Catch Popup

Catch Popup lets you create unlimited fully customisable popups on your WordPress site. Each popup is a custom post with its own trigger, appearance, size, position, close behaviour, and page-targeting rules. A separate **Popup Theme** controls the visual style (colours, fonts, borders, shadows) and can be reused across multiple popups.

1) Installation #

a)Using the WordPress Administration Panel

You can download Plugins directly to your blog by using the Add New Plugins option in the Plugins sub-menu.

1. Log in to the WordPress Administration Panel
2. Go to "Plugins => Add New"
3. Search for "Catch Popup" by catchthemes
4. Click on "Install Now" install and then "Activate" to activate the Plugin

b)Manual Installation using FTP

To add a new Plugin to your WordPress installation, follow these basic steps:

1. Download Catch Pop from your Catch Themes https://catchthemes.com/plugins/catch-pop/ page to your Desktop
2. Unzip catch-pop.zip to your Desktop
3. Using an FTP client to access your host web server. Go to "/wp-content/plugins/" and make sure that you do not already have a catch-pop folder installed. If you do, then back it up and remove it from "/wp-content/plugins/" before uploading your copy of Catch Pop
4. Upload Catch Pop to /wp-content/plugins/
5. Activate Catch Pop through "Plugins", in your WordPress Dashboard

Updating Plugin Using the Administration Panel #

You can update Plugin directly from the Administration Panel by simply pressing the update button in the main plugins page.

Updating Plugins Using FTP

To update Plugin though FTP, follow these basic steps:

1. Download Catch Pop plugin to your Desktop
2. Unzip catch-pop.zip to your Desktop
3. Using an FTP client to access your host web server, go to /wp-content/plugin/ and upload your new copy of Catch Pop which shall replace the old files

Creating a Popup

Navigate to "Catch Popup => Add New Popup". The standard WordPress editor handles the popup's title and body content. Below the editor you will find the Meta Box for "Popup Settings" with four tabs [Triggers, Display, Close, and Targeting].

Popup Content

It's just like the normal post with Title (Displayed as the popup heading), Blocks Editor (The main content — supports any blocks, HTML, shortcodes, images, forms, etc.) and Featured Image (Optional image displayed above the body content inside the popup).

Popup Metabox

1. Triggers Tab: Controls "how and when" the popup opens
2. Display Tab: Controls the "visual appearance, size, and position" of the popup window. Four sub-tabs:Appearance, Size, Position, and Advanced
3. Close Tab: Controls how visitors can "dismiss" the popup. Two sub-tabs: Button, and Alternative Methods
4. Targeting Tab: Controls "which pages" the popup appears on. By default (no conditions added) the popup shows on every page of your site

Popup Theme

A "Popup Theme" is a separate post type that defines the visual design — overlay colour, container background, typography, close button style, drop shadows, and borders. One theme can be applied to many popups, so changing the theme updates all linked popups at once. Five themes are installed automatically on first activation:

1. Default: Clean white container, dark close button, Open Sans font
2. Theme Border: Gold/tan background with white border frame
3. Theme Blue: Bright blue background, white text, teal close button
4. Theme Light: Light grey tones, yellow close button, dark text
5. Theme Round: Green background, rounded corners, Dancing Script font

Displaying a Popup

There are two ways to display a popup by Shortcode or Catch Popup block.

Using Shortcode

When the popup trigger is set to "Click Open", you need a clickable element on the page that opens it. Use the

[catch-popup]

shortcode to wrap any text or HTML. The Shortcode has following attributes:

1. id: The ID of the popup post to open (required)
2. html_tag: The HTML element to wrap the trigger text in `span` | `a`, `button`, `div`, `span`
3. popup_class: Extra CSS class(es) to add to the trigger element. Any valid CSS class name

[catch-popup id="123" html_tag="button"]Open Popup[/catch-popup]

How to find the popup ID: Go to **Catch Popup**, hover over the popup name — the ID appears in the URL shown in the browser status bar (e.g. `post=123`). Or you can install the plugin "Catch Ids" and it will show ID. Examples:

[catch-popup id="42" html_tag="button" popup_class="my-btn"]Subscribe Now[/catch-popup]

[catch-popup id="42" html_tag="a"]Click here for our offer[/catch-popup]

Note: The shortcode generates a cursor-pointer element. Style it further with your theme CSS or the `popup_class` attribute.

