\n\nIn light of the current public discourse, we are expediting the update of our plugin. We will initiate a rollout by EOD.
\n
MalCare reports that its users have seen no evidence of the vulnerability being exploited.
\n\n\n\nSnicco noted that the same vulnerability also exists in WPRemote (20k installs) and Blogvault (100k installs) plugins, as they share the same code. Users of either of these plugins or the MalCare plugin should update to the latest versions as soon as possible now that the vulnerability advisory and proof of concept have been published.
\n", "content_text": "\u00a0Snicco, a WordPress security services provider, has published an advisory on a vulnerability in the MalCare plugin, which is active on more than 300,000 sites. \n\n\n\n“MalCare uses broken cryptography to authenticate API requests from its remote servers to connected WordPress sites,” WordPress security researcher Calvin Alkan said.\n\n\n\n“Requests are authentication by\u00a0comparing a shared secret stored as plaintext in the WordPress database\u00a0to the one provided by MalCare\u2019s remote application.\n\n\n\n“This can\u00a0allow attackers to completely take over the site\u00a0because they can impersonate MalCare\u2019s remote application and perform any implemented action.” \n\n\n\nThese potential malicious actions include creating rogue admin users, uploading random files to the site, and installing and removing plugins. \n\n\n\nExploitation requires a pre-condition to be met, such as a site with a SQL injection vulnerability in a plugin, theme, or WordPress core, or a database compromised at the hosting level, or subject to another vulnerability that allows the attacker to read or update WordPress options.\n\n\n\n“MalCare has received the full details of this vulnerability\u00a0three months before this public release, and despite us offering (free) help,\u00a0they subtly dismissed\u00a0it\u00a0because ‘supposedly’ this is the industry standard for API authentication,” Alkan said.“Furthermore, concerns were raised, because the vulnerability requires a pre-condition that on its own, would be a vulnerability.”\n\n\n\nTwo days after Snicco published the security advisory with the proof of concept, MalCare pushed a patch in version 5.16 on July 8, 2023, along with a notice on the plugin’s blog:\n\n\n\n\nIn the rare situation, where a site has a pre-existing, high severity SQL injection vulnerability, an attacker might be able to read the MalCare key. To address such issues, we are further strengthening our authentication systems.\n\n\n\nAuthentication is a critical system and any improvements must be done in a careful manner. We have reviewed various plugins and best practices in our ecosystem to come up with our solution.\n\n\n\nIn light of the current public discourse, we are expediting the update of our plugin. We will initiate a rollout by EOD.\n\n\n\n\nMalCare reports that its users have seen no evidence of the vulnerability being exploited.\n\n\n\nSnicco noted that the same vulnerability also exists in WPRemote (20k installs) and Blogvault (100k installs) plugins, as they share the same code. Users of either of these plugins or the MalCare plugin should update to the latest versions as soon as possible now that the vulnerability advisory and proof of concept have been published.", "date_published": "2023-07-10T23:28:31-04:00", "date_modified": "2023-07-10T23:28:33-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2021/10/keys.jpeg", "tags": [ "security", "News", "Plugins" ] }, { "id": "https://wptavern.com/?p=146444", "url": "https://wptavern.com/wordpress-plugin-review-team-adds-6-new-sponsored-volunteers-opens-applications", "title": "WordPress Plugin Review Team Adds 6 New Sponsored Volunteers, Opens Applications\u00a0", "content_html": "\nA new era has begun for WordPress.org’s Plugin Review Team. Mika Epstein, who has served for the past decade, is stepping down, but not before launching a new crew of volunteers.
\n\n\n\nThe team is responsible for approving newly submitted plugins, maintaining the Plugin Reviewer Handbook, as well as investigating any reported security issues and guideline violations.
\n\n\n\nHistorically, the Plugin Review team has had very little turnover, but a new crop of six sponsored volunteers will be contributing an estimated 50+ hours per week. The new members include David P\u00e9rez,\u00a0Evan Herman,\u00a0Francisco Torres,\u00a0Luke Carbis,\u00a0Marta Torre, and\u00a0Paco Marchante. Their efforts are already in demand as they work to tackle a large backlog of plugins.
\n\n\n\n“Given the nature of the work the team does, joining this team is a little different than some of the others: each new member will go through a vetting process by current team members before being selected,” Epstein said. “Some of the things the team is looking for are: a solid track record as a plugin developer; the ability to communicate clearly, kindly and constructively \u2013 both with other developers and users; interest in improving tools and processes; and excellent collaborative and conflict-management skills.”\u00a0
\n\n\n\nEpstein is encouraging more volunteers to apply, if they have at least five hours per week to devote to the team, as they could still use more help. Prospective team members can\u00a0submit an application, which will be evaluated by current team members. Applicants will be required to send examples of plugins they have coded to demonstrate their experience, provide references, and detail some of their contributions to the project.
\n", "content_text": "A new era has begun for WordPress.org’s Plugin Review Team. Mika Epstein, who has served for the past decade, is stepping down, but not before launching a new crew of volunteers.\n\n\n\nThe team is responsible for approving newly submitted plugins, maintaining the Plugin Reviewer Handbook, as well as investigating any reported security issues and guideline violations.\n\n\n\nHistorically, the Plugin Review team has had very little turnover, but a new crop of six sponsored volunteers will be contributing an estimated 50+ hours per week. The new members include David P\u00e9rez,\u00a0Evan Herman,\u00a0Francisco Torres,\u00a0Luke Carbis,\u00a0Marta Torre, and\u00a0Paco Marchante. Their efforts are already in demand as they work to tackle a large backlog of plugins. \n\n\n\n“Given the nature of the work the team does, joining this team is a little different than some of the others: each new member will go through a vetting process by current team members before being selected,” Epstein said. “Some of the things the team is looking for are: a solid track record as a plugin developer; the ability to communicate clearly, kindly and constructively \u2013 both with other developers and users; interest in improving tools and processes; and excellent collaborative and conflict-management skills.”\u00a0\n\n\n\nEpstein is encouraging more volunteers to apply, if they have at least five hours per week to devote to the team, as they could still use more help. Prospective team members can\u00a0submit an application, which will be evaluated by current team members. Applicants will be required to send examples of plugins they have coded to demonstrate their experience, provide references, and detail some of their contributions to the project.", "date_published": "2023-06-30T22:52:15-04:00", "date_modified": "2023-06-30T22:52:17-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2014/12/plugin.jpg", "tags": [ "plugin review", "News", "Plugins" ] }, { "id": "https://wptavern.com/?p=146380", "url": "https://wptavern.com/hackers-actively-exploiting-unpatched-privilege-escalation-vulnerability-in-ultimate-member-plugin", "title": "Hackers Actively Exploiting Unpatched Privilege Escalation Vulnerability in Ultimate Member Plugin", "content_html": "\nWPScan is reporting a hacking campaign actively exploiting an unpatched vulnerability in the Ultimate Member plugin, which allows unauthenticated attackers to create new user accounts with administrative privileges and take over the site. The vulnerability has been assigned a CVSSv3.1 (Common Vulnerability Scoring System) score of 9.8 (Critical).
\n\n\n\nAutomattic’s WP.cloud and Pressable.com hosting platforms picked up on a trend in compromised sites where each had rogue new administrators popping up. After further investigation they found a discussion on the WordPress.org support forums about a potential Privilege Escalation vulnerability in the plugin, as well as indications that it was already being actively exploited.
\n\n\n\nUltimate Member, which is active on more than 200,000 WordPress sites, patched the plugin, but WPScan reports that it wasn’t sufficient.
