WP Beacon

Syed Balkhi

@smub · wordpress.org profile ↗
Member since
2008-06-22
Location
—
Employer
—
Job title
—
Authored
111 (13 closed)
SVN commit access
11 (1 closed)
Readme contributor
31
Combined install base
24.8M+ across 142 plugins

Alerts (1)

Medium code_scan_delta Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More 11d ago
Slugduplicator
Previous version1.5.17
Current version5.0.0
New findings
PatternKindFileLineSnippetConfidence
gzinflatebuiltinvendor-prefixed/rmccue/requests/src/Requests.php831$decoded = @gzinflate($data);medium
gzinflatebuiltinvendor-prefixed/rmccue/requests/src/Requests.php920$decompressed = @gzinflate(substr($gz_data, 2));medium
gzinflatebuiltinvendor-prefixed/rmccue/requests/src/Requests.php944$decompressed = @gzinflate(substr($gz_data, 30 + $first_file_start));medium
gzinflatebuiltinvendor-prefixed/rmccue/requests/src/Requests.php951$decompressed = @gzinflate($gz_data);medium
gzinflatebuiltinvendor-prefixed/rmccue/requests/src/Requests.php957$decompressed = @gzinflate(substr($gz_data, 2));medium
base64_decodebuiltinaddons/litebase/src/Settings/ConnectController.php258$cipherBin = base64_decode($encrypted, true);medium
base64_decodebuiltinaddons/litelegacyaddon/src/Models/LegacyBackupMigration.php337if (!is_string($installer['OptsSecurePass']) || ($password = base64_decode($installer['OptsSecurePass'], true)) === false) {medium
base64_decodebuiltinsrc/Package/Create/PackInstaller.php182$this->passowrd = base64_decode($this->OptsSecurePass);medium
base64_decodebuiltinsrc/Utils/Crypt/CryptBlowfish.php260$decoded = base64_decode($string);medium
base64_decodebuiltinsrc/Utils/Crypt/CryptBlowfish.php293$decoded = base64_decode($string);medium
base64_decodebuiltinsrc/Libs/Snap/SnapServer.php290$decoded = base64_decode($parts[1], true);medium
gzinflatebuiltinsrc/Libs/DupArchive/Headers/DupArchiveGlobHeader.php166if (($result = @gzinflate($result)) === false) {medium
base64_decodebuiltininstaller/dup-installer/api/class.cpnl.ctrl.php78$creds = explode(",", base64_decode($token));medium
New finding count13
View raw JSON
{
    "slug": "duplicator",
    "previous_version": "1.5.17",
    "current_version": "5.0.0",
    "new_findings": [
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "vendor-prefixed/rmccue/requests/src/Requests.php",
            "line": 831,
            "snippet": "$decoded = @gzinflate($data);",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "vendor-prefixed/rmccue/requests/src/Requests.php",
            "line": 920,
            "snippet": "$decompressed = @gzinflate(substr($gz_data, 2));",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "vendor-prefixed/rmccue/requests/src/Requests.php",
            "line": 944,
            "snippet": "$decompressed = @gzinflate(substr($gz_data, 30 + $first_file_start));",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "vendor-prefixed/rmccue/requests/src/Requests.php",
            "line": 951,
            "snippet": "$decompressed = @gzinflate($gz_data);",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "vendor-prefixed/rmccue/requests/src/Requests.php",
            "line": 957,
            "snippet": "$decompressed = @gzinflate(substr($gz_data, 2));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "addons/litebase/src/Settings/ConnectController.php",
            "line": 258,
            "snippet": "$cipherBin = base64_decode($encrypted, true);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "addons/litelegacyaddon/src/Models/LegacyBackupMigration.php",
            "line": 337,
            "snippet": "if (!is_string($installer['OptsSecurePass']) || ($password = base64_decode($installer['OptsSecurePass'], true)) === false) {",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Package/Create/PackInstaller.php",
            "line": 182,
            "snippet": "$this->passowrd = base64_decode($this->OptsSecurePass);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Utils/Crypt/CryptBlowfish.php",
            "line": 260,
            "snippet": "$decoded = base64_decode($string);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Utils/Crypt/CryptBlowfish.php",
            "line": 293,
            "snippet": "$decoded = base64_decode($string);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Libs/Snap/SnapServer.php",
            "line": 290,
            "snippet": "$decoded = base64_decode($parts[1], true);",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "src/Libs/DupArchive/Headers/DupArchiveGlobHeader.php",
            "line": 166,
            "snippet": "if (($result = @gzinflate($result)) === false) {",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "installer/dup-installer/api/class.cpnl.ctrl.php",
            "line": 78,
            "snippet": "$creds = explode(\",\", base64_decode($token));",
            "confidence": "medium"
        }
    ],
    "new_finding_count": 13
}
Show 49 resolved alerts
Critical code_scan_match Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More Resolved · code_scan_fp_class_genre_encoding 4mo ago
Slugduplicator
Finding count7
Findings
PatternKindFileLineSnippetConfidence
base64_decodebuiltinclasses/utilities/class.u.php476return base64_decode($string);medium
base64_decodebuiltinsrc/Ajax/ServicesEducation.php217$encrypted = base64_decode($encryptedData);medium
gzinflatebuiltinsrc/Libs/DupArchive/Headers/DupArchiveReaderGlobHeader.php86return ($isCompressed ? gzinflate($globContents) : $globContents);medium
gzinflatebuiltinsrc/Libs/DupArchive/DupArchiveExpandBasicEngine.php252$globContents = gzinflate($globContents);medium
serialized_admin_rolebuiltininstaller/dup-installer/classes/config/class.conf.wp.php22const ADMIN_SERIALIZED_SECURITY_STRING = 'a:1:{s:13:"administrator";b:1;}';high
base64_decodebuiltininstaller/dup-installer/classes/class.crypt.php33$string = base64_decode($string);medium
base64_decodebuiltininstaller/dup-installer/classes/utilities/class.u.php1,391$decoded = base64_decode($str, true);medium
Resolved sha61a8ed704b64de3d0352e7c5f37648612842cfdf
View raw JSON
{
    "slug": "duplicator",
    "finding_count": 7,
    "findings": [
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "classes/utilities/class.u.php",
            "line": 476,
            "snippet": "return base64_decode($string);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Ajax/ServicesEducation.php",
            "line": 217,
            "snippet": "$encrypted = base64_decode($encryptedData);",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "src/Libs/DupArchive/Headers/DupArchiveReaderGlobHeader.php",
            "line": 86,
            "snippet": "return ($isCompressed ? gzinflate($globContents) : $globContents);",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "src/Libs/DupArchive/DupArchiveExpandBasicEngine.php",
            "line": 252,
            "snippet": "$globContents = gzinflate($globContents);",
            "confidence": "medium"
        },
        {
            "pattern": "serialized_admin_role",
            "kind": "builtin",
            "file": "installer/dup-installer/classes/config/class.conf.wp.php",
            "line": 22,
            "snippet": "const ADMIN_SERIALIZED_SECURITY_STRING = 'a:1:{s:13:\"administrator\";b:1;}';",
            "confidence": "high"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "installer/dup-installer/classes/class.crypt.php",
            "line": 33,
            "snippet": "$string = base64_decode($string);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "installer/dup-installer/classes/utilities/class.u.php",
            "line": 1391,
            "snippet": "$decoded = base64_decode($str, true);",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "61a8ed704b64de3d0352e7c5f37648612842cfdf"
}
Critical code_pattern Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More Resolved · false_positive_defensive_string_check 4mo ago
Slugduplicator
Patternserialized_admin_role
Kindbuiltin
Version1.5.16
Hit count1
First hit
File
installer/dup-installer/classes/config/class.conf.wp.php
Line
22
Snippet
const ADMIN_SERIALIZED_SECURITY_STRING = 'a:1:{s:13:"administrator";b:1;}';
Explanationplugin source contains `s:13:"administrator"` — the PHP-serialized representation of the `administrator` role meta value. Used to bypass `wp_insert_user()` by writing directly to `wp_usermeta` with a hand-crafted capabilities string. Near-zero FP because legit code uses `WP_User::set_role()` instead of building the serialized form by hand.
View raw JSON
{
    "slug": "duplicator",
    "pattern": "serialized_admin_role",
    "kind": "builtin",
    "version": "1.5.16",
    "hit_count": 1,
    "first_hit": {
        "file": "installer/dup-installer/classes/config/class.conf.wp.php",
        "line": 22,
        "snippet": "const ADMIN_SERIALIZED_SECURITY_STRING = 'a:1:{s:13:\"administrator\";b:1;}';"
    },
    "explanation": "plugin source contains `s:13:\"administrator\"` \u2014 the PHP-serialized representation of the `administrator` role meta value. Used to bypass `wp_insert_user()` by writing directly to `wp_usermeta` with a hand-crafted capabilities string. Near-zero FP because legit code uses `WP_User::set_role()` instead of building the serialized form by hand."
