Title: ConferenceManager
Author: creativestrategy24
Published: June 7, 2026
Last modified: August 16, 2026
---
Search plugins
# ConferenceManager
By [creativestrategy24](https://profiles.wordpress.org/creativestrategy24/)
[Download](https://downloads.wordpress.org/plugin/conferencemanager.1.2.4.zip)
* [Details](https://pcd.wordpress.org/plugins/conferencemanager/#description)
* [Reviews](https://pcd.wordpress.org/plugins/conferencemanager/#reviews)
* [Installation](https://pcd.wordpress.org/plugins/conferencemanager/#installation)
* [Development](https://pcd.wordpress.org/plugins/conferencemanager/#developers)
[Support](https://wordpress.org/support/plugin/conferencemanager/)
## Description
Conference Manager is a WordPress plugin designed for academic societies and conference
organizers. It provides end-to-end management of event registration, payments, and
document generation.
**Features:**
* Member management (import/export via CSV/Excel)
* Event and session management
* Registration forms with group (team) registration support
* Bank transfer and Stripe credit card payment
* Automatic invoice and receipt PDF generation
* Participant list and MyPage (with Passkey/WebAuthn authentication)
* AES-256-GCM encryption for personal data
* Audit logging, rate limiting, and bot protection
* Transactional email notifications (OTP, confirmations)
* SNS share buttons (Twitter/X, Facebook, LINE)
* Full Japanese / English localization
A separately distributed Pro edition (Conference Manager Pro) adds abstract submission
and peer review, sponsor management, bulk email and other features for larger conferences.
It is a different plugin and is not required: everything listed above works in full
here, with nothing locked or time-limited. See Conference > What’s New in the admin
menu for the full list.
### External Services
This plugin connects to the following external services.
#### Stripe Payments (optional)
When the site administrator configures Stripe API keys (Secret and Publishable)
under Conference Setup, and a participant chooses Stripe at checkout, the plugin:
* Loads Stripe.js from `https://js.stripe.com` on the registration page.
* Creates a PaymentIntent on Stripe’s servers via the Stripe PHP SDK.
* Stripe Elements (an iframe hosted by Stripe) collects the card data directly;
the card number never touches the WordPress server.
* Optionally receives webhook callbacks from Stripe to confirm payment status.
What data is sent to Stripe:
* Payment amount and currency.
* Participant email address (for Stripe receipts).
* Billing details if provided by the participant.
* Registration ID and registration number as metadata.
When:
* Only when a participant selects Stripe as the payment method and submits the
registration form.
* When Stripe sends a webhook back to the site (server-to-server callback).
Links:
* Stripe Terms of Service: [https://stripe.com/legal/ssa](https://stripe.com/legal/ssa)
* Stripe Privacy Policy: [https://stripe.com/privacy](https://stripe.com/privacy)
#### IPAex Font Download (PDF generation)
To render Japanese text in PDF documents (invoice, receipt), the plugin needs the
open-source IPAex Gothic and IPAex Mincho fonts. From the admin Dashboard you can
install them with one click; the plugin then downloads the font files (one-time,
per font). No user data is transmitted — it is a file download only. If the server
cannot reach the download host, you can instead upload the `.ttf` files directly
from the Dashboard (no external connection required).
* Download host (mirror maintained by the plugin author): [https://cs24.biz/conference/fonts/](https://cs24.biz/conference/fonts/)
* Data sent: none (file download only)
* The download URL can be overridden via the `conf_manager_font_source_url` filter.
* Original font source / IPAex Font License (IPA, Information-technology Promotion
Agency): [https://moji.or.jp/ipafont/license/](https://moji.or.jp/ipafont/license/)
### Development / Building from source
The admin and public interfaces are built with React (JSX). The human-readable
source for the compiled, minified bundles `build/admin-app.js` and build/public-
app.js is shipped inside this plugin under the `src/` directory:
* `src/admin/` — source for `build/admin-app.js` (admin dashboard app)
* `src/public/` — source for `build/public-app.js` (public registration / MyPage
app)
Build toolchain: the project uses [@wordpress/scripts](https://www.npmjs.com/package/@wordpress/scripts)
(
a wrapper around webpack and Babel). The webpack configuration is included as webpack.
config.js, and all dependencies and build scripts are declared in package.json (
with `package-lock.json` for reproducible installs).