\n\n\n\n“In response to the vulnerability report, the creators of the plugin promptly released a new version, 2.6.4, intending to fix the problem,” WPScan security researcher Marc Montpas said. “However, upon investigating this update, we found numerous methods to circumvent the proposed patch, implying the issue is still fully exploitable.
\n\n\n\n“Adding to the urgency of the situation, a look at our monitoring systems also confirmed attacks using this vulnerability were indeed happening in the wild.”
\n\n\n\nWPScan has identified more than a dozen IP addresses from which exploits are originating, common usernames for malicious accounts, and other indicators of compromise, such as malicious plugins, themes, and code. Check the security advisory if you believe you have been compromised.
\n\n\n\nVersion 2.6.6 is the latest release from the Ultimate Member plugin but it is still believed to be vulnerable. WPScan recommends users disable the plugin until it has been adequately patched.
\n", "content_text": "WPScan is reporting a hacking campaign actively exploiting an unpatched vulnerability in the Ultimate Member plugin, which allows unauthenticated attackers to create new user accounts with administrative privileges and take over the site. The vulnerability has been assigned a CVSSv3.1 (Common Vulnerability Scoring System) score of 9.8 (Critical).\n\n\n\nAutomattic’s WP.cloud and Pressable.com hosting platforms picked up on a trend in compromised sites where each had rogue new administrators popping up. After further investigation they found a discussion on the WordPress.org support forums about a potential Privilege Escalation vulnerability in the plugin, as well as indications that it was already being actively exploited.\n\n\n\nUltimate Member, which is active on more than 200,000 WordPress sites, patched the plugin, but WPScan reports that it wasn’t sufficient.\n\n\n\n“In response to the vulnerability report, the creators of the plugin promptly released a new version, 2.6.4, intending to fix the problem,” WPScan security researcher Marc Montpas said. “However, upon investigating this update, we found numerous methods to circumvent the proposed patch, implying the issue is still fully exploitable.\n\n\n\n“Adding to the urgency of the situation, a look at our monitoring systems also confirmed attacks using this vulnerability were indeed happening in the wild.”\n\n\n\nWPScan has identified more than a dozen IP addresses from which exploits are originating, common usernames for malicious accounts, and other indicators of compromise, such as malicious plugins, themes, and code. Check the security advisory if you believe you have been compromised.\n\n\n\nVersion 2.6.6 is the latest release from the Ultimate Member plugin but it is still believed to be vulnerable. WPScan recommends users disable the plugin until it has been adequately patched.", "date_published": "2023-06-29T21:35:52-04:00", "date_modified": "2023-06-29T21:35:54-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2023/06/cHJpdmF0ZS9zdGF0aWMvaW1hZ2Uvd2Vic2l0ZS8yMDIyLTA0L2xyL2ZyY2FzdGxlX3JhaWxpbmdfbG92ZV82NTI3NzEtaW1hZ2Uta3liZTJkMTQuanBn.jpg", "tags": [ "security", "News", "Plugins" ] }, { "id": "https://wptavern.com/?p=146129", "url": "https://wptavern.com/really-simple-ssl-plugin-adds-free-vulnerability-detection", "title": "Really Simple SSL Plugin Adds Free Vulnerability Detection", "content_html": "\nReally Simple SSL, a popular plugin used on more than five million sites for installing SSL certificates, handling website migrations, mixed content, redirects, and security headers, has added a new feature in its most recent major update.
\n\n\n\nVersion 7.0.0 introduces vulnerability detection as part of a partnership with WP Vulnerability, an open source, free API created by Javier Casares with contributions from other open source, freely available databases. Once enabled, it notifies users if a vulnerability is found and suggests actions.
\n\n\n\n“Really Simple SSL mirrors the free database with its own instance to secure stability and deliverability, but of course provides the origin database with an API to enrich, or improve its current data,” Really Simple Plugins developer Aert Hulsebos said.
\n\n\n\nThe new vulnerability detection feature is not enabled by default, so users will need to enable it in the settings. A modal will pop up where users can configure their notifications and run the first scan.
\n\n\n\nWhen emailed about a vulnerability users can manually respond with an action or set the plugin to automatically force an update (when available) after 24 hours of no response. There are other automated actions the plugin can take based on how users configure the Measures section of the settings.
\n\n\n\nFor the past several years Really Simple SSL has been providing SSL certificate configuration and installation via Let’s Encrypt as a first pass at securing WordPress sites. To finance this for the free users, the plugin also has a Pro version that handles Security Headers, such as Content Security Policies, which are highly complex for most and not easily configured.
\n\n\n\n“We figured that with our reach we could impact security on the web as a whole, by adding features in order of impact on security,” Hulsebos said. “So vulnerabilities, after hardening features specific to WordPress, was next.\u00a0
\n\n\n\n“The nature of our partnership with Javier and WP Vulnerability is sponsoring the efforts of WP Vulnerability and appointing a security consultant ourselves to this open-source effort to improve, and moderate the open-source database daily. WP Vulnerability does not compensate us, nor does it have a stake in Really Simple SSL. Vulnerability detection is available for everyone and always will be.”
\n\n\n\nBecause Really Simple SSL started as a lightweight SSL plugin, Hulsebos said they have taken a modular approach to minimize impact on users who only want or need certain features. Following the launch of the new vulnerability detection feature, the plugin’s authors plan to add login security with 2FA to better secure authentication on WordPress sites.
\n", "content_text": "Really Simple SSL, a popular plugin used on more than five million sites for installing SSL certificates, handling website migrations, mixed content, redirects, and security headers, has added a new feature in its most recent major update.\n\n\n\nVersion 7.0.0 introduces vulnerability detection as part of a partnership with WP Vulnerability, an open source, free API created by Javier Casares with contributions from other open source, freely available databases. Once enabled, it notifies users if a vulnerability is found and suggests actions.\n\n\n\n“Really Simple SSL mirrors the free database with its own instance to secure stability and deliverability, but of course provides the origin database with an API to enrich, or improve its current data,” Really Simple Plugins developer Aert Hulsebos said.\n\n\n\nThe new vulnerability detection feature is not enabled by default, so users will need to enable it in the settings. A modal will pop up where users can configure their notifications and run the first scan.\n\n\n\n\n\n\n\nWhen emailed about a vulnerability users can manually respond with an action or set the plugin to automatically force an update (when available) after 24 hours of no response. There are other automated actions the plugin can take based on how users configure the Measures section of the settings.\n\n\n\n\n\n\n\nFor the past several years Really Simple SSL has been providing SSL certificate configuration and installation via Let’s Encrypt as a first pass at securing WordPress sites. To finance this for the free users, the plugin also has a Pro version that handles Security Headers, such as Content Security Policies, which are highly complex for most and not easily configured.\n\n\n\n“We figured that with our reach we could impact security on the web as a whole, by adding features in order of impact on security,” Hulsebos said. “So vulnerabilities, after hardening features specific to WordPress, was next.\u00a0\n\n\n\n“The nature of our partnership with Javier and WP Vulnerability is sponsoring the efforts of WP Vulnerability and appointing a security consultant ourselves to this open-source effort to improve, and moderate the open-source database daily. WP Vulnerability does not compensate us, nor does it have a stake in Really Simple SSL. Vulnerability detection is available for everyone and always will be.”\n\n\n\nBecause Really Simple SSL started as a lightweight SSL plugin, Hulsebos said they have taken a modular approach to minimize impact on users who only want or need certain features. Following the launch of the new vulnerability detection feature, the plugin’s authors plan to add login security with 2FA to better secure authentication on WordPress sites.", "date_published": "2023-06-23T17:34:02-04:00", "date_modified": "2023-06-23T17:34:03-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2023/06/Screen-Shot-2023-06-23-at-5.27.39-PM.png", "tags": [ "security", "ssl", "News", "Plugins" ] }, { "id": "https://wptavern.com/?p=145864", "url": "https://wptavern.com/woocommerce-stripe-gateway-plugin-patches-security-vulnerability-in-7-4-1", "title": "WooCommerce Stripe Gateway Plugin Patches\u00a0Security Vulnerability in 7.4.1", "content_html": "\nPatchstack is reporting an Insecure Direct Object References (IDOR) vulnerability in WooCommerce Stripe Gateway, the most popular WooCommerce Stripe payment plugin with more than 900,000 active users. It was discovered by Patchstack researcher Rafie Muhammad on April 17, 2023, and patched by WooCommerce on May 30, 2023, in version 7.4.1.
