=== Genoo === Contributors: Genoo,latorante Tags: marketing automation, email marketing, centralized lead database, lead capture forms Requires at least: 4.6 Tested up to: 7.0.2 License: GPLv2 or later License URI: http://www.gnu.org/licenses/gpl-2.0.html Stable tag: 6.0.34 Combine the flexibility of WordPress with the power of Genoo and experience amazing results! == Description == The Genoo Plugin for WordPress has been crafted to address one of the most important challenges with WordPress sites - creating an easy way to engage site visitors, capture their contact information, and continue to engage them with relevant content based on their interests. With the Genoo plugin installed, customers using WordPress as their website platform can now: - Track all visitor activity and record it into the lead's Activity screen inside Genoo - Automate emails based on site visitor actions - Create content-relevant and buyer-stage calls-to-action (CTAs) and insert them on pages, into posts, or in sidebars - wherever they make the most sense based on your content - CTAs can be images that change on mouse-over, or HTML buttons - your choice - Integrate WordPress user levels with Genoo Lead Types - automatically - and then use Smart Rules to create deeper engagement - Understand your approved commenters and add them to your lead database automatically - Create and manage forms inside Genoo and present them in your WordPress site using a Genoo form theme or your site's CSS - use for calls-to-action, event registrations, and more - as popups or full forms -and the forms are responsive too. - Form submissions on WordPress automatically create or update Genoo lead records - trigger automatic emails, nurturing sequences, or a variety of other activities With the Genoo Plugin for WordPress, your site will engage visitors, entice them to provide their contact informaton, and increase your audience - which means, ultimately, that you will increase your sales! [Schedule a demo now](http://www.genoo.com/marketing-automation-features/WordPress-Plugin/Genoo-WP-Plugin-Demo-Request "Schedule a demo now"). To download the Genoo Plugin for WordPress, visit https://wordpress.org/plugins/genoo/ or search for "Genoo" from your WordPress Plugins screen (Add New). To obtain the Genoo WordPress Plugin user guide, visit Help/Support from your Genoo Admin Screen. Not a Genoo customer yet? Let's get your ["30-Day Free Trial"](http://www.genoo.com/30-Day_Free_Trial "30-Day Free Trial") started today! = Requirements = 1. Wordpress at least version 3.3 2. PHP at least version 7.4 3. PHP DOMDocument extension 4. Active Genoo account (http://www.genoo.com) == Installation == = Automatic = 1. Go to your admin area and select Plugins -> Add new from the menu. 2. Search for "Genoo". 3. Click install. 4. Click activate. 5. Enjoy. = Manual = 1. Go to [http://wordpress.org/plugins/genoo/](http://wordpress.org/plugins/genoo/ "Genoo") 2. Download latest version of Genoo. 3. Unzip file into Wordpress plugins directory. 4. Activate plugin. 5. Enjoy. == Screenshots == 1. Add your Genoo API key and External Tracking script, and the Genoo plugin will automatically ensure that all lead activity on your website pages is tracked. Once you save that information, you'll be able to set a Lead Type where all approved Commenters will be placed within your Central lead database within Genoo. 2. Keep your Form look and feel as the default for your theme, or select from one of our themes. The look and feel will be applied to lead capture forms you place onto your site pages. 3. The External Forms you've created with your Genoo account are listed. You select which one is the default "blog subscribe" form. Using Shortcodes or our Widget to easily place the right form on the right page on your website ensures that all of your lead information resides in your Genoo account's centralized lead database, allowing you to automate actions and follow-up effectively. 4. Push all existing subscribers and approved commenters to your Genoo account easily, and perform other housekeeping activities as needed. (note: once you push your existing subscribers and approved commenters, all NEW subscribers will be pushed automatically - just use the chosen Genoo blog subscribe form on your pages. Approved commenters will be pushed across in real time to your Genoo account, as comments are approved). Understanding which leads are commenting in addition to all their other activity is now seamless! == Frequently Asked Questions == == External Services == This plugin connects to the Genoo marketing automation API (https://app.genoo.com) to provide its core functionality. **What data is sent and when:** * Visitor tracking data (page views, clicks, referrers) is sent to Genoo on every front-end page load when the plugin is configured with a valid API key. * Lead and contact data (name, email address, and any other fields submitted) is sent to Genoo when a visitor submits a lead capture form embedded on your site. * Existing WordPress subscriber and approved commenter data (name, email) is sent to Genoo when a site administrator manually triggers an import via the plugin's Tools screen. * CTA definitions, form HTML, form themes, landing page templates, and related configuration data are retrieved from the Genoo API to display calls-to-action and lead capture forms on your site. This service is provided by Genoo, LLC. * Service URL: https://app.genoo.com * Terms of Service: https://www.genoo.com/terms-of-service * Privacy Policy: https://www.genoo.com/privacy-policy == Upgrade Notice == == Changelog == = 6.0.33 = * Fix: API key was overwritten with the display mask on every settings save after the first. The mask-detection regex used a non-Unicode PCRE pattern; PHP applied the {20,} quantifier to only the last byte of the 3-byte bullet character (U+2022), so the mask was never detected and the masked placeholder was encrypted and stored as the new API key. Replaced with a simple mb_strpos check — real API keys never contain the bullet character. * Security: Replace static sha1 shared secret on the genooFlushPages and genooFlush cache-flush endpoints with RSA-SHA256 asymmetric request signing. The plugin now embeds Genoo's public key (kid 2026-01-dev) and verifies a signed, timestamped payload on every incoming flush request, preventing replay attacks and eliminating the risk of a single leaked secret compromising all customer sites. Legacy key is accepted in parallel during the migration window. * Fix: CTAs and Styles pages are now fully accessible to Editor-role users. Root cause was that the Genoo parent menu was registered at manage_options, causing WordPress to block all CPT pages (edit.php?post_type=*) for Editors via the $_wp_menu_nopriv path. The parent menu is now registered at edit_posts; the Settings submenu entry is explicitly re-registered at manage_options so it remains hidden from and inaccessible to Editors. * Fix: Landing Pages no longer appears as a standalone menu item — it is accessible only through Page Builder as intended. * Fix: Menu order corrected to Settings, Forms, Surveys, Page Builder, CTAs, Styles, Tools. * Fix: Page Builder delete and rename operations sent a corrupted template ID to the API. Template IDs are alphanumeric hashes (e.g. 20b08fe853594bcc9e) but absint() truncated them to just the leading integer (20), targeting the wrong or nonexistent template on every operation. Replaced with sanitize_text_field(). * Fix: Page Builder "Move to folder" URL placeholders (%%ID%%, %%NEW_NAME%%) were URL-encoded by add_query_arg(), making the JS rename replace() and the PHP str_replace() unable to find them. URL is now built with raw string concatenation to preserve the placeholders verbatim. * Fix: Page Builder delete always showed "Template successfully removed" regardless of API result because deletePage() returns FALSE (not an exception) on non-204 responses and the return value was ignored. Now checks the return value and shows an error on failure. * Fix: Page Builder rename catch block treated exception code 1000 as a success signal, masking API failures. All exceptions now correctly surface as error notices. = 6.0.29 = * Security: Genoo API key is now encrypted at rest using AES-256-CBC (key derived from WordPress AUTH_KEY). Plain-text keys already in the database are transparently migrated to encrypted storage on first page load — no manual action required. * Security: API key settings field now shows a masked placeholder (bullets + last 4 characters) so the full key is never rendered into the page source. * Security: Added "Verify Key" button on the API Settings page to confirm a stored key is valid against the live Genoo API without exposing the key value. * Security: Added nonce verification (check_ajax_referer) and manage_options capability check to all admin AJAX handlers: genooImportStart, genooImportComments, genooImportSubscribersStart, genooImportSubscribers, wpme_import_cta_count, wpme_import_ctas. * Security: Fixed critical XSS vulnerability in Frontend::renderPreviewLumenIframe() — $src and $id are now escaped with esc_url() / sanitize_html_class() before output. * Security: Sanitized all raw $_POST/$_GET/$_REQUEST reads across Ajax.php, MetaboxCTA.php, MetaboxBuilder.php, MetaboxArea.php, Table.php, TablePages.php, Users.php, and LandingPages/Metabox.php. * Security: Escaped all unescaped output — esc_html() applied to exception messages in Frontend.php and all widget files; esc_js() applied to JavaScript-context output in Admin.php and Utils.php; esc_attr() applied to TinyMCE popup fields. * Security: Removed all error_reporting(0) and ini_set('display_errors', 0) suppression calls from production code paths. * Security: Added External Services disclosure section to readme.txt per WordPress.org guidelines. * Fix: Corrected inverted conditional in Import::importSubscribers() that caused a false "no lead type found" error on every subscriber import. * Compliance: Removed unnecessary load_plugin_textdomain() call (redundant since WordPress 4.6). = 6.0.28 = * Fix: Plugin extension detection notices now correctly suppress when the LifterLMS extension is already installed (file path was stale after plugin rename from lifterlms-wpmktgengine-extension to genoo-ecommerce-tools-lifterlms). * Fix: isExtensionInstalled() now checks both the current and legacy file path, preventing false-positive notices for any renamed extension plugin. * Fix: Auto-segmentation extension notice now appears for wp-genoo users in addition to WPMKTGENGINE users. * Improvement: Populated missing plugin name fields for bbPress, BuddyPress, WooCommerce, LifterLMS, Gravity Forms, and Elementor extension notices. = 6.0.27 = * Performance: Form theme CSS (wpme-styles) is now pre-generated as a static external file in the uploads directory, eliminating the ~1.7 KB inline