}
Critical code_scan_delta Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More Resolved · false_positive_cdn_known_good 4mo ago
Slugduplicator
Previous version1.5.16
Current version1.5.16
New findings
PatternKindFileLineSnippetConfidence
serialized_admin_rolebuiltininstaller/dup-installer/classes/config/class.conf.wp.php22const ADMIN_SERIALIZED_SECURITY_STRING = 'a:1:{s:13:"administrator";b:1;}';high
New finding count1
View raw JSON
{
    "slug": "duplicator",
    "previous_version": "1.5.16",
    "current_version": "1.5.16",
    "new_findings": [
        {
            "pattern": "serialized_admin_role",
            "kind": "builtin",
            "file": "installer/dup-installer/classes/config/class.conf.wp.php",
            "line": 22,
            "snippet": "const ADMIN_SERIALIZED_SECURITY_STRING = 'a:1:{s:13:\"administrator\";b:1;}';",
            "confidence": "high"
        }
    ],
    "new_finding_count": 1
}
Critical code_pattern ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) Resolved · no_longer_matches 4mo ago
Sluggoogle-analytics-dashboard-for-wp
Patternunserialize_after_remote_call
Kindbuiltin
Version9.1.3
Hit count2
First hit
File
includes/gutenberg/headline-tool/phpinsight/lib/PHPInsight/Sentiment.php
Line
230
Snippet
L229: $temp = file_get_contents( $fn ); → L230: $words = unserialize( trim( $temp ) );
Explanationa remote HTTP fetch (`wp_remote_*`/`curl_exec`/`file_get_contents`) is followed by `@unserialize` within the same file — classic PHP Object Injection C2 gadget used by EP and most WP supply-chain backdoors. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak.
View raw JSON
{
    "slug": "google-analytics-dashboard-for-wp",
    "pattern": "unserialize_after_remote_call",
    "kind": "builtin",
    "version": "9.1.3",
    "hit_count": 2,
    "first_hit": {
        "file": "includes/gutenberg/headline-tool/phpinsight/lib/PHPInsight/Sentiment.php",
        "line": 230,
        "snippet": "L229: $temp  = file_get_contents( $fn );  \u2192  L230: $words = unserialize( trim( $temp ) );"
    },
    "explanation": "a remote HTTP fetch (`wp_remote_*`/`curl_exec`/`file_get_contents`) is followed by `@unserialize` within the same file \u2014 classic PHP Object Injection C2 gadget used by EP and most WP supply-chain backdoors. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak."
}
Critical code_scan_delta ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) Resolved · fp_vendored_library_local_cache 4mo ago
Sluggoogle-analytics-dashboard-for-wp
Previous version9.1.3
Current version9.1.3
New findings
PatternKindFileLineSnippetConfidence
unserialize_after_remote_callbuiltinincludes/gutenberg/headline-tool/phpinsight/lib/PHPInsight/Sentiment.php230L229: $temp = file_get_contents( $fn ); → L230: $words = unserialize( trim( $temp ) );high
unserialize_after_remote_callbuiltinincludes/gutenberg/headline-tool/phpinsight/lib/PHPInsight/Sentiment.php360L359: $temp = file_get_contents( $fn ); → L360: $words = unserialize( trim( $temp ) );high
New finding count2
View raw JSON
{
    "slug": "google-analytics-dashboard-for-wp",
    "previous_version": "9.1.3",
    "current_version": "9.1.3",
    "new_findings": [
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "includes/gutenberg/headline-tool/phpinsight/lib/PHPInsight/Sentiment.php",
            "line": 230,
            "snippet": "L229: $temp  = file_get_contents( $fn );  \u2192  L230: $words = unserialize( trim( $temp ) );",
            "confidence": "high"
        },
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "includes/gutenberg/headline-tool/phpinsight/lib/PHPInsight/Sentiment.php",
            "line": 360,
            "snippet": "L359: $temp  = file_get_contents( $fn );  \u2192  L360: $words = unserialize( trim( $temp ) );",
            "confidence": "high"
        }
    ],
    "new_finding_count": 2
}
Critical code_pattern WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More Resolved · no_longer_matches 4mo ago
Slugwpforms-lite
Patternunserialize_after_remote_call
Kindbuiltin
Version1.10.0.4
Hit count3
First hit
File
vendor_prefixed/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCache/Serializer.php
Line
71
Snippet
L71: return \unserialize(\file_get_contents($file)); → L71: return \unserialize(\file_get_contents($file));
Explanationa remote HTTP fetch (`wp_remote_*`/`curl_exec`) is followed by `unserialize`/`maybe_unserialize` within the same file — classic PHP Object Injection C2 gadget used by EP and most WP supply-chain backdoors. Legit plugins essentially never do this.
View raw JSON
{
    "slug": "wpforms-lite",
    "pattern": "unserialize_after_remote_call",
    "kind": "builtin",
    "version": "1.10.0.4",
    "hit_count": 3,
    "first_hit": {
        "file": "vendor_prefixed/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCache/Serializer.php",
        "line": 71,
        "snippet": "L71: return \\unserialize(\\file_get_contents($file));  \u2192  L71: return \\unserialize(\\file_get_contents($file));"
    },
    "explanation": "a remote HTTP fetch (`wp_remote_*`/`curl_exec`) is followed by `unserialize`/`maybe_unserialize` within the same file \u2014 classic PHP Object Injection C2 gadget used by EP and most WP supply-chain backdoors. Legit plugins essentially never do this."
}
Critical code_scan_delta WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More Resolved · fp_vendored_library_local_cache 4mo ago
Slugwpforms-lite
Previous version1.10.0.4
Current version1.10.0.4
New findings
PatternKindFileLineSnippetConfidence
unserialize_after_remote_callbuiltinvendor_prefixed/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCache/Serializer.php71L71: return \unserialize(\file_get_contents($file)); → L71: return \unserialize(\file_get_contents($file));high
unserialize_after_remote_callbuiltinvendor_prefixed/ezyang/htmlpurifier/library/HTMLPurifier/ConfigSchema.php69L68: $contents = \file_get_contents(\WPForms\Vendor\HTMLPURIFIER_PREFIX . '/HTMLPurifie → L69: $r = \unserialize($contents);high
unserialize_after_remote_callbuiltinvendor_prefixed/ezyang/htmlpurifier/library/HTMLPurifier/EntityLookup.php27L27: $this->table = \unserialize(\file_get_contents($file)); → L27: $this->table = \unserialize(\file_get_contents($file));high
New finding count3
View raw JSON
{
    "slug": "wpforms-lite",
    "previous_version": "1.10.0.4",
    "current_version": "1.10.0.4",
    "new_findings": [
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "vendor_prefixed/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCache/Serializer.php",
            "line": 71,
            "snippet": "L71: return \\unserialize(\\file_get_contents($file));  \u2192  L71: return \\unserialize(\\file_get_contents($file));",
            "confidence": "high"
        },
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "vendor_prefixed/ezyang/htmlpurifier/library/HTMLPurifier/ConfigSchema.php",
            "line": 69,
            "snippet": "L68: $contents = \\file_get_contents(\\WPForms\\Vendor\\HTMLPURIFIER_PREFIX . '/HTMLPurifie  \u2192  L69: $r = \\unserialize($contents);",
            "confidence": "high"
        },
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "vendor_prefixed/ezyang/htmlpurifier/library/HTMLPurifier/EntityLookup.php",
            "line": 27,
            "snippet": "L27: $this->table = \\unserialize(\\file_get_contents($file));  \u2192  L27: $this->table = \\unserialize(\\file_get_contents($file));",
            "confidence": "high"
        }
    ],
    "new_finding_count": 3
}
Critical domain_younger_than_plugin Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more Resolved · no_longer_matches 4mo ago
Slugeasy-wp-smtp
Domaineasywpsmtpapi.com
Domain sourcec2_http_call
Domain registered at2024-10-01
Plugin earliest commit2013-04-16 18:52:05
Plugin latest release2026-04-01 13:24:50
Gap days4,185
Domain age at release547
Active installs500,000
View raw JSON
{
    "slug": "easy-wp-smtp",
    "domain": "easywpsmtpapi.com",
    "domain_source": "c2_http_call",
    "domain_registered_at": "2024-10-01",
    "plugin_earliest_commit": "2013-04-16 18:52:05",
    "plugin_latest_release": "2026-04-01 13:24:50",
    "gap_days": 4185,
    "domain_age_at_release": 547,
    "active_installs": 500000
}