\n\n\n\nThe security advisory describes the vulnerability as follows:
\n\n\n\n\n\n\n\n\nThis vulnerability allows any unauthenticated user to view any WooCommnerce order\u2019s PII data including email, user\u2019s name, and full address.\u00a0The described vulnerability was fixed in version\u00a07.4.1\u00a0with some backported fixed version and assigned\u00a0CVE-2023-34000.
\n
It was assigned a high severity CVSS 3.1 score of 7.5 and added to the Patchstack database on June 13.
\n\n\n\nThe vulnerability affects versions 7.4.0 and below. Although the patch from WooCommerce has been available for two weeks, more than 55% of the plugin’s user base is running on versions older than 7.4 and it’s not clear how many 7.4.x users are on the latest version.
\n\n\n\nThe WooCommerce Stripe Gateway plugin’s changelog for version 7.4.1 includes two short notes and doesn’t elaborate on the severity of the security update:
\n\n\n\nPatchstack’s security advisory includes more technical details about underlying vulnerabilities fixed in this update. It is not yet known to have been exploited but store owners are encouraged to update to the latest 7.4.1 version as soon as possible.
\n", "content_text": "Patchstack is reporting an Insecure Direct Object References (IDOR) vulnerability in WooCommerce Stripe Gateway, the most popular WooCommerce Stripe payment plugin with more than 900,000 active users. It was discovered by Patchstack researcher Rafie Muhammad on April 17, 2023, and patched by WooCommerce on May 30, 2023, in version 7.4.1.\n\n\n\nThe security advisory describes the vulnerability as follows: \n\n\n\n\nThis vulnerability allows any unauthenticated user to view any WooCommnerce order\u2019s PII data including email, user\u2019s name, and full address.\u00a0The described vulnerability was fixed in version\u00a07.4.1\u00a0with some backported fixed version and assigned\u00a0CVE-2023-34000.\n\n\n\n\nIt was assigned a high severity CVSS 3.1 score of 7.5 and added to the Patchstack database on June 13. \n\n\n\nThe vulnerability affects versions 7.4.0 and below. Although the patch from WooCommerce has been available for two weeks, more than 55% of the plugin’s user base is running on versions older than 7.4 and it’s not clear how many 7.4.x users are on the latest version.\n\n\n\n\n\n\n\nThe WooCommerce Stripe Gateway plugin’s changelog for version 7.4.1 includes two short notes and doesn’t elaborate on the severity of the security update:\n\n\n\n\nFix \u2013 Add Order Key Validation.\n\n\n\nFix \u2013 Add sanitization and escaping some outputs.\n\n\n\n\nPatchstack’s security advisory includes more technical details about underlying vulnerabilities fixed in this update. It is not yet known to have been exploited but store owners are encouraged to update to the latest 7.4.1 version as soon as possible.", "date_published": "2023-06-14T14:08:08-04:00", "date_modified": "2023-06-14T14:08:10-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2023/02/Screen-Shot-2023-02-10-at-9.56.03-PM.png", "tags": [ "security", "News", "Plugins" ] }, { "id": "https://wptavern.com/?p=145792", "url": "https://wptavern.com/wordpress-org-enables-commercial-and-community-filters-on-plugin-and-theme-directories", "title": "WordPress.org Enables Commercial and Community Filters on Plugin and Theme Directories", "content_html": "\nDuring the 2022 State of the Word, Matt Mullenweg announced a plan to add new “Community” and “Commercial” taxonomies for the theme and plugin directories that would help users more quickly ascertain the purpose of the extensions they are considering. Shortly after the announcement, instructions were published for theme and plugin authors to opt into the new taxonomies.
\n\n\n\nThe new filters are now enabled on both the theme and plugin directories, giving users the ability to quickly sort between free community extensions and those with commercial upgrades. Anything with a “pro version” should be designated as Commercial. These usually come with some upsells for more features than are offered in the free version. So far, the number of themes identified as commercial vastly exceed the number of community themes.
\n\n\n\nIn the Plugin directory, extensions designated as free are nearly equal those designated as commercial. Many of the most widely used plugins have already been identified as commercial, including Yoast SEO, Jetpack, Akismet, Elementor, WooCommerce, All-in-One WP Migration, and more. Examples of community plugins include the WordPress Importer, Classic Editor, Classic Widgets, Gutenberg, Performance Lab, and Debug Bar.
\n\n\n\nIn both directories it appears only a small percentage of authors have designated their extensions using the commercial or community taxonomies. At this time, use of the taxonomies is not required. This gave rise to some questions in the comments of the announcement.
\n\n\n\n“Would a better classification system would be to just have either no label for the majority, and then something closer to ‘includes paid upgrades’ that just implies they also offer additional services on top of their free (and often fully functional) version?” WordPress developer Kevin Batdorf said.
\n\n\n\n“All plugins are\u00a0open source\u00a0regardless of whether they sell something, and that doesn\u2019t make those developers any less passionate about open-source. Nor does it imply non-commercial plugins have any less features, or that the level of dedication to support is any less dedicated.”
\n\n\n\nBatdorf also asked if use of the taxonomies would be a requirement in the future, because, at the moment, their low usage could give some plugins an advantage under these new classifications.
\n\n\n\n“Should it also be a requirement?” he said. “Otherwise this also seems like something to be gamed for visibility. Do Community or Commercial (or neither) plugins show higher install growth? I guarantee you people are tracking this already.”
\n\n\n\nWordPress’ Meta team is seeking feedback on the current implementation. Automattic-sponsored contributor Steve Dufresne said “work is continuously underway to improve the browsing experience and refine the visual aspects of the Theme and Plugin Directory as part of the site redesign.” The new filters will be incorporated into the upcoming redesign changes that have been slowly rolling out across WordPress.org.
\n\n\n\nThese filters will also be making their way into the admin theme and plugin browsers, so users can access them from wherever they search for extensions. In the meantime, users and theme and plugin developers can leave feedback via Meta Trac on the specific tickets outlined in the announcement, as the team continues to iterate on the project.
