plugin works great with custom colors and sizing, but only when I’m logged in. Doesn’t appear across browsers when logged out of admin.

I installed the plugin, but it was not working the way I wanted it too. So I removed the plugin. However the progress bar generated by the plugin is still there. I have deactivated all the plugins, removed all custom CCS code from options and customiser. Switch to parent theme. cleared plugin, fusion, and browser after each step

When saving settings a wp_nonce_field() is created but wp_verify_nonce() and check_admin_referer() are both bypassed.

admin/partials/dashboard-display.php

<?php // Use nonce for verification.
	wp_nonce_field( basename( __FILE__ ), 'catch_progress_bar_nonce' );
?>

Creates $_POST[‘catch_progress_bar_nonce’] with the nonce.

admin/class-catch-scroll-progress-bar-admin.php

// Verify the nonce before proceeding.
if ( ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE )
	|| ( ! isset( $_POST['catch_progress_bar_page_nonce'] )
	|| ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['catch_progress_bar_page_nonce'] ) ), basename( __FILE__ ) ) )
	|| ( ! check_admin_referer( basename( __FILE__ ), 'catch_progress_bar_page_nonce' ) ) ) {

The comparison looks for $_POST[‘catch_progress_bar_page_nonce’] as one or comparison, field does not exist in $_POST, note the _page part, this causes a bypass of all other comparisons after this line:

	|| ( ! isset( $_POST['catch_progress_bar_page_nonce'] )

Suggested fixes:

• Use correct field name
• Use and comparison for conditions

Catch Scroll Progress Bar 1.6.1

Function show_it() called in a wp_enqueue_scripts() action directly prints the progress html tag within head tag of page.

This causes a) flash of unstyled content (FOUC) and b) error in html validators.

Example: https://catchthemes.com/demo/catch-scroll-progress-bar/ (line 8)

Suggested fix: Add progress tag via script to DOM or output in footer area.

Catch Scroll Progress Bar 1.6.1

When I click to select the color of the progress bar, the palette does not open.
The problem occurs in both Brave (Chromium) and Firefox.

Hello,

There is an issue with this plugin.

While plugins are released under GPL license so everyone is able to fork them into new projects, you have to at least credit their authors when you use them to create a new product.

I’d really appreciate if you were able to add a small “thank you” and a link to my origin plugin on the description of your fork.

Many thanks,
Jb

This plugin remove the site icon when someone visit a post and plugin is activated, please resolve this bug.