Gutenberg Block

1. In the block editor, click "+" to add a new block.
2. Search for "Catch Popup".
3. Select the "Catch Popup" block.
4. In the block settings panel enter:
   • Select Popup: Select which popup you want to open
   • HTML Tag: `a`, `button`, `div`, or `span`
   • Popup Class: optional extra CSS class
   • Content: Button Text the visible trigger label (defaults to "Click Me")

The block renders the same shortcode output on the front end.

Tips & Common Use Cases

Newsletter signup popup (auto, timed)

1. Create a popup with an email form in the body.
2. Set trigger to "Auto Open", delay to "5000" (5 seconds).
3. Leave Targeting empty so it appears site-wide, or add a condition for "Home" only.

Promotional banner (click trigger, specific page)

1. Create a popup with an offer image and CTA button.
2. Set trigger to "Click Open".
3. In the page or post you want, add a button using the Gutenberg "Catch Popup" block or the

   [catch-popup]

   shortcode with the popup ID.
4. Under Targeting, add "Selected Pages" and choose that specific page so the popup HTML is only loaded there.

Cookie/GDPR notice (auto, all pages, close delay)

1. Create a popup with your notice text.
2. Set trigger to "Auto Open", delay to "0" ms.
3. Set "Close Button Delay" to "3000" ms so visitors must read for 3 seconds before dismissing.
4. Enable "Click Overlay to Close" as a fallback.
5. Leave Targeting empty.

Reusing a visual style

1. Go to "Catch Popup Themes" and edit the "Default" theme (or create a new one).
2. Set your brand colours, fonts, and borders once.
3. Go to each popup and select that theme under "Display › Appearance › Popup Theme".

Stacking multiple conditions

1. Use "Or" to show the popup on either of two different page types (e.g. Home "Or" Search).
2. Use "And" to require both conditions to be true simultaneously (e.g. All Posts "And" With Categories = "News").

2.0 (Released: May 21, 2026)