\n", "content_text": "During the 2022 State of the Word, Matt Mullenweg announced a plan to add new “Community” and “Commercial” taxonomies for the theme and plugin directories that would help users more quickly ascertain the purpose of the extensions they are considering. Shortly after the announcement, instructions were published for theme and plugin authors to opt into the new taxonomies. \n\n\n\nThe new filters are now enabled on both the theme and plugin directories, giving users the ability to quickly sort between free community extensions and those with commercial upgrades. Anything with a “pro version” should be designated as Commercial. These usually come with some upsells for more features than are offered in the free version. So far, the number of themes identified as commercial vastly exceed the number of community themes. \n\n\n\n\n\n\n\nIn the Plugin directory, extensions designated as free are nearly equal those designated as commercial. Many of the most widely used plugins have already been identified as commercial, including Yoast SEO, Jetpack, Akismet, Elementor, WooCommerce, All-in-One WP Migration, and more. Examples of community plugins include the WordPress Importer, Classic Editor, Classic Widgets, Gutenberg, Performance Lab, and Debug Bar.\n\n\n\n\n\n\n\nIn both directories it appears only a small percentage of authors have designated their extensions using the commercial or community taxonomies. At this time, use of the taxonomies is not required. This gave rise to some questions in the comments of the announcement.\n\n\n\n“Would a better classification system would be to just have either no label for the majority, and then something closer to ‘includes paid upgrades’ that just implies they also offer additional services on top of their free (and often fully functional) version?” WordPress developer Kevin Batdorf said.\n\n\n\n“All plugins are\u00a0open source\u00a0regardless of whether they sell something, and that doesn\u2019t make those developers any less passionate about open-source. Nor does it imply non-commercial plugins have any less features, or that the level of dedication to support is any less dedicated.”\n\n\n\nBatdorf also asked if use of the taxonomies would be a requirement in the future, because, at the moment, their low usage could give some plugins an advantage under these new classifications.\n\n\n\n“Should it also be a requirement?” he said. “Otherwise this also seems like something to be gamed for visibility. Do Community or Commercial (or neither) plugins show higher install growth? I guarantee you people are tracking this already.”\n\n\n\nWordPress’ Meta team is seeking feedback on the current implementation. Automattic-sponsored contributor Steve Dufresne said “work is continuously underway to improve the browsing experience and refine the visual aspects of the Theme and Plugin Directory as part of the site redesign.” The new filters will be incorporated into the upcoming redesign changes that have been slowly rolling out across WordPress.org.\n\n\n\nThese filters will also be making their way into the admin theme and plugin browsers, so users can access them from wherever they search for extensions. In the meantime, users and theme and plugin developers can leave feedback via Meta Trac on the specific tickets outlined in the announcement, as the team continues to iterate on the project.", "date_published": "2023-06-13T00:11:36-04:00", "date_modified": "2023-06-13T00:11:38-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2023/06/Screen-Shot-2023-06-12-at-11.25.04-PM.png", "tags": [ "News", "Plugins", "Themes" ] }, { "id": "https://wptavern.com/?p=145418", "url": "https://wptavern.com/mariadb-health-checks-plugin-now-available-on-wordpress-org", "title": "MariaDB Health Checks Plugin Now Available on WordPress.org", "content_html": "\nA new MariaDB Health Checks plugin is now available on WordPress.org, thanks to the efforts of contributors involved in the 2023 CloudFest Hackathon which took place in Germany. MariaDB is a popular open source database used by those looking to further scale their websites, as it is generally faster than MySQL with better support for a concurrent number of connections.
\n\n\n\n“At the moment it appears WordPress is dominating the PHP world, so this seemed to be the perfect target,” MariaDB Foundation Chief Contributions Officer Andrew Hutchings said about creating the plugin at the hackathon.
\n\n\n\n“The MariaDB Foundation loves WordPress (I\u2019m writing this post in WordPress right now) so it seemed like a logical project.”
\n\n\n\nThe plugin helps users debug their MariaDB databases by displaying important information, such as logs, locale, connections, character set and collation, and options. It also shows a graph of the number of queries and the execution time over the last 24 hours.
\n\n\n\nThe plugin also integrates with WordPress’ Site Health feature with two checks: an end-of-life check and a check for whether Histograms have been run. Histograms are an optimizer that can help improve MariaDB performance, and the plugin enables calculation of histograms to run on WordPress tables with the click of a button under the plugin’s Tools menu.
\n\n\n\n“There are a few features now and it is a good framework to add more features to in future,” Hutchings said. “This is a community project and is open to suggestions and pull requests. This is a project that we at the MariaDB Foundation want to support in the future.”
\n\n\n\nMariaDB Health Checks is developed on GitHub where developers can follow the plugin’s progress, contribute to new features, and report bugs.
\n", "content_text": "A new MariaDB Health Checks plugin is now available on WordPress.org, thanks to the efforts of contributors involved in the 2023 CloudFest Hackathon which took place in Germany. MariaDB is a popular open source database used by those looking to further scale their websites, as it is generally faster than MySQL with better support for a concurrent number of connections. \n\n\n\n“At the moment it appears WordPress is dominating the PHP world, so this seemed to be the perfect target,” MariaDB Foundation Chief Contributions Officer Andrew Hutchings said about creating the plugin at the hackathon.\n\n\n\n “The MariaDB Foundation loves WordPress (I\u2019m writing this post in WordPress right now) so it seemed like a logical project.”\n\n\n\nThe plugin helps users debug their MariaDB databases by displaying important information, such as logs, locale, connections, character set and collation, and options. It also shows a graph of the number of queries and the execution time over the last 24 hours.\n\n\n\n\n\n\n\nThe plugin also integrates with WordPress’ Site Health feature with two checks: an end-of-life check and a check for whether Histograms have been run. Histograms are an optimizer that can help improve MariaDB performance, and the plugin enables calculation of histograms to run on WordPress tables with the click of a button under the plugin’s Tools menu.\n\n\n\n\n\n\n\n“There are a few features now and it is a good framework to add more features to in future,” Hutchings said. “This is a community project and is open to suggestions and pull requests. This is a project that we at the MariaDB Foundation want to support in the future.”\n\n\n\nMariaDB Health Checks is developed on GitHub where developers can follow the plugin’s progress, contribute to new features, and report bugs.", "date_published": "2023-05-24T17:14:56-04:00", "date_modified": "2023-05-24T17:14:57-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2023/05/mariadb-wapuu.png", "tags": [ "mariadb", "News", "Plugins" ] }, { "id": "https://wptavern.com/?p=145031", "url": "https://wptavern.com/acf-plugins-reflected-xss-vulnerability-attracts-exploit-attempts-within-24-hours-of-public-announcement", "title": "ACF Plugin\u2019s Reflected XSS Vulnerability Attracts Exploit Attempts Within 24 Hours of Public Announcement", "content_html": "\nOn May 5, Patchstack published a security advisory about a high severity reflected cross-site scripting (XSS) vulnerability in ACF (Advanced Custom Fields), potentially affecting more than 4.5 million users. WP Engine patched the vulnerability on May 4, but the Akamai Security Intelligence Group (SIG)\u00a0 is reporting that attackers began attempting to exploit it within 24 hours of Patchstack’s publication.
\n\n\n\n“Once exploit vector details are publicly released, scanning and exploitation attempts rapidly increase,” Akamai\u00a0Principal Security Researcher Ryan Barnett said. “It is common for security researchers, hobbyists, and companies searching for their risk profile to examine new vulnerabilities upon release. However, the volume is increasing, and the amount of time between release and said growth is drastically decreasing. The Akamai SIG analyzed XSS attack data and identified\u00a0attacks starting within 24 hours of the exploit PoC being made public.
\n\n\n\n“What is particularly interesting about this is the query itself:\u00a0The threat actor copied and used the Patchstack sample code from the write-up.“
\n\n\n\nPatchstack’s security advisory includes a breakdown of the vulnerability, sample payload, and details of the patch.
\n\n\n\nAlthough the vulnerability, assigned\u00a0CVE-2023-30777, was promptly patched, and WP Engine alerted its users the same day, site owners have been slow to update to the latest, patched version of the plugin (6.1.6). Only 31.5% of the plugin’s user base are running version 6.1+, leaving a significant portion still vulnerable unless they are protected by additional security measures like virtual patches.