Critical domain_younger_than_plugin ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) Resolved · no_longer_matches 4mo ago
Sluggoogle-analytics-dashboard-for-wp
Domainexactmetrics-translations.com
Domain sourcec2_http_call
Domain registered at2025-01-06
Plugin earliest commit2014-07-09 06:06:05
Plugin latest release2026-04-22 16:28:26
Gap days3,833
Domain age at release471
Active installs300,000
View raw JSON
{
    "slug": "google-analytics-dashboard-for-wp",
    "domain": "exactmetrics-translations.com",
    "domain_source": "c2_http_call",
    "domain_registered_at": "2025-01-06",
    "plugin_earliest_commit": "2014-07-09 06:06:05",
    "plugin_latest_release": "2026-04-22 16:28:26",
    "gap_days": 3833,
    "domain_age_at_release": 471,
    "active_installs": 300000
}
Critical new_committer_young_account UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds Resolved · no_longer_matches 5mo ago
Sluguserfeedback-lite
Committerdpaternina
Display nameDavid Paternina
Member since2024-06-28
First commit at2024-07-02 15:03:31
Account age at first commit4
Commit count22
Active installs200,000
View raw JSON
{
    "slug": "userfeedback-lite",
    "committer": "dpaternina",
    "display_name": "David Paternina",
    "member_since": "2024-06-28",
    "first_commit_at": "2024-07-02 15:03:31",
    "account_age_at_first_commit": 4,
    "commit_count": 22,
    "active_installs": 200000
}
Critical new_committer_young_account UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds Resolved · deduped 5mo ago
Sluguserfeedback-lite
Committerdpaternina
Display nameDavid Paternina
Member since2024-06-28
First commit at2024-07-02 15:03:31
Account age at first commit4
Commit count22
Active installs200,000
View raw JSON
{
    "slug": "userfeedback-lite",
    "committer": "dpaternina",
    "display_name": "David Paternina",
    "member_since": "2024-06-28",
    "first_commit_at": "2024-07-02 15:03:31",
    "account_age_at_first_commit": 4,
    "commit_count": 22,
    "active_installs": 200000
}
High code_scan_match Contact Form & SMTP Plugin for WordPress by PirateForms Resolved · code_scan_fp_class_vendor_cdn_enqueue 4mo ago
Slugpirate-forms
Finding count2
Findings
PatternKindFileLineSnippetConfidenceDetails
remote_enqueuebuiltinpublic/class-pirateforms-public.php137wp_register_script( 'google-recaptcha', 'https://www.google.com/recaptcha/api.js?hl=' . $pirate_forms_contactus_language, [ 'jquery' ], $this->version, true );medium
Url
https://www.google.com/recaptcha/api.js?hl=
Url host
www.google.com
remote_enqueuebuiltingutenberg/class-pirateforms-gutenberg.php106wp_enqueue_script( 'recaptcha', "https://www.google.com/recaptcha/api.js?hl=$language", [], $this->version, true );medium
Url
https://www.google.com/recaptcha/api.js?hl=$language
Url host
www.google.com
Resolved shad709db8dd42160bf9b69fa2cef1ffd2624fc3d8c
View raw JSON
{
    "slug": "pirate-forms",
    "finding_count": 2,
    "findings": [
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "public/class-pirateforms-public.php",
            "line": 137,
            "snippet": "wp_register_script( 'google-recaptcha', 'https://www.google.com/recaptcha/api.js?hl=' . $pirate_forms_contactus_language, [ 'jquery' ], $this->version, true );",
            "confidence": "medium",
            "details": {
                "url": "https://www.google.com/recaptcha/api.js?hl=",
                "url_host": "www.google.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "gutenberg/class-pirateforms-gutenberg.php",
            "line": 106,
            "snippet": "wp_enqueue_script( 'recaptcha', \"https://www.google.com/recaptcha/api.js?hl=$language\", [], $this->version, true );",
            "confidence": "medium",
            "details": {
                "url": "https://www.google.com/recaptcha/api.js?hl=$language",
                "url_host": "www.google.com"
            }
        }
    ],
    "resolved_sha": "d709db8dd42160bf9b69fa2cef1ffd2624fc3d8c"
}
High code_scan_match WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager Resolved · code_scan_fp_class_vendor_cdn_enqueue 4mo ago
Sluginsert-headers-and-footers
Finding count4
Findings
PatternKindFileLineSnippetConfidence
remote_enqueuebuiltinincludes/generator/class-wpcode-generator-style.php280$enqueue = 'true' === $styles_enqueue[ $key ] ? "wp_enqueue_style( '$style' );" : '';medium
remote_enqueuebuiltinincludes/generator/class-wpcode-generator-style.php285wp_register_style( '$style', '$styles_urls[$key]', {$this->array_to_code_string($dependencies)}, '$styles_versions[$key]'$media );medium
remote_enqueuebuiltinincludes/generator/class-wpcode-generator-script.php279$enqueue = 'true' === $scripts_enqueue[ $key ] ? "wp_enqueue_script( '$script_name' );" : '';medium
remote_enqueuebuiltinincludes/generator/class-wpcode-generator-script.php283wp_register_script( '$script_name', '$scripts_urls[$key]', {$this->array_to_code_string($dependencies)}, '$scripts_versions[$key]', $scripts_locations[$key] );medium
Resolved shace01147183d9a621f4f1d3b4cd7d4447fd5f1257
View raw JSON
{
    "slug": "insert-headers-and-footers",
    "finding_count": 4,
    "findings": [
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "includes/generator/class-wpcode-generator-style.php",
            "line": 280,
            "snippet": "$enqueue      = 'true' === $styles_enqueue[ $key ] ? \"wp_enqueue_style( '$style' );\" : '';",
            "confidence": "medium"
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "includes/generator/class-wpcode-generator-style.php",
            "line": 285,
            "snippet": "wp_register_style( '$style', '$styles_urls[$key]', {$this->array_to_code_string($dependencies)}, '$styles_versions[$key]'$media );",
            "confidence": "medium"
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "includes/generator/class-wpcode-generator-script.php",
            "line": 279,
            "snippet": "$enqueue      = 'true' === $scripts_enqueue[ $key ] ? \"wp_enqueue_script( '$script_name' );\" : '';",
            "confidence": "medium"
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "includes/generator/class-wpcode-generator-script.php",
            "line": 283,
            "snippet": "wp_register_script( '$script_name', '$scripts_urls[$key]', {$this->array_to_code_string($dependencies)}, '$scripts_versions[$key]', $scripts_locations[$key] );",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "ce01147183d9a621f4f1d3b4cd7d4447fd5f1257"
}
High bulk_committer_takeover All in One SEO Pack Importer Resolved · benign_plugin_creation 4mo ago
Committerpbaylies
Member since2011-05-02
Plugins joined5
Spread days0
Earliest join2012-12-13 16:30:54
Latest join2012-12-13 20:20:30
Combined installs800
Sample plugins
SlugActive installsFirst commit at
all-in-one-seo-pack-importer5002012-12-13 19:52:52
display-name-author-permalink2002012-12-13 20:09:12
ft-calendar1002012-12-13 18:59:36
moderate-selected-posts02012-12-13 20:20:30
simplemap02012-12-13 16:30:54
Triage note 2026 05 03Peter Baylies (Purcado dev), 2012 oldtimer cohort. All 5 plugins committed same day = original portfolio publication on wp.org account creation.
View raw JSON
{
    "committer": "pbaylies",
    "member_since": "2011-05-02",
    "plugins_joined": 5,
    "spread_days": 0,
    "earliest_join": "2012-12-13 16:30:54",
    "latest_join": "2012-12-13 20:20:30",
    "combined_installs": 800,
    "sample_plugins": [
        {
            "slug": "all-in-one-seo-pack-importer",
            "active_installs": 500,
            "first_commit_at": "2012-12-13 19:52:52"
        },
        {
            "slug": "display-name-author-permalink",
            "active_installs": 200,
            "first_commit_at": "2012-12-13 20:09:12"
        },
        {
            "slug": "ft-calendar",
            "active_installs": 100,
            "first_commit_at": "2012-12-13 18:59:36"
        },
        {
            "slug": "moderate-selected-posts",
            "active_installs": 0,
            "first_commit_at": "2012-12-13 20:20:30"
        },
        {
            "slug": "simplemap",
            "active_installs": 0,
            "first_commit_at": "2012-12-13 16:30:54"
        }
    ],
    "triage_note_2026_05_03": "Peter Baylies (Purcado dev), 2012 oldtimer cohort. All 5 plugins committed same day = original portfolio publication on wp.org account creation."
