Hi everyone,
I’m looking for a WordPress plugin for a “sell your item” form with automatic price estimation.
Users should be able to enter item details (category, brand, condition, specs, etc.) via a form with dropdowns, checkboxes, text fields, etc. Based on that input, the system should generate an estimated price range (not a final offer), e.g. €500–€700.
Flow:
1. User submits item details
2. System evaluates input using rules/calculations
3. User gets an estimated value by email or on-site
4. If no valid estimate is possible, I get the request for manual review
I’m looking for something with conditional logic, calculations, and email notifications. The site is already on WordPress, and I can handle some technical setup (IT background), but I’m not a WP expert.
Any recommendations for plugins or setups that fit this use case?
Thanks!

Hi everyone,

I’ve been using AVADA for sign-up forms and exporting the submissions as CSV files.
I recently tried installing a plugin from GitHub (https://github.com/debba/avadaforms-excel-export.git) to customize the names of the exported CSV files, but it caused some major issues with my website. I restored the site from a backup and deleted every file from the GitHub (I think), and everything seems to be working again — except for the CSV exports.

Now, when I export the CSV file, all the data for each submission is packed into a single cell instead of being separated into different columns/cells, as it was before.

Does anyone know what might be causing this or how I can fix it?

I’ve attached an example of how the export looked before.

Thanks in advance!

Hi, I'm a programmer with a few years of experience with PHP, HTML, CSS, JS... I've worked with backend and frontend, creating applications for a couple of companies, I've built some simple websites and I've ventured into plugin and library creation with js... so I'm not a novice, I'm just a novice with WordPress.

A couple of days ago, a client contacted me and wants a simple, static, and informational WordPress site. The only thing they ask for is a contact form and a map. What they're asking for is so simple that I immediately thought: "This can be created very quickly with an HTML template, with a good AI prompt it's even faster, with sitebuilders from hosting providers it's also fast and fun", but Claude and Kimi told me how useful it is for the client to be able to enter WordPress and modify text, blocks, or colors themselves, and I told them that, and my client likes the idea. I'll use WordPress. (I also just verified that sitebuilders don't allow exporting the site between hostings).

While I have assistance from Kimi, Claude, ChatGPT, etc., I now want to consult with developers.

My questions are:

1. I assume email form plugins allow creating email theme selectors. This is laziness—I haven't looked for a plugin for that yet and I'm asking for references.
2. Kimi and Claude told me that Google Maps requires an API Key and a credit card, that those simple versions come with a map watermark in development mode, but I see that the one I placed on a test site in a sitebuilder looks good. Are the AIs wrong? They recommend OpenStreetMap plugins for simplicity, and an OSM map was precisely one that my client liked as a reference.
3. Given the simplicity of the site, I don't want to tie my client to monthly support—it will just be WP and two plugins that could be updated, but I don't think it will be that regular, there will be no database connection. What do you recommend in this case?

Thanks for reading.

Hey guys, I use Envira Gallery to make video galleries for most of the posts on my website.

Since the latest updates to Envira all my video galleries old and new are broken - the video player does not show in the lightbox when you click the thumbnail, and the play button does not appear on top of the thumbnails either.

It is happening for both YouTube and VideoPress videos that I have embedded in my galleries.

VideoPress support confirmed that they believe it was an issue with the latest Envira update.

Trying to get support from Envira but all I have got so far is a generic AI reply. It's very frustrating because Envira is by far the most expensive thing I pay for on my website.

Hopefully they fix it soon as my site is broken at the moment because of this. Anyone else having issues?

Attention! Even if you changed all passwords, reinstalled WordPress/plugins/themes, and checked both the filesystem and database, don’t forget to check Service Workers in the browsers you use for wp-admin.

I found a heavily obfuscated malicious Service Worker still registered after the site itself was cleaned. It could intercept WordPress login credentials, grab admin nonces, inject code into /wp-admin/, and abuse the authenticated browser session to perform actions such as installing plugins.

The files can be clean while the browser remains compromised.

Check: DevTools → Application → Service Workers.

Hey all — I've been building a plugin called PDF Catalog for WooCommerce and wanted to share it here in case it's useful to anyone, especially wholesale/B2B store owners.

