NMR Strava activities
Explore NMR Strava activities vulnerabilities across all versions. Currently tracking 2 known vulnerabilities, including severity, impact, and patch status.
Vulnerability Records

NMR Strava activities
Author
mirceatm
NMR Strava activities imports athlete activities into your WordPress site as soon as Strava records them—no slow polling. Data is stored locally; developers can react with actions and filters for custom workflows, leaderboards, or integrations. Why webhooks? Strava can notify your site when an activity is created or deleted. This plugin subscribes to those events, then fetches full activity details with OAuth and saves them to custom database tables. You will need: A Strava API application (Client ID and Client Secret) A page or post containing the [strava_nmr] shortcode; its URL must match Redirect URI in both Strava and this plugin’s settings Configure the plugin: WordPress admin → Settings → Strava NMR Strava client id — from your Strava API application Strava client secret — from your Strava API application Redirect URI — full URL of the page/post where [strava_nmr] appears (must match Strava’s Authorization Callback Domain / redirect settings) Webhook callback url — filled automatically; should look like https://yoursite.com/wp-admin/admin-ajax.php?action=nmr-strava-callback& (keep the trailing & if your copy includes it) Verify token — a secret string you choose; used when Strava validates your webhook subscription After saving, use Activate Strava Webhook. On success, Plugin status shows something like: Strava webhook subscription id = 109463. Data and privacy Activities and tokens are stored in your WordPress database. See Privacy Notices below. For GDPR or similar obligations, ensure your site policy explains this processing. Developer hooks When an activity is saved or removed, other code can listen: do_action('strava_nmr_activity_changed', 'update', $activity_data); do_action('strava_nmr_activity_changed', 'delete', $payload); Filter which activities are saved using the activity type (single string, e.g. Run): function nmr_example_save_only_runs( $activity_type ) { if ( strcasecmp( 'Run', $activity_type ) === 0 || strcasecmp( 'VirtualRun', $activity_type ) === 0 ) { return $activity_type; } return false; } add_filter( 'nmr_strava_save_activity', 'nmr_example_save_only_runs' ); Filter using the full Strava activity array (return false to skip import): add_filter( 'nmr_strava_save_activity_full', function ( $activity ) { if ( ! empty( $activity['manual'] ) ) { return false; } return $activity; } ); Supported Strava activity types include: AlpineSki, BackcountrySki, Canoeing, Crossfit, EBikeRide, Elliptical, Golf, Handcycle, Hike, IceSkate, InlineSkate, Kayaking, Kitesurf, NordicSki, Ride, RockClimbing, RollerSki, Rowing, Run, Sail, Skateboard, Snowboard, Snowshoe, Soccer, StairStepper, StandUpPaddling, Surfing, Swim, Velomobile, VirtualRide, VirtualRun, Walk, WeightTraining, Wheelchair, Windsurf, Workout, Yoga. Shortcodes [strava_nmr] — OAuth connect flow (optional attributes for labels and require_login) [strava_nmr_connect] / [strava_nmr_disconnect] — logged-in connect/disconnect UI [strava_nmr_table top="100"] — simple HTML table of stored activities (default limit 100) Official listing Install from WordPress.org/plugins/nmr-strava-activities. More info: Plugin URI. If this plugin saves you time, consider making a donation. Privacy Notices This plugin stores data received from Strava—which may include personal information—in your site’s database. You are responsible for describing this in your privacy policy and for any consent or legal basis required in your jurisdiction.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C