\n\n\n\n“Exploitation of this leads to a reflected XSS attack in which a threat actor can inject malicious scripts, redirects, ads, and other forms of URL manipulation into a victim site,” Barnett said. “This would, in turn, push those illegitimate scripts to visitors of that affected site. This manipulation is essentially blind to the site owner, making these threats even more dangerous.”
\n\n\n\nBarnett noted that attackers using the sample code from Patchstack indicates these are not sophisticated attempts, but the comprehensive security advisory makes vulnerable sites easy to target.
\n\n\n\n“This highlights that the response time for attackers is rapidly decreasing, increasing the need for vigorous and prompt patch management,” Barnett said.
\n", "content_text": "On May 5, Patchstack published a security advisory about a high severity reflected cross-site scripting (XSS) vulnerability in ACF (Advanced Custom Fields), potentially affecting more than 4.5 million users. WP Engine patched the vulnerability on May 4, but the Akamai Security Intelligence Group (SIG)\u00a0 is reporting that attackers began attempting to exploit it within 24 hours of Patchstack’s publication.\n\n\n\n“Once exploit vector details are publicly released, scanning and exploitation attempts rapidly increase,” Akamai\u00a0Principal Security Researcher Ryan Barnett said. “It is common for security researchers, hobbyists, and companies searching for their risk profile to examine new vulnerabilities upon release. However, the volume is increasing, and the amount of time between release and said growth is drastically decreasing. The Akamai SIG analyzed XSS attack data and identified\u00a0attacks starting within 24 hours of the exploit PoC being made public.\n\n\n\n“What is particularly interesting about this is the query itself:\u00a0The threat actor copied and used the Patchstack sample code from the write-up.“\n\n\n\nPatchstack’s security advisory includes a breakdown of the vulnerability, sample payload, and details of the patch. \n\n\n\nAlthough the vulnerability, assigned\u00a0CVE-2023-30777, was promptly patched, and WP Engine alerted its users the same day, site owners have been slow to update to the latest, patched version of the plugin (6.1.6). Only 31.5% of the plugin’s user base are running version 6.1+, leaving a significant portion still vulnerable unless they are protected by additional security measures like virtual patches.\n\n\n\n\n\n\n\n“Exploitation of this leads to a reflected XSS attack in which a threat actor can inject malicious scripts, redirects, ads, and other forms of URL manipulation into a victim site,” Barnett said. “This would, in turn, push those illegitimate scripts to visitors of that affected site. This manipulation is essentially blind to the site owner, making these threats even more dangerous.”\n\n\n\nBarnett noted that attackers using the sample code from Patchstack indicates these are not sophisticated attempts, but the comprehensive security advisory makes vulnerable sites easy to target.\n\n\n\n“This highlights that the response time for attackers is rapidly decreasing, increasing the need for vigorous and prompt patch management,” Barnett said.", "date_published": "2023-05-15T22:40:13-04:00", "date_modified": "2023-05-15T22:40:15-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2022/04/ACF-logo.jpg", "tags": [ "acf", "News", "Plugins" ] }, { "id": "https://wptavern.com/?p=144955", "url": "https://wptavern.com/acf-launches-new-annual-survey", "title": "ACF Launches New Annual Survey", "content_html": "\nWP Engine has launched an annual survey for Advanced Custom Fields (ACF), one of the plugins it acquired from Delicious Brains in 2022. ACF reports more than 4.5 million active users, including PRO site installs, and WP Engine Product Manager Iain Poulson reports that the plugin is “growing in every way since the acquisition.” ACF has added more users, features, and releases, along with community building efforts like bi-weekly office hours.
\n\n\n\nThis is the first time ACF has surveyed its user base about how they are building sites with WordPress and what can be improved. The survey starts with questions about the contexts in which professionals are using ACF and the volume and types of sites they are building. Respondents are asked about how they edit their sites, the type of license they are using, how often the reach for ACF in their toolbox, and which ACF features they use most often (i.e. REST API, ACF Blocks, Options pages, ACF Forms, Post Types Registration, etc.).
\n\n\n\nThe survey is on the lengthier side with an estimated 15 minutes to complete. As ACF is a critical and indispensable part of many WordPress developers’ workflow, helping to shape its future development may be worth the time. WP Engine has also added a few questions that may only be tangentially related to ACF, such as where users are hosting their WordPress sites and what they use for local development.
\n\n\n\n“It’s our primary method for gathering insights and feedback from the WP community on what they would like to see in ACF,” WP Engine Product Marketing Manager Rob Stinson said. He also related the importance of previous customer feedback that helped ACF’s team plan and implement features like registering CPTs and Taxonomies (v6.1).
\n\n\n\n“In the near term, we\u2019re working on bringing a UI to register Options Pages which is a PRO plugin feature, some long requested features like bi-directional relationship fields and improvements to conditional logic rules for taxonomy fields,” Poulson said. “We will also be focussing a release on more ACF Blocks features and improvements. The survey won\u2019t likely change those planned features, and the initial results are validating our planned work on ACF Blocks.”
\n\n\n\nThe survey ends May 19, 2023, and WP Engine plans to publish an aggregated and anonymized version of the results soon after the data is collected.
\n", "content_text": "WP Engine has launched an annual survey for Advanced Custom Fields (ACF), one of the plugins it acquired from Delicious Brains in 2022. ACF reports more than 4.5 million active users, including PRO site installs, and WP Engine Product Manager Iain Poulson reports that the plugin is “growing in every way since the acquisition.” ACF has added more users, features, and releases, along with community building efforts like bi-weekly office hours.\n\n\n\nThis is the first time ACF has surveyed its user base about how they are building sites with WordPress and what can be improved. The survey starts with questions about the contexts in which professionals are using ACF and the volume and types of sites they are building. Respondents are asked about how they edit their sites, the type of license they are using, how often the reach for ACF in their toolbox, and which ACF features they use most often (i.e. REST API, ACF Blocks, Options pages, ACF Forms, Post Types Registration, etc.).\n\n\n\nThe survey is on the lengthier side with an estimated 15 minutes to complete. As ACF is a critical and indispensable part of many WordPress developers’ workflow, helping to shape its future development may be worth the time. WP Engine has also added a few questions that may only be tangentially related to ACF, such as where users are hosting their WordPress sites and what they use for local development. \n\n\n\n“It’s our primary method for gathering insights and feedback from the WP community on what they would like to see in ACF,” WP Engine Product Marketing Manager Rob Stinson said. He also related the importance of previous customer feedback that helped ACF’s team plan and implement features like registering CPTs and Taxonomies (v6.1).\n\n\n\n“In the near term, we\u2019re working on bringing a UI to register Options Pages which is a PRO plugin feature, some long requested features like bi-directional relationship fields and improvements to conditional logic rules for taxonomy fields,” Poulson said. “We will also be focussing a release on more ACF Blocks features and improvements. The survey won\u2019t likely change those planned features, and the initial results are validating our planned work on ACF Blocks.”\n\n\n\nThe survey ends May 19, 2023, and WP Engine plans to publish an aggregated and anonymized version of the results soon after the data is collected.", "date_published": "2023-05-12T16:38:12-04:00", "date_modified": "2023-05-12T16:38:13-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2023/05/image-1.png", "tags": [ "acf", "News", "Plugins" ] }, { "id": "https://wptavern.com/?p=144929", "url": "https://wptavern.com/essential-addons-for-elementor-patches-critical-privilege-escalation-vulnerability", "title": "Essential Addons for Elementor Patches Critical Privilege Escalation Vulnerability", "content_html": "\nEssential Addons for Elementor, a plugin with more than a million active installs, has patched an unauthenticated privilege escalation vulnerability\u00a0in version 5.7.2. The vulnerability was discovered on May 8, 2023, and reported by Patchstack researcher Rafie Muhammad. It was given a 9.8 (Critical severity) CVSS 3.1 score and is not yet known to have been exploited.
