CMS Tree Page View – Reorder Pages with a Drag-and-Drop Tree

1.7.1 (June 2026)

Security

• The tree and its search now show each user only the posts and pages they are allowed to see, matching WordPress’ built-in posts and pages screens. Users who cannot edit other people’s content (such as Contributors) no longer see — or find by searching — other authors’ drafts in the tree.
• When adding pages, the plugin now respects who is allowed to publish. If a user cannot publish a given post type, their new page is saved as “Pending review” instead of being published.

1.7.0 (June 2026)

The plugin is now maintained by its original author again and is being modernized. This release focuses on security and compatibility with current WordPress and PHP.

Changed

• Tree rendering no longer runs three database queries per node. Loading a level of the tree now primes the post and meta caches in one query each and resolves all child counts in a single query, instead of one query each for the post, its meta, and a “has children?” check per node. On a tree with ~250 nodes this cut a single level’s queries from ~760 to 4 (about 7× faster).
• Tested up to WordPress 7.0.
• Now requires at least WordPress 6.0 and PHP 7.4.

Fixed

• The tree now degrades gracefully instead of erroring on PHP 8+ when an unregistered post type is requested.
• The settings screen no longer triggers “setting is unregistered / deprecated” and “headers already sent” notices on modern WordPress. The settings form is now handled directly by the plugin instead of routing through core options.php. Settings save exactly as before.
• Removed a redundant database query that ran once per ancestor while expanding search results in the tree.

Security

• Fixed a reflected XSS issue where the post_type URL parameter was output on the tree pages without escaping.
• Fixed potential stored XSS in the page tree data — page titles, author display names, permalinks, and edit links are now safely JSON-encoded.
• Added a capability check (manage_options) to the settings save handler.
• Hardened database queries with prepared statements.
• Added nonce (CSRF) protection to the dismissible notice boxes.
• Added direct file access (ABSPATH) guards.

Older versions

The changelog for all previous releases (1.6.8 and earlier, back to the first release in 2010) is in changelog.txt, included with the plugin.

ysaetf7ruhjnm3e2x4tbtletpc35ckeb