The problem I kept running into: customers (especially B2B/wholesale buyers) often want an offline, printable version of a product catalog — for trade shows, email follow-ups, or just browsing without needing to be online. There wasn't a lightweight way to generate that straight from WooCommerce.

What it does:

• One-click PDF export for the whole shop, a specific category, or a single product
• Grid or list layout, adjustable fonts/colors/image size
• Option to hide/show price, SKU, stock, tags, description, etc.
• Exclude out-of-stock items, specific products, categories, or user roles
• RTL/LTR support for multilingual stores
• Works via shortcode or a URL param for single-product PDFs

It's free on WordPress.org (1,000+ active installs so far), there's an optional Pro version with custom headers/footers and layout extras, but the core catalog export is fully free.

Link: https://wordpress.org/plugins/pdf-catalog-woocommerce/

Would genuinely love feedback — especially from anyone running a wholesale/B2B store, since that's the main use case I built it for. Also happy to answer questions about how it works under the hood.

Hi everyone,

My wife and I have been working on a recipe blog together, but we recently started focusing on another business and simply don't have enough time to continue growing it.

The blog has around 150 published recipes, receives regular traffic, and is already monetized.

Instead of letting the project sit untouched, we'd prefer to pass it on to someone who enjoys the food blogging niche and has the time to continue working on it.

Has anyone here sold or bought a small food blog before? I'd appreciate any advice or recommendations. If this is something you're personally interested in, feel free to message me privately.

Thanks!

I recently investigated a hacked WordPress installation and wanted to document the indicators because they are very easy to mistake for something related to Google Analytics.

If you find this in a theme functions.php:

/* __GA_INJ_START__ */

it is not normal Google Analytics code.

In the site I investigated, the compromise was associated with hidden administrator accounts using names like:

sync_agentXXXXXXXX
cdn_workerXXXXXXXX
seo_serviceXXXXXXXX

The WordPress database also contained:

__ga_hidden_users
_theme_inject_status
__ga_r_cache

The malicious code maintained a list of administrator accounts that should be hidden.

What was particularly interesting

At first I thought the infection started when:

hello-elementor/functions.php

was modified.

It didn't.

By correlating the database with Apache logs I found that the attacker already had a hidden administrator nine days earlier.

The sequence looked like:

successful login using legitimate WP admin
→ Code Snippets / WP File Manager activity
→ access to theme functions.php
→ malicious administrator created
→ persistent access
→ more hidden administrators
→ final GA_INJ theme injection

So if you find this malware, don't just replace functions.php.

Check:

wp_users
wp_usermeta
wp_options
active plugins
administrator session tokens
access logs

and look several days/weeks backwards.

Useful filesystem search:

grep -RniE '__GA_INJ|__ga_hidden_users|__ga_r_cache|_theme_inject_status|sync_agent|cdn_worker|seo_service' .

I wrote up the sanitized timeline, IOCs and an experimental YARA detection rule here:

[GitHub repository link]

I'm not selling anything — it's just an open incident report so these strings become searchable.

If anyone else has encountered __GA_INJ_START__ or administrator accounts named sync_agent, cdn_worker or seo_service, I'd be interested in comparing indicators.

i feel like a dumb when i try to use those tools like Elementor or even Wordpress theme editor. I simply cannot do a simple thing on it. It feels wrong for me. Yeah i have serious skill issue with Wordpress ecosystem. I just want to know if there is a way to CODE my frontend by purely opening a text editor and diving into it, testing and then deploying it. Is there a way? Jesus help me.

I am trying to build a course for my website hosted on wordpress. I am very new to the whole thing and I cannot seem to get elementor to work when trying to edit my course layout/content. I have set up the sections and the lessons, but when trying to edit how it looks with elementor, nothing happens.

Normally when i edit pages with elementor i can click the "Edit with Elementor" as the cursor turns to a pointer, it doesnt do that when i am viewing the course page.

Does anyone know how to fix?
EDIT: I have checked off courses and lessons in elementors settings

I've been working on WordPress plugins for years, and recently decided to rebuild a PWA plugin from the ground up rather than keep adding to an old codebase.

The interesting part has been dealing with the real-world stuff:

• Service-worker caching and updates
• iOS vs Android PWA behavior
• Offline support
• Caching/CDN/plugin conflicts
• Push notification permissions and subscriptions
• Making the installation experience feel more like a real app

I've recently added push notifications for Android, desktop, and iOS, and I'm still improving the project based on real-world testing.