\n\n\n\nMuhammad outlined the vulnerability in a security advisory published today:
\n\n\n\n\n\n\n\n\nThis plugin suffers from an unauthenticated privilege escalation vulnerability and allows any unauthenticated user to escalate their privilege to that of any user on the WordPress site.
\n\n\n\nIt is possible to reset the password of any user as long as we know their username thus being able to reset the password of the administrator and login on their account. This vulnerability occurs because this password reset function does not validate a password reset key and instead directly changes the password of the given user.
\n
The plugin’s authors published the patch today, on May 11, with the following note in the changelog:
\n\n\n\n5.7.2 \u2013 11/05/2023
Improved: EA Login/Register Form for Security Enhancement
Few minor bug fixes & improvements
The vulnerability affects sites using versions 5.4.0\u00a0to\u00a05.7.1 of Essential Addons for Elementor. Users are advised to update to the latest version 5.7.2 immediately now that Patchstack has published the proof of concept for exploiting it.
\n", "content_text": "Essential Addons for Elementor, a plugin with more than a million active installs, has patched an unauthenticated privilege escalation vulnerability\u00a0in version 5.7.2. The vulnerability was discovered on May 8, 2023, and reported by Patchstack researcher Rafie Muhammad. It was given a 9.8 (Critical severity) CVSS 3.1 score and is not yet known to have been exploited.\n\n\n\nMuhammad outlined the vulnerability in a security advisory published today:\n\n\n\n\nThis plugin suffers from an unauthenticated privilege escalation vulnerability and allows any unauthenticated user to escalate their privilege to that of any user on the WordPress site.\n\n\n\nIt is possible to reset the password of any user as long as we know their username thus being able to reset the password of the administrator and login on their account. This vulnerability occurs because this password reset function does not validate a password reset key and instead directly changes the password of the given user. \n\n\n\n\nThe plugin’s authors published the patch today, on May 11, with the following note in the changelog:\n\n\n\n5.7.2 \u2013 11/05/2023Improved: EA Login/Register Form for Security EnhancementFew minor bug fixes & improvements\n\n\n\nThe vulnerability affects sites using versions 5.4.0\u00a0to\u00a05.7.1 of Essential Addons for Elementor. Users are advised to update to the latest version 5.7.2 immediately now that Patchstack has published the proof of concept for exploiting it.", "date_published": "2023-05-11T20:34:09-04:00", "date_modified": "2023-05-11T20:34:11-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2023/05/lock.jpeg", "tags": [ "security", "News", "Plugins" ] }, { "id": "https://wptavern.com/?p=144739", "url": "https://wptavern.com/advanced-custom-fields-plugin-patches-reflected-xss-vulnerability", "title": "Advanced Custom Fields Plugin Patches Reflected XSS Vulnerability", "content_html": "\nAdvanced Custom Fields (ACF) has patched a reflected XSS vulnerability that affects versions 6.1.5\u00a0and below of ACF and ACF Pro, potentially impacting more than 2+ million users. It was discovered by Patchstack researcher Rafie Muhammad in May 2, 2023, and patched by ACF developers in version 6.1.6 on May 4, 2023.
\n\n\n\nPatchstack published a security bulletin and Muhammad described the vulnerability as follows:
\n\n\n\n\n\n\n\n\nThis vulnerability allows any unauthenticated user to steal sensitive information for, in this case, privilege escalation on the WordPress site by tricking a privileged user to visit the crafted URL path.
\n
The vulnerability was given a high severity CVSS score of 3.1. Muhammad outlined a proof of concept in the security bulletin. At this time, the vulnerability is not known to have been exploited. ACF free and ACF Pro users should update to the latest 6.1.6 version of the plugin as soon as possible.
\n", "content_text": "Advanced Custom Fields (ACF) has patched a reflected XSS vulnerability that affects versions 6.1.5\u00a0and below of ACF and ACF Pro, potentially impacting more than 2+ million users. It was discovered by Patchstack researcher Rafie Muhammad in May 2, 2023, and patched by ACF developers in version 6.1.6 on May 4, 2023.\n\n\n\nPatchstack published a security bulletin and Muhammad described the vulnerability as follows:\n\n\n\n\nThis vulnerability allows any unauthenticated user to steal sensitive information for, in this case, privilege escalation on the WordPress site by tricking a privileged user to visit the crafted URL path. \n\n\n\n\nThe vulnerability was given a high severity CVSS score of 3.1. Muhammad outlined a proof of concept in the security bulletin. At this time, the vulnerability is not known to have been exploited. ACF free and ACF Pro users should update to the latest 6.1.6 version of the plugin as soon as possible.", "date_published": "2023-05-05T23:51:23-04:00", "date_modified": "2023-05-10T08:36:54-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2022/04/ACF-logo.jpg", "tags": [ "security", "News", "Plugins" ] }, { "id": "https://wptavern.com/?p=144183", "url": "https://wptavern.com/periodic-table-of-wordpress-plugins-showcases-108-most-popular-plugins", "title": "Periodic Table of WordPress Plugins Showcases 108 Most Popular Plugins", "content_html": "\nWordPress core committer Pascal Birchler has published a Periodic Table of WordPress Plugins to celebrate the software’s upcoming 20th anniversary. The table showcases 108 of the most popular free plugins on WordPress.org.
\n\n\n\nTen years ago Birchler created a website that showed the most popular plugins in a similar table layout, ranking them by number of active installations. This chart has been updated and is now available at plugintable.com.
\n\n\n\n“Today, I am actually ‘re-introducing’ this project, complete with a modernized look and feel, more curation, and more useful information than before,” Birchler said.
\n\n\n\nThe website is interactive, so cards can be expanded to see more information about each plugin, including the author, install count, star rating, and the date it was first published.
\n\n\n\nApproximately 57% of the plugins included have 1 million or more installs, so it gives you a chance to see all of the most successful WordPress.org extensions at a glance. 600k is the lowest number of active installs for plugins included in the chart.
\n\n\n\nAfter making the chart, Birchler noted that he was impressed by the stats for the Really Simple SSL plugin, which has more than 5 million active installs and a 5/5-star rating. He also highlighted Site Kit by Google as being the youngest “element” first released in October 2019, with 3+ million active installs in just over three years in the directory. The XML Sitemaps Generator plugin is the oldest among those included, released in 2005 just before Akismet.
\n\n\n\n“Another plugin that has caught my eye is WP Multibyte Patch by @eastcoder, which offers improvements for Japanese sites,” Birchler said. “With over 1+ million installs it makes me wonder why WordPress core itself doesn’t have better support for multibyte characters.”
\n\n\n\nIf you like the Period Table of WordPress Plugins and want to see it hanging on your wall, Birchler has set up a Shopify-powered store where you can purchase a high-quality print version. The poster comes in light and dark modes and is also available framed. He plans to donate the proceeds of the store to the WordPress community.