}
High code_scan_delta Sugar Calendar – Events Calendar, Event Tickets, and Events Management Platform Resolved · false_positive_cdn_known_good 4mo ago
Slugsugar-calendar-lite
Previous version3.11.0
Current version3.11.0
New findings
PatternKindFileLineSnippetConfidence
remote_enqueuebuiltinincludes/admin/assets.php46wp_register_script( 'sugar_calendar_admin_calendar', "{$url}js/sc-calendar.js", $dialog, $ver, false );medium
remote_enqueuebuiltinincludes/admin/assets.php52wp_register_script( 'sugar_calendar_admin_taxonomy', "{$url}js/sc-taxonomy.js", $dialog, $ver, false );medium
remote_enqueuebuiltinincludes/admin/assets.php67wp_register_style( 'sugar_calendar_admin_calendar', "{$url}css/{$path}sc-calendar.css", $deps, $ver, 'all' );medium
remote_enqueuebuiltinincludes/admin/assets.php68wp_register_style( 'sugar_calendar_admin_datepicker', "{$url}css/{$path}sc-datepicker.css", $deps, $ver, 'all' );medium
remote_enqueuebuiltinincludes/admin/assets.php74wp_register_style( 'sugar_calendar_admin_taxonomy', "{$url}css/{$path}sc-taxonomy.css", $wpui, $ver, 'all' );medium
New finding count5
View raw JSON
{
    "slug": "sugar-calendar-lite",
    "previous_version": "3.11.0",
    "current_version": "3.11.0",
    "new_findings": [
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "includes/admin/assets.php",
            "line": 46,
            "snippet": "wp_register_script( 'sugar_calendar_admin_calendar', \"{$url}js/sc-calendar.js\", $dialog, $ver, false );",
            "confidence": "medium"
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "includes/admin/assets.php",
            "line": 52,
            "snippet": "wp_register_script( 'sugar_calendar_admin_taxonomy', \"{$url}js/sc-taxonomy.js\", $dialog, $ver, false );",
            "confidence": "medium"
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "includes/admin/assets.php",
            "line": 67,
            "snippet": "wp_register_style( 'sugar_calendar_admin_calendar', \"{$url}css/{$path}sc-calendar.css\", $deps, $ver, 'all' );",
            "confidence": "medium"
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "includes/admin/assets.php",
            "line": 68,
            "snippet": "wp_register_style( 'sugar_calendar_admin_datepicker', \"{$url}css/{$path}sc-datepicker.css\", $deps, $ver, 'all' );",
            "confidence": "medium"
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "includes/admin/assets.php",
            "line": 74,
            "snippet": "wp_register_style( 'sugar_calendar_admin_taxonomy', \"{$url}css/{$path}sc-taxonomy.css\", $wpui, $ver, 'all' );",
            "confidence": "medium"
        }
    ],
    "new_finding_count": 5
}
High code_scan_delta Contact Form & SMTP Plugin for WordPress by PirateForms Resolved · false_positive_cdn_known_good 4mo ago
Slugpirate-forms
Previous version2.6.1
Current version2.6.1
New findings
PatternKindFileLineSnippetConfidenceDetails
remote_enqueuebuiltinpublic/class-pirateforms-public.php137wp_register_script( 'google-recaptcha', 'https://www.google.com/recaptcha/api.js?hl=' . $pirate_forms_contactus_language, [ 'jquery' ], $this->version, true );medium
Url
https://www.google.com/recaptcha/api.js?hl=
Url host
www.google.com
New finding count1
View raw JSON
{
    "slug": "pirate-forms",
    "previous_version": "2.6.1",
    "current_version": "2.6.1",
    "new_findings": [
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "public/class-pirateforms-public.php",
            "line": 137,
            "snippet": "wp_register_script( 'google-recaptcha', 'https://www.google.com/recaptcha/api.js?hl=' . $pirate_forms_contactus_language, [ 'jquery' ], $this->version, true );",
            "confidence": "medium",
            "details": {
                "url": "https://www.google.com/recaptcha/api.js?hl=",
                "url_host": "www.google.com"
            }
        }
    ],
    "new_finding_count": 1
}
High code_scan_delta WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager Resolved · false_positive_cdn_known_good 4mo ago
Sluginsert-headers-and-footers
Previous version2.3.5
Current version2.3.5
New findings
PatternKindFileLineSnippetConfidence
remote_enqueuebuiltinincludes/generator/class-wpcode-generator-style.php285wp_register_style( '$style', '$styles_urls[$key]', {$this->array_to_code_string($dependencies)}, '$styles_versions[$key]'$media );medium
remote_enqueuebuiltinincludes/generator/class-wpcode-generator-script.php283wp_register_script( '$script_name', '$scripts_urls[$key]', {$this->array_to_code_string($dependencies)}, '$scripts_versions[$key]', $scripts_locations[$key] );medium
New finding count2
View raw JSON
{
    "slug": "insert-headers-and-footers",
    "previous_version": "2.3.5",
    "current_version": "2.3.5",
    "new_findings": [
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "includes/generator/class-wpcode-generator-style.php",
            "line": 285,
            "snippet": "wp_register_style( '$style', '$styles_urls[$key]', {$this->array_to_code_string($dependencies)}, '$styles_versions[$key]'$media );",
            "confidence": "medium"
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "includes/generator/class-wpcode-generator-script.php",
            "line": 283,
            "snippet": "wp_register_script( '$script_name', '$scripts_urls[$key]', {$this->array_to_code_string($dependencies)}, '$scripts_versions[$key]', $scripts_locations[$key] );",
            "confidence": "medium"
        }
    ],
    "new_finding_count": 2
}
High committer_younger_than_plugin WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager Resolved · benign_company_employee 4mo ago
Sluginsert-headers-and-footers
Committer slugdeb255
Committer display nameDave
Committer employer—
Committer member since2017-02-28
Committer first commit2017-03-08 05:20:37
Committer commit count18
Plugin listed authorsmub
Earliest plugin commit2012-07-11 20:38:49
Plugin age at join days1,700
Committer age at join days8
Active installs3,000,000
View raw JSON
{
    "slug": "insert-headers-and-footers",
    "committer_slug": "deb255",
    "committer_display_name": "Dave",
    "committer_employer": null,
    "committer_member_since": "2017-02-28",
    "committer_first_commit": "2017-03-08 05:20:37",
    "committer_commit_count": 18,
    "plugin_listed_author": "smub",
    "earliest_plugin_commit": "2012-07-11 20:38:49",
    "plugin_age_at_join_days": 1700,
    "committer_age_at_join_days": 8,
    "active_installs": 3000000
}
High committer_younger_than_plugin Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation Resolved · benign_company_employee 4mo ago
Slugoptinmonster
Committer slugmattawesomemotive
Committer display namemattawesomemotive
Committer employer—
Committer member since2023-04-17
Committer first commit2023-07-26 20:06:51
Committer commit count44
Plugin listed authorsmub
Earliest plugin commit2015-04-23 14:13:00
Plugin age at join days3,016
Committer age at join days100
Active installs1,000,000
View raw JSON
{
    "slug": "optinmonster",
    "committer_slug": "mattawesomemotive",
    "committer_display_name": "mattawesomemotive",
    "committer_employer": null,
    "committer_member_since": "2023-04-17",
    "committer_first_commit": "2023-07-26 20:06:51",
    "committer_commit_count": 44,
    "plugin_listed_author": "smub",
    "earliest_plugin_commit": "2015-04-23 14:13:00",
    "plugin_age_at_join_days": 3016,
    "committer_age_at_join_days": 100,
    "active_installs": 1000000
}
High committer_younger_than_plugin Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more Resolved · benign_company_employee 4mo ago
Slugeasy-wp-smtp
Committer slugsixfingersam
Committer display nameIgnazio Setti
Committer employer—
Committer member since2024-09-23
Committer first commit2024-09-26 08:21:02
Committer commit count8
Plugin listed authorsmub
Earliest plugin commit2013-04-16 18:52:05
Plugin age at join days4,180
Committer age at join days3
Active installs500,000
View raw JSON
{
    "slug": "easy-wp-smtp",
    "committer_slug": "sixfingersam",
    "committer_display_name": "Ignazio Setti",
    "committer_employer": null,
    "committer_member_since": "2024-09-23",
    "committer_first_commit": "2024-09-26 08:21:02",
    "committer_commit_count": 8,
    "plugin_listed_author": "smub",
    "earliest_plugin_commit": "2013-04-16 18:52:05",
    "plugin_age_at_join_days": 4180,
    "committer_age_at_join_days": 3,
    "active_installs": 500000
}
High committer_younger_than_plugin ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) Resolved · benign_company_employee 4mo ago
Sluggoogle-analytics-dashboard-for-wp
Committer slugdpaternina
Committer display nameDavid Paternina
Committer employer—
Committer member since2024-06-28
Committer first commit2024-10-22 14:36:42
Committer commit count38
Plugin listed authorsmub
Earliest plugin commit2014-07-09 06:06:05
Plugin age at join days3,758
Committer age at join days116
Active installs300,000
View raw JSON
{
    "slug": "google-analytics-dashboard-for-wp",