To rebuild the compiled assets from source:
1. Install Node.js 18+ and npm.
2. From the plugin directory, run `npm install`.
3. Run `npm run build`. This regenerates `build/admin-app.js` and
build/public-app.
js (and their `*.asset.php` dependency manifests). Use `npm start` for an unminified
development watch build.
Third-party libraries bundled into the compiled JavaScript (all open source,
installed
from the public npm registry and declared in `package.json`):
* `@stripe/react-stripe-js` and `@stripe/stripe-js` — Stripe Elements payment UI(
MIT)
* `html5-qrcode` — QR code scanner used for participant check-in (Apache-2.0)
WordPress-provided packages (`wp-element`, `wp-components`, `wp-api-fetch`,
wp-
i18n, `react`, `react-jsx-runtime`) are declared as externals and are NOT bundled—
they are loaded from WordPress core at runtime.
## Screenshots
[⌊Dashboard — event overview and quick actions⌉⌊Dashboard — event overview and quick
actions⌉[
Dashboard — event overview and quick actions
[⌊Registration form — participant registration with group support⌉⌊Registration
form — participant registration with group support⌉[
Registration form — participant registration with group support
[⌊Payment management — bank transfer and Stripe payment tracking with invoice generation⌉⌊
Payment management — bank transfer and Stripe payment tracking with invoice generation⌉[
Payment management — bank transfer and Stripe payment tracking with invoice generation
## Installation
1. Upload the plugin folder to `/wp-content/plugins/`.
2. Activate the plugin through the “Plugins” menu in WordPress.
3. Go to “Conference” in the admin menu to start configuring your event.
4. (Optional) To accept credit card payments, obtain Stripe API keys from your Stripe
account and enter them in Conference Setup.
## FAQ
### Does this plugin charge any fees?
No. The plugin itself is free and GPL-licensed, and nothing in it is locked, time-
limited or unlocked by payment. If you enable Stripe payments, Stripe’s standard
transaction fees apply and payments go directly to your own Stripe account — this
plugin does not take any percentage.
### Is there a paid version?
The plugin author distributes a separate Pro edition with additional features for
larger conferences. It is a different plugin, sold and updated outside WordPress.
org, and it is not required to use this one. No part of it is included here, and
no feature of this plugin is withheld pending an upgrade. The Conference > What’s
New screen lists what is in this plugin and what the Pro edition adds.
### Does the plugin support Japanese?
Yes. The plugin is fully internationalized and includes Japanese translations. PDF
documents use IPA fonts for proper Japanese rendering.
### What are the server requirements?
WordPress 6.9 or later, PHP 8.4 or later, and MariaDB 10.5 or later (or MySQL 8.0
+).
### How is personal data protected?
Email addresses, phone numbers, and postal addresses are encrypted with AES-256-
GCM before they are written to the database.
For the strongest protection, define `CONF_MANAGER_ENCRYPTION_KEY` in `wp-config.
php` before activating the plugin (it must be at least 16 characters; a shorter
value is ignored and the fallback below is used instead). The key then lives outside
the database, so a database-only compromise — an SQL injection, or a leaked backup—
does not expose the key along with the data it protects.
If that constant is not defined, the plugin generates a random key on first activation
and stores it in `wp_options`, so that encryption works without any setup. This
is the default. Note that the key then resides in the same database as the data
it encrypts.
Conference Setup shows which of the two modes your site is using.
Important: do not add or change the encryption key once the plugin has stored data.
Decryption always uses the key currently in effect, so replacing it makes existing
encrypted data permanently unreadable.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“ConferenceManager” is open source software. The following people have contributed
to this plugin.
Contributors
* [ creativestrategy24 ](https://profiles.wordpress.org/creativestrategy24/)
“ConferenceManager” has been translated into 1 locale. Thank you to [the translators](https://translate.wordpress.org/projects/wp-plugins/conferencemanager/contributors)
for their contributions.
[Translate “ConferenceManager” into your language.](https://translate.wordpress.org/projects/wp-plugins/conferencemanager)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/conferencemanager/),
check out the [SVN repository](https://plugins.svn.wordpress.org/conferencemanager/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/conferencemanager/)
by [RSS](https://plugins.trac.wordpress.org/log/conferencemanager/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 1.2.4
* Fixed: a shortcode naming a view that only exists in the Pro edition — for example[
conf_manager view=”reviewer-apply”] or view=”sponsors” — quietly displayed the
attendee registration form instead. Anyone opening what was meant to be a reviewer
application or a sponsor listing could submit a registration, and it was recorded
as a real one. Those views now stop instead of falling back, and a note explaining
why is shown to users who can edit the page. A mistyped view name still falls
back to the registration form, as before.