\n", "content_text": "WordPress core committer Pascal Birchler has published a Periodic Table of WordPress Plugins to celebrate the software’s upcoming 20th anniversary. The table showcases 108 of the most popular free plugins on WordPress.org.\n\n\n\nTen years ago Birchler created a website that showed the most popular plugins in a similar table layout, ranking them by number of active installations. This chart has been updated and is now available at plugintable.com.\n\n\n\n“Today, I am actually ‘re-introducing’ this project, complete with a modernized look and feel, more curation, and more useful information than before,” Birchler said.\n\n\n\n\n\n\n\nThe website is interactive, so cards can be expanded to see more information about each plugin, including the author, install count, star rating, and the date it was first published.\n\n\n\n\n\n\n\nApproximately 57% of the plugins included have 1 million or more installs, so it gives you a chance to see all of the most successful WordPress.org extensions at a glance. 600k is the lowest number of active installs for plugins included in the chart.\n\n\n\nAfter making the chart, Birchler noted that he was impressed by the stats for the Really Simple SSL plugin, which has more than 5 million active installs and a 5/5-star rating. He also highlighted Site Kit by Google as being the youngest “element” first released in October 2019, with 3+ million active installs in just over three years in the directory. The XML Sitemaps Generator plugin is the oldest among those included, released in 2005 just before Akismet. \n\n\n\n“Another plugin that has caught my eye is WP Multibyte Patch by @eastcoder, which offers improvements for Japanese sites,” Birchler said. “With over 1+ million installs it makes me wonder why WordPress core itself doesn’t have better support for multibyte characters.”\n\n\n\nIf you like the Period Table of WordPress Plugins and want to see it hanging on your wall, Birchler has set up a Shopify-powered store where you can purchase a high-quality print version. The poster comes in light and dark modes and is also available framed. He plans to donate the proceeds of the store to the WordPress community.", "date_published": "2023-04-28T23:51:50-04:00", "date_modified": "2023-04-28T23:51:51-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2023/04/screencapture-plugintable-2023-04-28-22_31_06-scaled.jpg", "tags": [ "News", "Plugins" ] }, { "id": "https://wptavern.com/?p=143887", "url": "https://wptavern.com/newly-rewritten-wordpress-sqlite-database-integration-plugin-needs-testing", "title": "Newly Rewritten WordPress SQLite Database Integration Plugin Needs Testing", "content_html": "\nWordPress contributors are making progress on officially supporting SQLite in core, a project that would benefit less complex sites (small to medium sites and blogs) that don\u2019t necessarily require WordPress\u2019 standard MySQL database. In a recent update, Yoast-sponsored core contributor Ari Stathopoulos said the SQLite Database Integration feature plugin has been rewritten, with the help of Automattic-sponsored core contributor Adam Zielinski, to be a more future-proof implementation.
\n\n\n\n“The code has been completely rewritten to use an SQL Lexer and is now stable and able to handle all WordPress queries properly,” Stathopoulos said. “The SQL Lexer is part of the\u00a0PHPMyAdmin/SQL-Parser\u00a0project (licensed under the\u00a0GPL\u00a02.0) and it was adapted for WordPress, effectively implementing a\u00a0MySQL to SQLite translation engine. This provides improved security, as well as compatibility.”
\n\n\n\nStathopoulos contends that the next step is to implement these changes in WordPress core “instead of using a plugin,” because in its current form it can only be tested on pre-existing websites that already have a MySQL database.
\n\n\n\n“Using the\u00a0featured\u00a0plugin is a great way to allow users to test the implementation and iron out any issues etc,” he said. “However, long-term, it doesn\u2019t make sense to use it as a plugin.”\u00a0
\n\n\n\nStathopoulos created a draft Pull Request\u00a0and an accompanying\u00a0Trac ticket proposing the new implementation be merged into core.
\n\n\n\nAlthough the effort has received positive feedback and support from the community and WordPress lead developer Matt Mullenweg, the feature plugin has only 30 active installs and the new implementation has received very little testing.
\n\n\n\nMultiple participants in the discussion, including core committer Aaron Jorbin and lead developer Andrew Ozz, expressed concerns about the proposal’s call for merging the changes to core as the next step.
\n\n\n\n“Talk of merging to\u00a0core\u00a0feels incredibly premature for a couple of reasons,” Jorbin said. “The\u00a0plugin\u00a0now only has around 30 installations. I think there needs to be much higher adoption in order to understand how the near-infinite number of plugins will work with this deep underlying change to WordPress.”
\n\n\n\nJorbin also referenced WordPress’ philosophy of building things for end users who don’t want to have to make decisions about the underlying tech but simply want things to work.
\n\n\n\n“Assuming that a user is going to understand different database engines and the potential tradeoffs feels far stretched to me,” Jorbin said. “Therefore, any implementation really needs to be rock solid and extremely thoroughly tested.”
\n\n\n\nJorbin also echoed concerns of other contributors in previous conversations, about SQLite’s bizarre religion-infused “code of ethics.”
\n\n\n\nOzz suggested the plugin could be added to WordPress as a mu-plugin or a “drop-in” similar to how caching add-ons are implemented, pushing back on the rigidity of the requirement to fully merge it into core.
\n\n\n\n“Both of these methods are also better/more suitable for the users as they can be done by the hosting company or the script used for WordPress installation,” Ozz said. “There are some other benefits like independent updates, etc.”
\n\n\n\nStathopoulos responded to these concerns, saying that he sees the merge to core as a long-term goal, although the proposal communicated more of an urgency that confused participants in the discussion.
\n\n\n\n“It is premature,” Stathopoulos admitted. “However, looking at the bigger picture, it is not premature to plan for the future and get ready for it.
\n\n\n\n“It may be premature now, but it won\u2019t be 2 years from now\u2026 The problem is that we won\u2019t be able to do it in the future unless we start working on it now.
SQLite is not something that can \u2013 or should \u2013 happen in Core now, or even a year from now. It\u2019s a long-term goal, and should be treated as such.”
Stathopoulos agreed that the plugin needs more adoption to see how it works with plugins across the ecosystem. He also responded to concerns about users not fully understanding the implications of the database engine they select on installation.
\n\n\n\n“The proof-of-concept\u00a0UI\u00a0I put in place in the Core PR is just that \u2013 a proof of concept,” Stathopoulos said. “Something to trigger discussion and allow us to find solutions. It can be anything, even installation scenarios (do you want to create a\u00a0blog? A small e-commerce site? A large news outlet? The next Amazon?) That is a discussion that will need to happen when the time is right to discuss UI, but it\u2019s is a bit too early for that, I don\u2019t think we\u2019re there yet.”
\n\n\n\nStathopoulos recommends contributors test the new implementation with all the plugins they normally use, via the SQLite Database Integration plugin or by testing the\u00a0draft pull request in WordPress Core.