    "committer_slug": "dpaternina",
    "committer_display_name": "David Paternina",
    "committer_employer": null,
    "committer_member_since": "2024-06-28",
    "committer_first_commit": "2024-10-22 14:36:42",
    "committer_commit_count": 38,
    "plugin_listed_author": "smub",
    "earliest_plugin_commit": "2014-07-09 06:06:05",
    "plugin_age_at_join_days": 3758,
    "committer_age_at_join_days": 116,
    "active_installs": 300000
}
High committer_younger_than_plugin ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) Resolved · benign_company_employee 4mo ago
Sluggoogle-analytics-dashboard-for-wp
Committer slugmicheleam
Committer display namemicheleam
Committer employer—
Committer member since2023-04-11
Committer first commit2023-04-11 16:18:34
Committer commit count33
Plugin listed authorsmub
Earliest plugin commit2014-07-09 06:06:05
Plugin age at join days3,198
Committer age at join days0
Active installs300,000
View raw JSON
{
    "slug": "google-analytics-dashboard-for-wp",
    "committer_slug": "micheleam",
    "committer_display_name": "micheleam",
    "committer_employer": null,
    "committer_member_since": "2023-04-11",
    "committer_first_commit": "2023-04-11 16:18:34",
    "committer_commit_count": 33,
    "plugin_listed_author": "smub",
    "earliest_plugin_commit": "2014-07-09 06:06:05",
    "plugin_age_at_join_days": 3198,
    "committer_age_at_join_days": 0,
    "active_installs": 300000
}
High bulk_committer_takeover Smash Balloon Social Photo Feed – Easy Social Feeds Plugin Resolved · audit:benign 5mo ago
Committeralexopen
Member since2024-08-02
Plugins joined5
Spread days33
Earliest join2026-02-26 16:40:44
Latest join2026-04-01 15:25:09
Combined installs1,370,000
Sample plugins
SlugActive installsFirst commit at
instagram-feed1,000,0002026-02-26 17:15:19
custom-twitter-feeds100,0002026-02-26 16:40:44
feeds-for-youtube100,0002026-02-26 17:03:40
reviews-feed100,0002026-02-26 17:20:07
feeds-for-tiktok70,0002026-04-01 15:25:09
View raw JSON
{
    "committer": "alexopen",
    "member_since": "2024-08-02",
    "plugins_joined": 5,
    "spread_days": 33,
    "earliest_join": "2026-02-26 16:40:44",
    "latest_join": "2026-04-01 15:25:09",
    "combined_installs": 1370000,
    "sample_plugins": [
        {
            "slug": "instagram-feed",
            "active_installs": 1000000,
            "first_commit_at": "2026-02-26 17:15:19"
        },
        {
            "slug": "custom-twitter-feeds",
            "active_installs": 100000,
            "first_commit_at": "2026-02-26 16:40:44"
        },
        {
            "slug": "feeds-for-youtube",
            "active_installs": 100000,
            "first_commit_at": "2026-02-26 17:03:40"
        },
        {
            "slug": "reviews-feed",
            "active_installs": 100000,
            "first_commit_at": "2026-02-26 17:20:07"
        },
        {
            "slug": "feeds-for-tiktok",
            "active_installs": 70000,
            "first_commit_at": "2026-04-01 15:25:09"
        }
    ]
}
Medium code_scan_delta Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery Resolved · code_scan_fp_class_genre_encoding 24d ago
Slugnextgen-gallery
Previous version4.2.3
Current version4.4.0
New findings
PatternKindFileLineSnippetConfidence
eval_callbuiltinsrc/Legacy/Pope/lib/class.extensibleobject.php556eval("class {$mixin_klass} extends Mixin{medium
New finding count1
View raw JSON
{
    "slug": "nextgen-gallery",
    "previous_version": "4.2.3",
    "current_version": "4.4.0",
    "new_findings": [
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "src/Legacy/Pope/lib/class.extensibleobject.php",
            "line": 556,
            "snippet": "eval(\"class {$mixin_klass} extends Mixin{",
            "confidence": "medium"
        }
    ],
    "new_finding_count": 1
}
Medium code_scan_delta WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More Resolved · fp_base64_benign_data_handling 1mo ago
Slugwpforms-lite
Previous version1.10.2.1
Current version2.0.0.2
New findings
PatternKindFileLineSnippetConfidence
base64_decodebuiltinsrc/Analytics/Process.php222$decoded = base64_decode( $payload_raw, true );medium
base64_decodebuiltinsrc/Analytics/Process.php521$unslashed = base64_decode( $unslashed, true );medium
New finding count2
View raw JSON
{
    "slug": "wpforms-lite",
    "previous_version": "1.10.2.1",
    "current_version": "2.0.0.2",
    "new_findings": [
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Analytics/Process.php",
            "line": 222,
            "snippet": "$decoded = base64_decode( $payload_raw, true );",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Analytics/Process.php",
            "line": 521,
            "snippet": "$unslashed = base64_decode( $unslashed, true );",
            "confidence": "medium"
        }
    ],
    "new_finding_count": 2
}
Medium code_scan_match FOMO & Social Proof Notifications by TrustPulse – Best WordPress FOMO Plugin Resolved · code_scan_fp_class_ad_tracking 4mo ago
Slugtrustpulse-api
Finding count2
Findings
PatternKindFileLineSnippetConfidence
add_footer_scriptioc:code_patterntrustpulse.php212add_action( 'wp_enqueue_scripts', array( $this, 'add_footer_script_if_enabled' ) );medium
add_footer_scriptioc:code_patterntrustpulse.php283public function add_footer_script_if_enabled() {medium
Resolved sha2db26bfc443cdb8b358f3e77e559d4f22778f1f2
View raw JSON
{
    "slug": "trustpulse-api",
    "finding_count": 2,
    "findings": [
        {
            "pattern": "add_footer_script",
            "kind": "ioc:code_pattern",
            "file": "trustpulse.php",
            "line": 212,
            "snippet": "add_action( 'wp_enqueue_scripts', array( $this, 'add_footer_script_if_enabled' ) );",
            "confidence": "medium"
        },
        {
            "pattern": "add_footer_script",
            "kind": "ioc:code_pattern",
            "file": "trustpulse.php",
            "line": 283,
            "snippet": "public function add_footer_script_if_enabled() {",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "2db26bfc443cdb8b358f3e77e559d4f22778f1f2"
}
Medium code_scan_match Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Resolved · code_scan_fp_class_genre_encoding 4mo ago
Slugeasy-digital-downloads
Finding count5
Findings
PatternKindFileLineSnippetConfidence
eval_callbuiltinlibraries/Carbon/src/Carbon/Traits/Mixin.php103$context = eval(self::getAnonymousClassCodeForTrait($trait));medium
base64_decodebuiltinsrc/Gateways/Square/Connection.php118$token_json = base64_decode( $encoded_tokens );medium
base64_decodebuiltinincludes/gateways/libs/amazon/IpnHandler.php226$signature = base64_decode($this->getMandatoryField("Signature"));medium
base64_decodebuiltinincludes/deprecated-functions.php501if ( base64_encode( base64_decode( $expire, true ) ) === $expire ) {medium
base64_decodebuiltinincludes/deprecated-functions.php502$expire = base64_decode( $expire ); // If it is a base64 string, decode it. Old expiration dates were in base64medium
Resolved sha11db55284a5947151031b5c69184dc81c1ff5035
View raw JSON
{
    "slug": "easy-digital-downloads",
    "finding_count": 5,
    "findings": [
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "libraries/Carbon/src/Carbon/Traits/Mixin.php",
            "line": 103,
            "snippet": "$context = eval(self::getAnonymousClassCodeForTrait($trait));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Gateways/Square/Connection.php",
            "line": 118,
            "snippet": "$token_json = base64_decode( $encoded_tokens );",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "includes/gateways/libs/amazon/IpnHandler.php",
            "line": 226,
            "snippet": "$signature       = base64_decode($this->getMandatoryField(\"Signature\"));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "includes/deprecated-functions.php",
            "line": 501,
            "snippet": "if ( base64_encode( base64_decode( $expire, true ) ) === $expire ) {",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "includes/deprecated-functions.php",
            "line": 502,
            "snippet": "$expire = base64_decode( $expire ); // If it is a base64 string, decode it. Old expiration dates were in base64",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "11db55284a5947151031b5c69184dc81c1ff5035"
}
Medium code_scan_match All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) Resolved · fp:overgeneric_ioc 4mo ago
Slugall-in-one-seo-pack
Finding count2
Findings
PatternKindFileLineSnippetConfidence
Upgradeioc:changelog_phrasereadme.txt216Want to unlock more SEO features? [Upgrade to AIOSEO Pro](https://aioseo.com/?utm_source=wprepo&utm_medium=link&utm_campaign=liteplugin 'All in One SEO for WordPress').low
Upgradeioc:changelog_phrasereadme.txt450== Upgrade Notice ==low
Triage note 2026 05 03all-in-one-seo-pack: Upgrade changelog_phrase fires on standard "Upgrade Notice" + Pro promo lines. AIOSEO is well-known plugin, no supply-chain signal.