* Fixed: the one-time code for My Page was limited to 3 requests per hour per IP
address, with a one hour lockout. At a university, a company or a conference
venue, where many people share a single public IP address, the fourth person
to request a code locked everyone out for an hour. Because the send itself was
refused, no code arrived and the cause was invisible from the organiser’s side.
The limit is now 50 per hour with a ten minute lockout, while the existing per-
address limit of 5 per hour continues to stop abuse aimed at one mailbox.
#### 1.2.3
* Fixed: exporting members to CSV returned at most 100 rows. The export asked for
up to 10,000, but the underlying search caps a request at 100, so the file was
silently short — it looked like a complete export. It now pages through every
matching record. If an export ever reaches the 20,000 row safety limit, the file
says so on its last line instead of ending quietly.
* Fixed: lists that page through records were ordered by a value that repeats —
the date a record was created, or an event’s start date. Rows sharing that value
have no guaranteed order between pages, so a record could appear twice or be
passed over. Every paged list now falls back to the record id, which is unique.
* Fixed: after a successful encryption key rotation the plugin still warned that
data could not be read, because it kept comparing against the previous key. The
warning is now cleared when the rotation completes with no errors — and deliberately
kept when any record failed, since that is exactly when the warning is worth
seeing.
#### 1.2.2
* Fixed: the encryption key warning told every site to restore the key in wp-config.
php, even when the key was never kept there. Sites installed with the default
settings keep an automatically generated key in the database instead, so that
advice sent administrators looking for something that was not there. The warning
now says where the key actually is.
* Fixed: in the most common way this warning appears — adding the CONF_MANAGER_ENCRYPTION_KEY
constant to wp-config.php on a site that had been running on the automatically
generated key — the previous key is still held in the database, and the warning
now says so and how to put it back. That case is fully recoverable in one step;
it previously read as though the data were lost.
* Security: dismissing the encryption key warning now requires submitting the form’s
button. It was previously a link, and a link that changes state can be followed
by a browser or extension prefetching it, which would have moved the reference
point forward and removed the warning without anyone clicking it — erasing the
only sign that the key had changed. Requests that are not form submissions are
refused.
* Fixed: the key rotation routine paged through records by position rather than
by record, while updating those same records as it went. Nothing guaranteed the
order between pages, so a record could be passed over and left encrypted with
the previous key. It now advances by record id, and stops if a page fails to
advance.
#### 1.2.1
* Security: the plugin now notices when the encryption key changes and says so
in the admin area. Personal data encrypted with the previous key cannot be read
until that key is restored — the data is intact, but nothing in the plugin can
recover it on its own, so the warning appears while the mistake is still easy
to undo. Only a hash of the key is stored; the key itself never is.
* Fixed: the key rotation routine skipped any table without a “status” column and
still reported success, which would have left some records readable only with
the old key.
* The Setup screen no longer claims that encrypted data is unreadable if the database
is compromised, regardless of where the key is kept. That is true only when the
key is defined in wp-config.php. With the default automatic key, the key lives
in the same database as the data, and the screen now says so.
* The readme’s answer on personal data protection now states which key location
is recommended and why, that a key shorter than 16 characters is ignored, and
that adding or changing the key after data has been stored makes existing data
permanently unreadable.
* Removed unused code that generated a fresh encryption key. It was never reachable,
but wiring it up would have made existing encrypted data unrecoverable.
#### 1.2.0
* New: a “What’s New” screen under the Conference menu, listing what this plugin
can do — newest additions first, with the version each one arrived in — followed
by what the separately distributed Pro edition adds. The screen is static: it
renders no images, makes no external requests, and stores nothing.
* The readme now states plainly that a separate Pro edition exists. This plugin
is unchanged in what it does: every feature it ships remains fully functional,
and none of the Pro edition’s code is included in this package.
#### 1.1.12
* Fix: sites that had already skipped a database upgrade are now repaired. Before
1.1.11, activating the plugin recorded the schema version without running the
pending upgrades, which left the recorded version up to date while the data was
not. Because the version already looked current, 1.1.11 alone could not detect
or repair those sites. This release re-runs the 1.1.9 and 1.1.10 data upgrades
once, so the amount actually received is filled in and refunds made before 1.1.9
are moved into the settlement ledger. Both steps only touch rows that were never
migrated, so sites that are already correct are left untouched.