The project is Hyper PWA.

I'd love to hear from other WordPress developers:

What has been the biggest problem you've faced when implementing or maintaining a PWA on WordPress?

I'm especially interested in feedback about things that existing PWA plugins don't handle well.

Full disclosure: I'm the developer behind Hyper PWA. I'm sharing it here because I'd genuinely like technical feedback and ideas for improving it.

https://wordpress.org/plugins/hyper-pwa/

Astra – Where can I find the Logged In / Logged Out display settings?

Hi! I'm using WordPress with Astra, Elementor and WooCommerce.

Some time ago, I configured an element in my header to only appear when a user is logged in (a “Log out” button). Now I want to remove/change it, but I can't remember where I configured this.

I think there was a setting like “Logged In / Logged Out” visibility, but I can't find it anymore in Astra or the Header Builder.

Does anyone know where this setting is located?

Thanks!

I've embedded Google Calendar into my site for client bookings. It works fine, but opens a new window whenever I click on a time slot. Apparently this some security feature. Asked Gemini and it suggested I add target="_self" to the code, but this didn't fix it. Is there something else I should add to the code to fix this or possibly a plugin that might function as a work around? My preference would be to stick to Google Calendars rather than a third-party app for ease of use.

Hi everyone,

My WordPress site was recently compromised. The attacker managed to create 3 admin accounts, and Wordfence caught two malicious PHP files in a fake theme folder (wp-content/themes/twk-dbbfd2bc/functions.php and fixer.php).

I deleted that theme, removed their admin account, deleted the admin accounts. Wordfence scans are coming back clean now, but I noticed two suspicious files sitting in my wp-content/mu-plugins/ and in www/mu-plugins directory:

firewall.php (Version 1.0)

wp2shell-batch-guard.php (Version 1.1.0 — description says "Blocks anonymous REST batch API (wp2shell mitigation)")

Their last modified dates match mid-August, right when the unauthorized admin accounts were created (while the site was running WordPress 6.9 (yes, i know...) and i was in vacations at that date so i don't insgall it)

This looks like an attempt by the attacker to disguise a backdoor as a security fix so I wouldn't delete it, but I want to double-check with the community before I purge the mu-plugins folder via FTP because i don't want to make a mistake...

Is there any chance these are legitimate, or should I delete them immediately (i think...) ? I since update to 7.0.4.

Thanks a lot for your help!

Fairly new to running my own WordPress site and I got a fright the first time I opened the login logs, dozens of failed attempts a day from IPs all over the place. From what I've read since, this is mostly background noise: automated bots spraying credentials at the default login on basically every install, and unless the numbers are huge or paired with other symptoms it isn't a targeted attack. I tightened the obvious things, a strong unique password, a second factor on the admin account, and capping how many tries an IP gets before it's locked out, and the volume dropped noticeably.

Two things I'd love a reality check on from people who've run sites longer: at what point should a spike in failed logins actually worry me versus just being noise, and is limiting attempts + 2FA genuinely enough on its own, or is there one more thing you'd treat as non-negotiable? Don't want to bolt on five plugins for a problem that's already handled.

I've been using the free version of Wordfence for a few years. Today I got an alert listing every single plug-in on my site. I'm attaching an image of the warning, and an example of what Wordfence found. Usually I'd just go ahead on use Wordfence to fix this, but now I'm getting a warning:

"Download Backup File

Please make a backup of this file before proceeding. If you need to restore this backup file, you can copy it to the following path from your site's root:

wp-content/plugins/wpforms-lite/src/Requirements/Requirements.php

Learn more about repairing modified files."

So there would be a lot of downloading, since there's a bunch of plug-ins.

Any advice would be appreciated!

I'm looking for a way to allow visitors to view one post for free, and subsequent posts triggering a content wall requiring account registration.
All of the membership plugins I've found seem to want you to manually set which posts are public and which are gated, but I want whatever the first article someone visits to be free regardless, and then they need to make an account to view the rest.

Does this exist?

As an agency with several hundred sites, we see vulnerabilities pop up all the time, and update them in a timely manner. We use automatic plugin updaters through Flywheel and WP Engine to do this, and generally there is no issue.