View raw JSON
{
    "slug": "all-in-one-seo-pack",
    "finding_count": 2,
    "findings": [
        {
            "pattern": "Upgrade",
            "kind": "ioc:changelog_phrase",
            "file": "readme.txt",
            "line": 216,
            "snippet": "Want to unlock more SEO features? [Upgrade to AIOSEO Pro](https://aioseo.com/?utm_source=wprepo&utm_medium=link&utm_campaign=liteplugin 'All in One SEO for WordPress').",
            "confidence": "low"
        },
        {
            "pattern": "Upgrade",
            "kind": "ioc:changelog_phrase",
            "file": "readme.txt",
            "line": 450,
            "snippet": "== Upgrade Notice ==",
            "confidence": "low"
        }
    ],
    "triage_note_2026_05_03": "all-in-one-seo-pack: Upgrade changelog_phrase fires on standard \"Upgrade Notice\" + Pro promo lines. AIOSEO is well-known plugin, no supply-chain signal."
}
Medium code_scan_match WP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin Resolved · fp:overgeneric_ioc 4mo ago
Slugwp-mail-smtp
Finding count4
Findings
PatternKindFileLineSnippetConfidence
Upgradeioc:changelog_phrasereadme.txt430- IMPORTANT: Support for PHP 7.2 has been discontinued. If you are running this version, you MUST upgrade PHP before installing or upgrading to WP Mail SMTP v4.5. Failure to do that will disable WP Malow
Upgradeioc:changelog_phrasereadme.txt476- Changed: Removed `WPMailSMTP\Admin\PluginsInstallUpgrader` class and switched to the WordPress Core `Plugin_Upgrader` class.low
Upgradeioc:changelog_phrasereadme.txt500- IMPORTANT: Support for PHP 5.6, 7.0, and 7.1 has been discontinued. If you are running one of those versions, you MUST upgrade PHP before installing or upgrading to WP Mail SMTP v3.8. Failure to dolow
Upgradeioc:changelog_phrasereadme.txt552- IMPORTANT: Support for WordPress versions 5.1.x or lower has been discontinued. If you are using one of those versions, you MUST upgrade WordPress before installing or upgrading to WP Mail SMTP v3.3low
Triage note 2026 05 03wp-mail-smtp: 4 Upgrade hits, all PHP-version-discontinuation notices in changelog.
View raw JSON
{
    "slug": "wp-mail-smtp",
    "finding_count": 4,
    "findings": [
        {
            "pattern": "Upgrade",
            "kind": "ioc:changelog_phrase",
            "file": "readme.txt",
            "line": 430,
            "snippet": "- IMPORTANT: Support for PHP 7.2 has been discontinued. If you are running this version, you MUST upgrade PHP before installing or upgrading to WP Mail SMTP v4.5. Failure to do that will disable WP Ma",
            "confidence": "low"
        },
        {
            "pattern": "Upgrade",
            "kind": "ioc:changelog_phrase",
            "file": "readme.txt",
            "line": 476,
            "snippet": "- Changed: Removed `WPMailSMTP\\Admin\\PluginsInstallUpgrader` class and switched to the WordPress Core `Plugin_Upgrader` class.",
            "confidence": "low"
        },
        {
            "pattern": "Upgrade",
            "kind": "ioc:changelog_phrase",
            "file": "readme.txt",
            "line": 500,
            "snippet": "- IMPORTANT: Support for PHP 5.6, 7.0, and 7.1 has been discontinued. If you are running one of those versions, you MUST upgrade PHP before installing or upgrading to WP Mail SMTP v3.8. Failure to do",
            "confidence": "low"
        },
        {
            "pattern": "Upgrade",
            "kind": "ioc:changelog_phrase",
            "file": "readme.txt",
            "line": 552,
            "snippet": "- IMPORTANT: Support for WordPress versions 5.1.x or lower has been discontinued. If you are using one of those versions, you MUST upgrade WordPress before installing or upgrading to WP Mail SMTP v3.3",
            "confidence": "low"
        }
    ],
    "triage_note_2026_05_03": "wp-mail-smtp: 4 Upgrade hits, all PHP-version-discontinuation notices in changelog."
}
Medium code_scan_match WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More Resolved · fp:overgeneric_ioc 4mo ago
Slugwpforms-lite
Finding count11
Findings
PatternKindFileLineSnippetConfidence
base64_decodebuiltinincludes/class-process.php1,348$query_args = base64_decode( $hash );medium
eval_callbuiltinvendor_prefixed/ezyang/htmlpurifier/library/HTMLPurifier/VarParser/Native.php30$result = eval("\$var = {$expr};");medium
eval_callbuiltinvendor_prefixed/ezyang/htmlpurifier/library/HTMLPurifier/ConfigSchema/InterchangeBuilder.php157return eval('return array(' . $contents . ');');medium
base64_decodebuiltinvendor_prefixed/ezyang/htmlpurifier/library/HTMLPurifier/URIScheme/data.php81$raw_data = \base64_decode($data);medium
base64_decodebuiltinsrc/Tasks/Meta.php227$decoded = base64_decode( $meta->data );medium
base64_decodebuiltinsrc/Helpers/Crypto.php27return base64_decode( $secret_key ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decodemedium
base64_decodebuiltinsrc/Helpers/Crypto.php91$decoded = base64_decode( (string) $encrypted ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decodemedium
Upgradeioc:changelog_phrasereadme.txt162You can see why WPForms is the best WordPress contact form plugin on the market! Want to unlock these features? [Upgrade to our Pro version](https://wpforms.com/?utm_source=wprepo&utm_medium=link&utm_low
Upgradeioc:changelog_phrasereadme.txt541- IMPORTANT: Support for PHP 7.1 has been discontinued. If you are running PHP 7.1, you MUST upgrade PHP before installing WPForms 1.9.5. Failure to do that will disable WPForms core functionality.low
Upgradeioc:changelog_phrasereadme.txt599- IMPORTANT: Support for PHP 7.0 has been discontinued. If you are running PHP 7.0, you MUST upgrade PHP before installing WPForms 1.9.3. Failure to do that will disable WPForms core functionality.low
Upgradeioc:changelog_phrasereadme.txt821- Fixed: Upgrade to the Pro link had wrong styling on Bluehost hosted sites.low
Triage note 2026 05 03wpforms-lite: base64_decode + eval matches in vendored ezyang/htmlpurifier library + Crypto helpers. WPForms is well-known form plugin.
View raw JSON
{
    "slug": "wpforms-lite",
    "finding_count": 11,
    "findings": [
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "includes/class-process.php",
            "line": 1348,
            "snippet": "$query_args = base64_decode( $hash );",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "vendor_prefixed/ezyang/htmlpurifier/library/HTMLPurifier/VarParser/Native.php",
            "line": 30,
            "snippet": "$result = eval(\"\\$var = {$expr};\");",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "vendor_prefixed/ezyang/htmlpurifier/library/HTMLPurifier/ConfigSchema/InterchangeBuilder.php",
            "line": 157,
            "snippet": "return eval('return array(' . $contents . ');');",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "vendor_prefixed/ezyang/htmlpurifier/library/HTMLPurifier/URIScheme/data.php",
            "line": 81,
            "snippet": "$raw_data = \\base64_decode($data);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Tasks/Meta.php",
            "line": 227,
            "snippet": "$decoded = base64_decode( $meta->data );",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Helpers/Crypto.php",
            "line": 27,
            "snippet": "return base64_decode( $secret_key ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Helpers/Crypto.php",
            "line": 91,
            "snippet": "$decoded = base64_decode( (string) $encrypted ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode",
            "confidence": "medium"
        },
        {
            "pattern": "Upgrade",
            "kind": "ioc:changelog_phrase",
            "file": "readme.txt",
            "line": 162,
            "snippet": "You can see why WPForms is the best WordPress contact form plugin on the market! Want to unlock these features? [Upgrade to our Pro version](https://wpforms.com/?utm_source=wprepo&utm_medium=link&utm_",
            "confidence": "low"
        },
        {
            "pattern": "Upgrade",
            "kind": "ioc:changelog_phrase",
            "file": "readme.txt",
            "line": 541,
            "snippet": "- IMPORTANT: Support for PHP 7.1 has been discontinued. If you are running PHP 7.1, you MUST upgrade PHP before installing WPForms 1.9.5. Failure to do that will disable WPForms core functionality.",
            "confidence": "low"
        },
        {
            "pattern": "Upgrade",
            "kind": "ioc:changelog_phrase",
            "file": "readme.txt",
            "line": 599,
            "snippet": "- IMPORTANT: Support for PHP 7.0 has been discontinued. If you are running PHP 7.0, you MUST upgrade PHP before installing WPForms 1.9.3. Failure to do that will disable WPForms core functionality.",
            "confidence": "low"
        },
        {
            "pattern": "Upgrade",
            "kind": "ioc:changelog_phrase",
            "file": "readme.txt",
            "line": 821,
            "snippet": "- Fixed: Upgrade to the Pro link had wrong styling on Bluehost hosted sites.",
            "confidence": "low"
        }
    ],
    "triage_note_2026_05_03": "wpforms-lite: base64_decode + eval matches in vendored ezyang/htmlpurifier library + Crypto helpers. WPForms is well-known form plugin."