* Database schema auto-upgrades to v3.4.0.
#### 1.1.11
* Fix: pending database migrations were skipped when the plugin was updated by
deactivating it, replacing the folder and activating it again. Activation stamped
the schema version without running the migrations, so the upgrade steps introduced
in 1.1.9 and 1.1.10 never ran on those sites. Activation now runs them. This
stops the problem from happening again, but it does not recover a site that had
already skipped a migration — see 1.1.12, which does. Sites updated through the
normal WordPress plugin updater were never affected.
#### 1.1.10
* Fix: refunds issued before the settlement ledger was introduced in 1.1.9 were
not counted, so the net amount received was overstated by the refunded amount
and the payment could be shown as fully settled. Those refunds are migrated into
the ledger on upgrade. A full refund is migrated using the amount actually received,
because full refunds recorded before 1.1.9 stored only the tax-exclusive amount.
* Fix: a payment that has been refunded in full is no longer reported as needing
a surcharge. A full refund cancels the registration, so the billed amount is
no longer outstanding and the payment now counts as settled. Partial refunds
are unchanged and are still settled against the difference.
* Fix: uploading or deleting an abstract template on the event screen did nothing
because of a missing script import.
* Database schema auto-upgrades to v3.3.0.
#### 1.1.9
* Payments: the billed amount and the amount actually received are now tracked
separately. When confirming a payment you can record the real amount received(
for example when a bank transfer fee was deducted) together with a handover note
for the reception desk or accounting. The payment list gains Billed, Paid and
Difference columns and highlights rows that still need attention.
* Payments: a single “Settle” dialog replaces the old refund dialog and covers
all four cases — refunding the difference, collecting a surcharge, refunding
in full and cancelling the registration, and correcting a mis-recorded paid amount.
Refunds and surcharges are kept as a dated ledger with the method and the staff
member who handled them, and are reflected in the event totals.
* Participants: a registration’s fee category can now be corrected after payment
has been received. The billed amount is updated while the amount actually received
is left untouched, so the resulting difference is surfaced as “Refund due” or“
Surcharge due” instead of being silently lost. Receipts that were already issued
are regenerated under the same receipt number.
* Participants: the list is now scoped to a single event (defaulting to the most
recent one), shows status and settlement badges, and consolidates category correction
and status changes into one “Edit / Payment” dialog.
* Fix: full refunds are now calculated on the tax-inclusive amount actually received.
Previously a full refund recorded only the tax-exclusive amount, so a ¥8,800
payment was recorded as an ¥8,000 refund while Stripe refunded the full ¥8,800.
* Fix: payments reconciled before this release, which carry no recorded paid amount,
have it backfilled from the billed amount on upgrade. Without this, correcting
a fee category would move the substituted value along with the billed amount
and a needed refund would never be detected.
* CSV export gains paid amount, refund, surcharge, net paid, difference and handover-
note columns, and no longer quotes plain numbers so they open as numbers in Excel.
* Payment confirmation emails now show the billed amount and the amount received
side by side.
* Database schema auto-upgrades to v3.2.0.
* Updated the bundled Japanese translation for the new strings.
#### 1.1.8
* Improve: email verification (OTP) and My Page login-code emails now include the
sender site name, purpose, and a contact footer (taken from your site settings)
instead of a bare code. This reduces the chance of the message being flagged
as phishing and rejected or spam-foldered by strict mail providers (e.g. Yahoo!
Japan).
#### 1.1.7
* Fix: editing and saving a member who has no member number no longer fails with“
Failed to update member.” Previously, when two or more members had no member
number, saving the second such member triggered a unique-key conflict on an empty
member number. Empty member numbers are now stored as NULL (consistent with member
creation), so any number of members can be saved without a member number.
* Members: added a little more spacing between each field label and the control
above it in the New/Edit Member dialog for easier reading.
#### 1.1.6
* Receipts: participants can now edit the addressee name and company/department
of their receipt from My Page and have the PDF reissued under the same receipt
number (so only one valid receipt ever exists). Useful when payment was made
under a company, workplace or family name. Ownership is verified before editing,
and the proviso text is unchanged.
* Registrations: added an optional bank-transfer name note field, so a participant
paying by bank transfer under a different account name (for example a company
or family member) can tell the organizer the name the transfer will arrive under.
It is shown to administrators on the Participants and Payments screens and is
never printed on the receipt.
* Updated the bundled Japanese translation for the new strings.