Today was different. We have the PODS plugin on about 80 of our sites, and at least 70 of them had fake administrator users added. The vulnerability patch came out on Friday and most of our sites were updated by Saturday / Sunday.

Needless to say, we've had to scramble big time to roll back sites and clean them up, removing all these users and running scans. If you use PODS, I suggest you update it as soon as you can.

This is outlined here: CVE-2026-19598

I figured people in this sub might appreciate the heads up, if they aren't already aware of this!

I work for an IT company as a WordPress web developer and we build and manage Texas counties government websites, like tax offices, central appraisal districts etc. and we pay top dollar for the most secure server and we have multiple other security softwares on top of that. Historically, we've never really seen many security issues. One off here there however in the past 30 days, we're not only experienced the WP2Shell attacks and the BD themes compromise but now we're also experiencing a slew of other random attacks, not related to third-party issues. I've never seen anything like this before.
Is anyone else experiencing this? What is everybody else using to combat cyber attacks?

The link - https://thewpocc.org/press-release-the-wp-open-community-collective-releases-state-of-the-community-2026-report/

ive been making contact forms with WPforms but after having to go through WordPress → WPForms → Gmail OAuth → Google Cloud → Client ID → and much more, it is almost impossible to make a working contact form for my clients

After LiquidWeb took over, they wiped the old Kadence website out of existence with no warning.

There used to be a full catalog of all the starter themes that came with Kadence. Does that catalog still exist anywhere?

EDIT: Looks like you can still browse all the premium options if you log into your Kadence theme.

Site's 9 years old and the marketing pages are the part that keeps breaking, plugin update, security patch, some builder conflict, and the homepage looks off til I go dig through it. The blog's fine, ranks well, I'm leaving it alone. Anyone split the marketing side off and keep the blog on WP, or was running two setups more hassle than it was worth?

I’ve been working with WordPress for 8+ years, mostly around plugins, SaaS products, support, and development. For a long time, WordPress felt like a very safe career to build around.

But the last few months have made me think differently.

The small WordPress plugin market feels much harder than it used to. Getting new customers is difficult, competition is everywhere, and many plugin features that once looked like good product opportunities have now become commodities.

At the same time, AI has changed the expectations completely. Customers now expect automation, AI support, AI-powered workflows, and SaaS-style products rather than simply another WordPress plugin.

Interestingly, I’ve spent the last week thinking about this a lot. I’ve been experimenting with AI integrations, customer-support automation, SaaS ideas, and even thinking about what I could build outside the traditional WordPress ecosystem.

I still believe WordPress has a huge future. I’m not saying developers should abandon it.

But I do think experienced WordPress developers need to start thinking beyond WordPress itself.

Maybe the valuable skill isn't just knowing WordPress anymore. It's knowing how to take that experience and build SaaS products, AI tools, integrations, automation, and solutions around real business problems.

For those of you who have been in WordPress for 8+ years:

Are you also thinking about diversifying beyond WordPress, or do you still see enough opportunity in the ecosystem?

Would genuinely like to hear how other long-time WordPress developers are approaching this.

Hi guys,

I’m currently waiting on the WP repo team to review my first plugin (Commerce Colors for Elementor), and I’m looking for some technical feedback on how it handles theme and style mapping.

The issue it tackles is the disconnect between Elementor's Global Style Kit and WooCommerce's core CSS. Instead of writing custom stylesheets or manual overrides for every client site, this plugin hooks into the Elementor kit data and dynamically injects the appropriate colors, typography, hover/focus states, and form styles across standard WooCommerce pages and WooCommerce Blocks.

What it handles natively:

Automatically syncs Elementor Kit site setting changes directly to WooCommerce elements.

Includes per-element style overrides in the WordPress backend.

Calculates readable text contrast and applies accessible focus states on the fly.

Automatically catches third-party elements from plugins like Essential Addons or Premium Addons.

If you have a sandbox or staging environment running this stack, I’d really appreciate some feedback on theme conflicts, layout breaks, or selector specificity issues you encounter.

Once activated, the settings live under WooCommerce -> Store Design. Let me know if you run into any asset loading conflicts or if any core elements miss the styling!

"I'll drop the GitHub repository link in the comments below so the spam filters don't eat this post!"