}
Medium committer_younger_than_plugin Login for Google Apps Resolved · no_longer_matches 4mo ago
Sluggoogle-apps-login
Committer slugniravbhut
Committer display nameNirav Bhut
Committer employer—
Committer member since2018-05-09
Committer first commit2018-05-16 08:48:40
Committer commit count2
Plugin listed authorsmub
Earliest plugin commit2013-11-25 20:54:02
Plugin age at join days1,632
Committer age at join days7
Active installs10,000
View raw JSON
{
    "slug": "google-apps-login",
    "committer_slug": "niravbhut",
    "committer_display_name": "Nirav Bhut",
    "committer_employer": null,
    "committer_member_since": "2018-05-09",
    "committer_first_commit": "2018-05-16 08:48:40",
    "committer_commit_count": 2,
    "plugin_listed_author": "smub",
    "earliest_plugin_commit": "2013-11-25 20:54:02",
    "plugin_age_at_join_days": 1632,
    "committer_age_at_join_days": 7,
    "active_installs": 10000
}
Medium bulk_committer_takeover WP Call Button – Easy Click to Call Button for WordPress Resolved · no_longer_matches 4mo ago
Committer_smartik_
Member since2014-01-03
Plugins joined5
Spread days349
Earliest join2023-11-03 18:16:59
Latest join2024-10-18 17:06:42
Combined installs72,500
Sample plugins
SlugActive installsFirst commit at
wp-call-button40,0002024-07-26 14:36:40
transients-manager20,0002024-10-18 17:06:42
wp10110,0002023-11-03 18:16:59
compact-archives2,0002024-07-05 18:08:28
last-viewed-posts5002024-04-01 19:31:49
View raw JSON
{
    "committer": "_smartik_",
    "member_since": "2014-01-03",
    "plugins_joined": 5,
    "spread_days": 349,
    "earliest_join": "2023-11-03 18:16:59",
    "latest_join": "2024-10-18 17:06:42",
    "combined_installs": 72500,
    "sample_plugins": [
        {
            "slug": "wp-call-button",
            "active_installs": 40000,
            "first_commit_at": "2024-07-26 14:36:40"
        },
        {
            "slug": "transients-manager",
            "active_installs": 20000,
            "first_commit_at": "2024-10-18 17:06:42"
        },
        {
            "slug": "wp101",
            "active_installs": 10000,
            "first_commit_at": "2023-11-03 18:16:59"
        },
        {
            "slug": "compact-archives",
            "active_installs": 2000,
            "first_commit_at": "2024-07-05 18:08:28"
        },
        {
            "slug": "last-viewed-posts",
            "active_installs": 500,
            "first_commit_at": "2024-04-01 19:31:49"
        }
    ]
}
Medium bulk_committer_takeover PDF Embedder – PDF Viewer & Embed PDF Files for WordPress Resolved · no_longer_matches 4mo ago
Committerlevertechadmin
Member since2018-03-29
Plugins joined5
Spread days335
Earliest join2018-08-17 05:24:30
Latest join2019-07-18 07:14:06
Combined installs320,000
Sample plugins
SlugActive installsFirst commit at
pdf-embedder300,0002018-08-21 15:17:27
google-apps-login10,0002019-03-27 13:24:55
google-drive-embedder5,0002018-08-17 05:24:30
all-in-one-intranet4,0002019-03-27 13:32:04
get-params1,0002019-07-18 07:14:06
View raw JSON
{
    "committer": "levertechadmin",
    "member_since": "2018-03-29",
    "plugins_joined": 5,
    "spread_days": 335,
    "earliest_join": "2018-08-17 05:24:30",
    "latest_join": "2019-07-18 07:14:06",
    "combined_installs": 320000,
    "sample_plugins": [
        {
            "slug": "pdf-embedder",
            "active_installs": 300000,
            "first_commit_at": "2018-08-21 15:17:27"
        },
        {
            "slug": "google-apps-login",
            "active_installs": 10000,
            "first_commit_at": "2019-03-27 13:24:55"
        },
        {
            "slug": "google-drive-embedder",
            "active_installs": 5000,
            "first_commit_at": "2018-08-17 05:24:30"
        },
        {
            "slug": "all-in-one-intranet",
            "active_installs": 4000,
            "first_commit_at": "2019-03-27 13:32:04"
        },
        {
            "slug": "get-params",
            "active_installs": 1000,
            "first_commit_at": "2019-07-18 07:14:06"
        }
    ]
}
Medium committer_younger_than_plugin Login for Google Apps Resolved · no_longer_matches 4mo ago
Sluggoogle-apps-login
Committer slugniravbhut
Committer display nameNirav Bhut
Committer employer—
Committer member since2018-05-09
Committer first commit2018-05-16 08:48:40
Committer commit count2
Plugin listed authorsmub
Earliest plugin commit2013-11-25 20:54:02
Plugin age at join days1,632
Committer age at join days7
Active installs10,000
View raw JSON
{
    "slug": "google-apps-login",
    "committer_slug": "niravbhut",
    "committer_display_name": "Nirav Bhut",
    "committer_employer": null,
    "committer_member_since": "2018-05-09",
    "committer_first_commit": "2018-05-16 08:48:40",
    "committer_commit_count": 2,
    "plugin_listed_author": "smub",
    "earliest_plugin_commit": "2013-11-25 20:54:02",
    "plugin_age_at_join_days": 1632,
    "committer_age_at_join_days": 7,
    "active_installs": 10000
}
Medium committer_younger_than_plugin Sugar Calendar – Events Calendar, Event Tickets, and Events Management Platform Resolved · no_longer_matches 4mo ago
Slugsugar-calendar-lite
Committer slugspiettojo
Committer display nameSean Michael P
Committer employer—
Committer member since2025-06-09
Committer first commit2025-09-30 13:45:49
Committer commit count2
Plugin listed authorsmub
Earliest plugin commit2012-10-05 19:33:19
Plugin age at join days4,742
Committer age at join days113
Active installs10,000
View raw JSON
{
    "slug": "sugar-calendar-lite",
    "committer_slug": "spiettojo",
    "committer_display_name": "Sean Michael P",
    "committer_employer": null,
    "committer_member_since": "2025-06-09",
    "committer_first_commit": "2025-09-30 13:45:49",
    "committer_commit_count": 2,
    "plugin_listed_author": "smub",
    "earliest_plugin_commit": "2012-10-05 19:33:19",
    "plugin_age_at_join_days": 4742,
    "committer_age_at_join_days": 113,
    "active_installs": 10000
}
Medium code_scan_delta FOMO & Social Proof Notifications by TrustPulse – Best WordPress FOMO Plugin Resolved · fp:overgeneric_ioc 4mo ago
Slugtrustpulse-api
Previous version1.2.5
Current version1.2.5
New findings
PatternKindFileLineSnippetConfidence
add_footer_scriptioc:code_patterntrustpulse.php212add_action( 'wp_enqueue_scripts', array( $this, 'add_footer_script_if_enabled' ) );medium
add_footer_scriptioc:code_patterntrustpulse.php283public function add_footer_script_if_enabled() {medium
New finding count2
View raw JSON
{
    "slug": "trustpulse-api",
    "previous_version": "1.2.5",
    "current_version": "1.2.5",
    "new_findings": [
        {
            "pattern": "add_footer_script",
            "kind": "ioc:code_pattern",
            "file": "trustpulse.php",
            "line": 212,
            "snippet": "add_action( 'wp_enqueue_scripts', array( $this, 'add_footer_script_if_enabled' ) );",
            "confidence": "medium"
        },
        {
            "pattern": "add_footer_script",
            "kind": "ioc:code_pattern",
            "file": "trustpulse.php",
            "line": 283,
            "snippet": "public function add_footer_script_if_enabled() {",
            "confidence": "medium"
        }
    ],
    "new_finding_count": 2
}
Medium committer_younger_than_plugin WP Lightbox 2 Resolved · benign_company_employee 4mo ago
Slugwp-lightbox-2
Committer slugcsskevin
Committer display namecsskevin
Committer employer—
Committer member since2020-08-16
Committer first commit2020-10-02 12:48:57
Committer commit count3
Plugin listed authorsmub
Earliest plugin commit2011-11-27 17:09:13
Plugin age at join days3,231
Committer age at join days47
Active installs30,000
View raw JSON
{
    "slug": "wp-lightbox-2",
    "committer_slug": "csskevin",
    "committer_display_name": "csskevin",
    "committer_employer": null,
    "committer_member_since": "2020-08-16",