• Security Fix: Added nonce verification to catch_popup_get_data AJAX handler
• Security Fix: Shortcode html_tag attribute now validated against an allowlist to prevent XSS
• Security Fix: add_plugin_meta_links() output now escaped with wp_kses()
• Security Fix: $_POST['post_ID'] sanitized with absint() before use in save handler
• Security Fix: $_POST values unslashed before sanitization in catch_popup_save()
• Bug Fixed: AJAX calls now pass nonce via cpop_object.ajax_nonce localized variable
• Bug Fixed: $tag->post_title corrected to $tag->name for WP_Term objects in catch_popup_get_data()
• Bug Fixed: get_posts() args corrected from 'status'=>'published' to 'post_status'=>'publish'
• Bug Fixed: $styles['close']['font-family'] no longer stores a boolean from isset()
• Bug Fixed: console.log(counter) debug statement removed from generated popup JS
• Bug Fixed: Duplicate value attribute removed from catch_popup_auto_height checkbox
• Bug Fixed: Dead code $popup->ID; standalone statements removed
• Bug Fixed: Function renamed from something() to catch_popup_maybe_enqueue_assets() to prevent naming conflicts
• Bug Fixed: $_GET['post_type'] and $_GET['action'] now sanitized with sanitize_key() before comparison
• Bug Fixed: esc_html('Remove', 'catch-popup') corrected to esc_html__() so string is translatable
• Bug Fixed: esc_html($post_value['post_title'], 'catch-popup') — spurious second argument removed
• Bug Fixed: esc_attr() replaced with esc_html() for popup title element text in shortcode output
• Bug Fixed: WP_Filesystem() now initialized before use in enqueue-scripts-styles.php
• Bug Fixed: strtotime('now') replaced with time()
• Bug Fixed: Duplicate ABSPATH guard removed from install-functions.php
• Bug Fixed: Admin script version corrected from hardcoded '1.0.1' to CATCH_POPUP_VERSION
• Bug Fixed: Admin scripts moved to footer for improved page performance
• Bug Fixed: Replaced deprecated wp.editor.ServerSideRender with wp.serverSideRender — block was silently failing to register, making it invisible in the block inserter
• Bug Fixed: Added missing wp-server-side-render script dependency to block registration
• Bug Fixed: Replaced deprecated 'wp-editor' script dependency with 'wp-block-editor' in block registration
• Code Quality: Plugin Check — NonceVerification.Missing in catch_popup_theme_save() fixed by checking nonce field presence before any $_POST access
• Code Quality: Plugin Check — MissingUnslash in catch_popup_theme_save() fixed by calling wp_unslash() on the submitted popup_theme array before sanitizing individual fields
• Code Quality: Plugin Check — NonceVerification.Recommended for $_GET reads in catch_popup_maybe_enqueue_assets() suppressed with phpcs:ignore; these params are read only to detect the current admin page, not to process user input
• Code Quality: Plugin Check — NonPrefixedHooknameFound fixed; filter hooks generated_css, theme_get_generated_styles, generate_popup_theme_styles, and generate_popup_styles now all carry the catch_popup_ prefix
• Code Quality: Plugin Check — NonPrefixedVariableFound fixed; global-scope loop variable $hook in catch-popup-editor-button.php renamed to $catch_popup_hook
• Bug Fixed: "Error loading block: Invalid parameter(s): attributes" — replaced ServerSideRender REST call with a static editor placeholder; the block trigger preview now renders instantly in the editor without any REST API round-trip
• Bug Fixed: Click-triggered popups never opened — wp_strip_all_tags() was used to write the generated JS cache file, which silently deleted all JavaScript content inside the tags; replaced with preg_replace() that strips only the tag wrappers
• Bug Fixed: Click-triggered popup only opened on first page load and failed on refresh — click handler was bound inside $(window).on('load') which is a one-shot event missed entirely when the page loads from cache; moved handler binding directly into the DOM-ready jQuery wrapper
• Bug Fixed: Clicking a trigger for popup A would set container opacity on popup B — the opacity line used a hardcoded PHP loop variable instead of the dynamic id captured from the click target's data-popup attribute
• Code Quality: Plugin Check — removed load_plugin_textdomain()
• Compatibility check up to version 7.0

1.5 (Released: February 05, 2026)

• Bug Fixed: WordPress.WP.AlternativeFunctions.file_system_operations_mkdir
• Bug Fixed: WordPress.WP.AlternativeFunctions.strip_tags_strip_tags
• Bug Fixed: WordPress.DateTime.RestrictedFunctions.date_date
• Bug Fixed: WordPress.Security.EscapeOutput.OutputNotEscaped
• Bug Fixed: WordPress.WP.I18n.NonSingularStringLiteralText
• Bug Fixed: WordPress.WP.I18n.TextDomainMismatch
• Bug Fixed: plugin_header_invalid_author_uri
• Bug Fixed: Translation loading
• Bug Fixed: stable_tag_mismatch
• Bug Fixed: license_mismatch
• Compatibility check up to version 6.9.1

1.4.2 (Released: February 24, 2022)

• Compatibility check up to version 5.9

1.4.1 (Released: August 06, 2021)

• Bug Fixed: Catch popup blocks

1.4 (Released: August 05, 2021)

• Compatibility check up to version 5.8

1.3 (Released: March 11, 2021)

• Compatibility check up to version 5.7
• Bug Fixed: wp_localize_script issue
• Bug Fixed: Catch popup blocks

1.2 (Released: March 12, 2020)

• Bug Fixed: Title font family issue
• Code optimization
• Compatibility check up to version 5.4

1.1 (Released: November 12, 2019)

• Compatibility check up to version 5.3

1.0.0 (Released: September 21, 2019)

• Initial Release