#### 1.1.5
* Notifications: the recipient for the new-registration admin notice is now configurable
on the Setup screen. You can enter one or more addresses (comma-separated); leaving
it blank falls back to the WordPress admin email. The notice is enabled by default
and includes a link to the admin dashboard while keeping personal contact details
out of the email body.
* Participants: administrators can now correct a registration’s fee category and
on-site/online participation type from the Participants screen. The fee, tax,
label and status are recalculated automatically; a pending payment amount and
any issued invoice are kept in sync. Editing is limited to unpaid (pending/confirmed)
individual registrations.
* Fix: the admin screen no longer goes blank when publishing a newly created event(
and similar actions). A display-error boundary now recovers gracefully with a
reload prompt instead of a white screen.
* Updated the bundled Japanese translation for the new strings.
#### 1.1.4
* Free events: registrations whose total is ¥0 are now confirmed automatically (
no payment record is created, and the confirmation email omits the bank-transfer
details). Applies to both individual and group registrations.
* Event editor: fee fields now accept and keep a value of 0 (previously 0 was cleared
to blank), with a placeholder and a note clarifying that blank or 0 means free.
Added a delete button for custom fee types in the on-site fee table.
* Safety: uninstall now keeps your data by default, and a duplicate-load guard
prevents fatal errors when an older copy of the plugin remains installed in another
folder.
#### 1.1.3
* Internationalization: the plugin source language is now English. All user-facing
strings in the PHP backend and the React admin/registration screens use English
source text with `__()`/`_e()` and the `conferencemanager` text domain, so the
plugin can be translated into any language via translate.wordpress.org. The bundled
Japanese translation (`languages/conferencemanager-ja.po`/`.mo` and the React
translation JSON) provides the complete Japanese UI as before.
#### 1.1.2
* Plugin Review feedback response (from the v1.1.1 submission):
- Trialware: removed all online-meeting (Zoom/Meet/Teams) and Peatix integration
fields from the core plugin (database columns, admin UI, REST handling and
documentation). These belong to separately distributed add-ons; the core plugin
no longer ships any locked or skipped feature code. On-site/online participation
fee tiers remain fully functional.
- Third-party libraries: removed the unused `chillerlan/php-qrcode` and `web-
auth/webauthn-lib` dependencies (passkey support is implemented with native
PHP), updated `stripe/stripe-php` to 20.2.0, and updated the bundled `setasign/
fpdi` to 2.6.7 (security advisory CVE-2026-45802).
- Writable data location: downloaded/uploaded PDF fonts are now stored under`
wp-content/uploads/conf-manager/fonts/` instead of inside the plugin folder,
so plugin updates and read-only installs are unaffected.
- REST API: the public fee-calculation endpoint (`/public/events/{id}/fee`)
now returns 404 for non-published events, matching the event-detail endpoint,
so unpublished pricing is never exposed.
#### 1.1.1
* Plugin Review feedback response (from the v1.1.0 submission):
- Source code: the React/JSX source for the compiled `build/admin-app.js` and`
build/public-app.js` bundles is now shipped inside the plugin (`src/`), together
with the build configuration (`webpack.config.js`, `package.json`, `package-
lock.json`). See the new “Development / Building from source” section.
- Core files: moved `require_once ABSPATH . 'wp-admin/includes/file.php'` so
it immediately precedes the `download_url()` / `wp_handle_upload()` call that
needs it.
- REST API: token-authenticated public endpoints (MyPage, my registrations,
group staff, email preferences, logout) now validate the CSRF token and session
token in their `permission_callback`.
- Privacy: the public email-based member existence check no longer returns any
personal data (name); it returns only an existence flag and non-identifying
metadata, protected by combined IP + email rate limiting.
- Removed HEREDOC syntax: the default Terms-of-Service content is now rendered
from a template partial via output buffering (`templates/default-terms-content.
php`).
* Fix: The “fonts not installed” admin notice linked to the wrong page slug, causing
a “you do not have permission” error; it now opens the Dashboard correctly.
* Improvement: PDF fonts (IPAex Gothic / Mincho) are now downloaded from the plugin
author’s own mirror (with automatic retry), and a manual `.ttf` upload option
was added to the Dashboard for servers that cannot reach the download host. The
download URL is filterable via `conf_manager_font_source_url`.
#### 1.1.0
* Plugin Review feedback response (from the initial v1.0.3 submission):
- Removed optional paid add-on gating; all features included in this plugin
are fully functional and free.
- Removed inline `