\n", "content_text": "WordPress contributors are making progress on officially supporting SQLite in core, a project that would benefit less complex sites (small to medium sites and blogs) that don\u2019t necessarily require WordPress\u2019 standard MySQL database. In a recent update, Yoast-sponsored core contributor Ari Stathopoulos said the SQLite Database Integration feature plugin has been rewritten, with the help of Automattic-sponsored core contributor Adam Zielinski, to be a more future-proof implementation.\n\n\n\n“The code has been completely rewritten to use an SQL Lexer and is now stable and able to handle all WordPress queries properly,” Stathopoulos said. “The SQL Lexer is part of the\u00a0PHPMyAdmin/SQL-Parser\u00a0project (licensed under the\u00a0GPL\u00a02.0) and it was adapted for WordPress, effectively implementing a\u00a0MySQL to SQLite translation engine. This provides improved security, as well as compatibility.”\n\n\n\nStathopoulos contends that the next step is to implement these changes in WordPress core “instead of using a plugin,” because in its current form it can only be tested on pre-existing websites that already have a MySQL database.\n\n\n\n“Using the\u00a0featured\u00a0plugin is a great way to allow users to test the implementation and iron out any issues etc,” he said. “However, long-term, it doesn\u2019t make sense to use it as a plugin.”\u00a0\n\n\n\nStathopoulos created a draft Pull Request\u00a0and an accompanying\u00a0Trac ticket proposing the new implementation be merged into core.\n\n\n\nAlthough the effort has received positive feedback and support from the community and WordPress lead developer Matt Mullenweg, the feature plugin has only 30 active installs and the new implementation has received very little testing.\n\n\n\nMultiple participants in the discussion, including core committer Aaron Jorbin and lead developer Andrew Ozz, expressed concerns about the proposal’s call for merging the changes to core as the next step. \n\n\n\n“Talk of merging to\u00a0core\u00a0feels incredibly premature for a couple of reasons,” Jorbin said. “The\u00a0plugin\u00a0now only has around 30 installations. I think there needs to be much higher adoption in order to understand how the near-infinite number of plugins will work with this deep underlying change to WordPress.”\n\n\n\nJorbin also referenced WordPress’ philosophy of building things for end users who don’t want to have to make decisions about the underlying tech but simply want things to work.\n\n\n\n“Assuming that a user is going to understand different database engines and the potential tradeoffs feels far stretched to me,” Jorbin said. “Therefore, any implementation really needs to be rock solid and extremely thoroughly tested.”\n\n\n\nJorbin also echoed concerns of other contributors in previous conversations, about SQLite’s bizarre religion-infused “code of ethics.”\n\n\n\nOzz suggested the plugin could be added to WordPress as a mu-plugin or a “drop-in” similar to how caching add-ons are implemented, pushing back on the rigidity of the requirement to fully merge it into core.\n\n\n\n“Both of these methods are also better/more suitable for the users as they can be done by the hosting company or the script used for WordPress installation,” Ozz said. “There are some other benefits like independent updates, etc.”\n\n\n\nStathopoulos responded to these concerns, saying that he sees the merge to core as a long-term goal, although the proposal communicated more of an urgency that confused participants in the discussion.\n\n\n\n“It is premature,” Stathopoulos admitted. “However, looking at the bigger picture, it is not premature to plan for the future and get ready for it.\n\n\n\n“It may be premature now, but it won\u2019t be 2 years from now\u2026 The problem is that we won\u2019t be able to do it in the future unless we start working on it now.SQLite is not something that can \u2013 or should \u2013 happen in Core now, or even a year from now. It\u2019s a long-term goal, and should be treated as such.”\n\n\n\nStathopoulos agreed that the plugin needs more adoption to see how it works with plugins across the ecosystem. He also responded to concerns about users not fully understanding the implications of the database engine they select on installation.\n\n\n\n“The proof-of-concept\u00a0UI\u00a0I put in place in the Core PR is just that \u2013 a proof of concept,” Stathopoulos said. “Something to trigger discussion and allow us to find solutions. It can be anything, even installation scenarios (do you want to create a\u00a0blog? A small e-commerce site? A large news outlet? The next Amazon?) That is a discussion that will need to happen when the time is right to discuss UI, but it\u2019s is a bit too early for that, I don\u2019t think we\u2019re there yet.”\n\n\n\nStathopoulos recommends contributors test the new implementation with all the plugins they normally use, via the SQLite Database Integration plugin or by testing the\u00a0draft pull request in WordPress Core.", "date_published": "2023-04-21T17:37:28-04:00", "date_modified": "2023-04-21T17:37:29-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2022/07/track.jpg", "tags": [ "News", "Plugins" ] }, { "id": "https://wptavern.com/?p=143580", "url": "https://wptavern.com/yoast-seo-20-5-drops-support-for-php-5-6-7-0-and-7-1", "title": "Yoast SEO 20.5 Drops Support for PHP 5.6, 7.0, and 7.1", "content_html": "\nYoast SEO 20.5 was released this week with several security fixes and an improved Google SERP preview. The preview shows mobile and desktop snippets with Google’s current styling so users can see exactly how their snippets will look and tweak how they optimize them for Google Search results.
\n\n\n\nAnother highlight of this release is that Yoast SEO has dropped compatibility with PHP 5.6, 7.0 and 7.1. The plugin now requires PHP 7.2.5 or higher (along with WP 6.0). While this may seem extreme at first glance, approximately 89.9% of WordPress sites are running on PHP 7.2+. WordPress doesn’t cross-reference these stats with WP version numbers, but it’s possible sites running on much older versions of WordPress are also on unsupported versions of PHP.
\n\n\n\nGetting WordPress sites to update to the latest versions of PHP is a slow-moving process, but historically Yoast SEO has been a force for change in pushing users to upgrade their PHP versions. In version 4.5, released in 2017, Yoast SEO threw the weight of its estimated 6.5 million user base behind the movement to push hosts to upgrade their customers to PHP 7. That version of the plugin introduced a large, non-dismissible notice urging site administrators to upgrade to PHP 7.
\n\n\n\n\u201cTo move the web forward, we need to take a stand against old, slow, and unsafe software,” Yoast founder Joost de Valk said at that time. \u201cBecause web hosts are not upgrading PHP, we have decided to start pushing this from within plugins.” He contended that the WordPress ecosystem was losing good developers because the project was moving too slowly and also made the case for security and speed.
\n\n\n\nAlthough the latest version 20.5 will be incompatible with approximately 10% of WordPress sites running unsupported versions of PHP, this move forward is necessary for maintaining a healthy and secure ecosystem.
\n", "content_text": "Yoast SEO 20.5 was released this week with several security fixes and an improved Google SERP preview. The preview shows mobile and desktop snippets with Google’s current styling so users can see exactly how their snippets will look and tweak how they optimize them for Google Search results.\n\n\n\n\n\n\n\nAnother highlight of this release is that Yoast SEO has dropped compatibility with PHP 5.6, 7.0 and 7.1. The plugin now requires PHP 7.2.5 or higher (along with WP 6.0). While this may seem extreme at first glance, approximately 89.9% of WordPress sites are running on PHP 7.2+. WordPress doesn’t cross-reference these stats with WP version numbers, but it’s possible sites running on much older versions of WordPress are also on unsupported versions of PHP.\n\n\n\nWordPress PHP Version Stats – 4/11/2023\n\n\n\nGetting WordPress sites to update to the latest versions of PHP is a slow-moving process, but historically Yoast SEO has been a force for change in pushing users to upgrade their PHP versions. In version 4.5, released in 2017, Yoast SEO threw the weight of its estimated 6.5 million user base behind the movement to push hosts to upgrade their customers to PHP 7. That version of the plugin introduced a large, non-dismissible notice urging site administrators to upgrade to PHP 7.\n\n\n\n\u201cTo move the web forward, we need to take a stand against old, slow, and unsafe software,” Yoast founder Joost de Valk said at that time. \u201cBecause web hosts are not upgrading PHP, we have decided to start pushing this from within plugins.” He contended that the WordPress ecosystem was losing good developers because the project was moving too slowly and also made the case for security and speed.\n\n\n\nAlthough the latest version 20.5 will be incompatible with approximately 10% of WordPress sites running unsupported versions of PHP, this move forward is necessary for maintaining a healthy and secure ecosystem.", "date_published": "2023-04-12T20:54:23-04:00", "date_modified": "2023-04-12T20:54:25-04:00", "authors": [ { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" } ], "author": { "name": "Sarah Gooding", "url": "https://wptavern.com/author/sarah", "avatar": "https://secure.gravatar.com/avatar/d12f506a8f9afba443178608fc9e2232?s=512&d=retro&r=r" }, "image": "https://149611589.v2.pressablecdn.com/wp-content/uploads/2020/06/yoast-16x9-1.png", "tags": [ "php", "News", "Plugins" ] } ] }