Unfiltered MU
This WordPress MU/WordPress 3.0 multisite plugin gives blog Administrators and Editors the ability to post whatever HTML they want.
The facts
- Rating
- 4.9★ from 14
- Active installs
- 3k+
- Price
- Free
- Last updated
- 20 Dec 2018
- Added
- May 2008
- Requires WP
- 2.9.2
- Tested up to
- WP 5.0.27
- Downloads
- 125,157
Our analysis
AI-assistedUnfiltered MU is a WordPress plugin designed for WordPress Multisite installations, allowing Administrators and Editors to use unfiltered HTML in their posts. This means that tags like <iframe> and <embed> will not be stripped from the content, providing greater flexibility for embedding media. However, this capability is not extended to Authors and Contributors due to security concerns.
The plugin can be applied globally across the entire multisite or on a per-blog basis. It is important to note that using this plugin can pose significant security risks, particularly if untrusted users are allowed to create blogs on your site, as it opens the possibility for malicious code to be injected.
Best for: This plugin is suited for experienced administrators of WordPress Multisite who need to allow unfiltered HTML for trusted users.
What it does well
- ✓Allows unfiltered HTML for Administrators and Editors
- ✓Can be applied globally or on a blog-by-blog basis
- ✓Free to use from the WordPress.org directory
Where it falls short
- •High security risk if untrusted users are present
- •Not suitable for regular WordPress installations
- •Warning against use is prominent in the description
Verdict
Unfiltered MU provides flexibility for content creation but comes with serious security warnings. Use it with caution and only in trusted environments.
From the developer
Donncha O Caoimh (a11n)'s own description of Unfiltered MU, lightly tidied.
Unfiltered MU gives Administrators and Editors the unfiltered_html capability. This prevents WordPress MU/WordPress 3.0 multisite from stripping <iframe>, <embed>, etc. from these users’ posts. Authors and Contributors do not get this capability for security reasons.
The plugin can either be used globally for your entire MU site, or it can be applied on a blog-by-blog basis.
For WordPress MU or WordPress 3.0 multisite only. Regular WordPress already offers this feature and does not need this plugin.
Warning! This is a very dangerous plugin to activate if you have untrusted users on your site. Any user could add Javascript code to steal the login cookies of any visitor who runs a blog on the same site. The rogue user can then inpersonate any of those users and wreak havoc. If all you want is to display videos on your WordPress MU blogs, use the native Embed Support, Viper’s Video Quicktags or any of the other video plugins on WordPress.org.
If you use this plugin your site will be hacked in one way or another if you allow anonymous users on the Internet to create blogs on your site. It’s very dangerous.
Are you still 100% sure you want to use this plugin?