    "committer_first_commit": "2020-10-02 12:48:57",
    "committer_commit_count": 3,
    "plugin_listed_author": "smub",
    "earliest_plugin_commit": "2011-11-27 17:09:13",
    "plugin_age_at_join_days": 3231,
    "committer_age_at_join_days": 47,
    "active_installs": 30000
}
Medium committer_younger_than_plugin FOMO & Social Proof Notifications by TrustPulse – Best WordPress FOMO Plugin Resolved · benign_company_employee 4mo ago
Slugtrustpulse-api
Committer slugmattawesomemotive
Committer display namemattawesomemotive
Committer employer—
Committer member since2023-04-17
Committer first commit2023-09-19 16:08:02
Committer commit count23
Plugin listed authorsmub
Earliest plugin commit2019-05-16 00:22:26
Plugin age at join days1,587
Committer age at join days155
Active installs20,000
View raw JSON
{
    "slug": "trustpulse-api",
    "committer_slug": "mattawesomemotive",
    "committer_display_name": "mattawesomemotive",
    "committer_employer": null,
    "committer_member_since": "2023-04-17",
    "committer_first_commit": "2023-09-19 16:08:02",
    "committer_commit_count": 23,
    "plugin_listed_author": "smub",
    "earliest_plugin_commit": "2019-05-16 00:22:26",
    "plugin_age_at_join_days": 1587,
    "committer_age_at_join_days": 155,
    "active_installs": 20000
}
Medium bulk_committer_takeover Smash Balloon Social Photo Feed – Easy Social Feeds Plugin Resolved · no_longer_matches 5mo ago
Committerahmedgeek
Member since2010-04-21
Plugins joined5
Spread days365
Earliest join2024-04-23 16:03:28
Latest join2025-04-23 18:46:40
Combined installs1,500,000
Sample plugins
SlugActive installsFirst commit at
instagram-feed1,000,0002024-06-12 11:35:17
custom-facebook-feed200,0002025-04-23 18:46:40
custom-twitter-feeds100,0002024-10-03 14:09:24
feeds-for-youtube100,0002024-04-23 16:03:28
reviews-feed100,0002024-04-25 15:14:13
View raw JSON
{
    "committer": "ahmedgeek",
    "member_since": "2010-04-21",
    "plugins_joined": 5,
    "spread_days": 365,
    "earliest_join": "2024-04-23 16:03:28",
    "latest_join": "2025-04-23 18:46:40",
    "combined_installs": 1500000,
    "sample_plugins": [
        {
            "slug": "instagram-feed",
            "active_installs": 1000000,
            "first_commit_at": "2024-06-12 11:35:17"
        },
        {
            "slug": "custom-facebook-feed",
            "active_installs": 200000,
            "first_commit_at": "2025-04-23 18:46:40"
        },
        {
            "slug": "custom-twitter-feeds",
            "active_installs": 100000,
            "first_commit_at": "2024-10-03 14:09:24"
        },
        {
            "slug": "feeds-for-youtube",
            "active_installs": 100000,
            "first_commit_at": "2024-04-23 16:03:28"
        },
        {
            "slug": "reviews-feed",
            "active_installs": 100000,
            "first_commit_at": "2024-04-25 15:14:13"
        }
    ]
}
Medium bulk_committer_takeover Smash Balloon Social Photo Feed – Easy Social Feeds Plugin Resolved · deduped 5mo ago
Committerahmedgeek
Member since2010-04-21
Plugins joined5
Spread days365
Earliest join2024-04-23 16:03:28
Latest join2025-04-23 18:46:40
Combined installs1,500,000
Sample plugins
SlugActive installsFirst commit at
instagram-feed1,000,0002024-06-12 11:35:17
custom-facebook-feed200,0002025-04-23 18:46:40
custom-twitter-feeds100,0002024-10-03 14:09:24
feeds-for-youtube100,0002024-04-23 16:03:28
reviews-feed100,0002024-04-25 15:14:13
View raw JSON
{
    "committer": "ahmedgeek",
    "member_since": "2010-04-21",
    "plugins_joined": 5,
    "spread_days": 365,
    "earliest_join": "2024-04-23 16:03:28",
    "latest_join": "2025-04-23 18:46:40",
    "combined_installs": 1500000,
    "sample_plugins": [
        {
            "slug": "instagram-feed",
            "active_installs": 1000000,
            "first_commit_at": "2024-06-12 11:35:17"
        },
        {
            "slug": "custom-facebook-feed",
            "active_installs": 200000,
            "first_commit_at": "2025-04-23 18:46:40"
        },
        {
            "slug": "custom-twitter-feeds",
            "active_installs": 100000,
            "first_commit_at": "2024-10-03 14:09:24"
        },
        {
            "slug": "feeds-for-youtube",
            "active_installs": 100000,
            "first_commit_at": "2024-04-23 16:03:28"
        },
        {
            "slug": "reviews-feed",
            "active_installs": 100000,
            "first_commit_at": "2024-04-25 15:14:13"
        }
    ]
}
Medium bulk_committer_takeover Smash Balloon Social Photo Feed – Easy Social Feeds Plugin Resolved · superseded 5mo ago
Committerahmedgeek
Member since2010-04-21
Plugins joined5
Spread days365
Earliest join2024-04-23 16:03:28
Latest join2025-04-23 18:46:40
Combined installs1,500,000
Sample plugins
SlugActive installsFirst commit at
instagram-feed1,000,0002024-06-12 11:35:17
custom-facebook-feed200,0002025-04-23 18:46:40
custom-twitter-feeds100,0002024-10-03 14:09:24
feeds-for-youtube100,0002024-04-23 16:03:28
reviews-feed100,0002024-04-25 15:14:13
View raw JSON
{
    "committer": "ahmedgeek",
    "member_since": "2010-04-21",
    "plugins_joined": 5,
    "spread_days": 365,
    "earliest_join": "2024-04-23 16:03:28",
    "latest_join": "2025-04-23 18:46:40",
    "combined_installs": 1500000,
    "sample_plugins": [
        {
            "slug": "instagram-feed",
            "active_installs": 1000000,
            "first_commit_at": "2024-06-12 11:35:17"
        },
        {
            "slug": "custom-facebook-feed",
            "active_installs": 200000,
            "first_commit_at": "2025-04-23 18:46:40"
        },
        {
            "slug": "custom-twitter-feeds",
            "active_installs": 100000,
            "first_commit_at": "2024-10-03 14:09:24"
        },
        {
            "slug": "feeds-for-youtube",
            "active_installs": 100000,
            "first_commit_at": "2024-04-23 16:03:28"
        },
        {
            "slug": "reviews-feed",
            "active_installs": 100000,
            "first_commit_at": "2024-04-25 15:14:13"
        }
    ]
}
Medium bulk_committer_takeover Smash Balloon Social Photo Feed – Easy Social Feeds Plugin Resolved · superseded 5mo ago
Committerahmedgeek
Member since2010-04-21
Plugins joined5
Spread days365
Earliest join2024-04-23 16:03:28
Latest join2025-04-23 18:46:40
Combined installs1,500,000
Sample plugins
SlugActive installsFirst commit at
instagram-feed1,000,0002024-06-12 11:35:17
custom-facebook-feed200,0002025-04-23 18:46:40
custom-twitter-feeds100,0002024-10-03 14:09:24
feeds-for-youtube100,0002024-04-23 16:03:28
reviews-feed100,0002024-04-25 15:14:13
View raw JSON
{
    "committer": "ahmedgeek",
    "member_since": "2010-04-21",
    "plugins_joined": 5,
    "spread_days": 365,
    "earliest_join": "2024-04-23 16:03:28",
    "latest_join": "2025-04-23 18:46:40",
    "combined_installs": 1500000,
    "sample_plugins": [
        {
            "slug": "instagram-feed",
            "active_installs": 1000000,
            "first_commit_at": "2024-06-12 11:35:17"
        },
        {
            "slug": "custom-facebook-feed",
            "active_installs": 200000,
            "first_commit_at": "2025-04-23 18:46:40"
        },
        {
            "slug": "custom-twitter-feeds",
            "active_installs": 100000,
            "first_commit_at": "2024-10-03 14:09:24"
        },
        {
            "slug": "feeds-for-youtube",
            "active_installs": 100000,
            "first_commit_at": "2024-04-23 16:03:28"
        },
        {
            "slug": "reviews-feed",
            "active_installs": 100000,
            "first_commit_at": "2024-04-25 15:14:13"
        }
    ]
}
Medium bulk_committer_takeover Smash Balloon Social Photo Feed – Easy Social Feeds Plugin Resolved · superseded 5mo ago
Committerahmedgeek
Member since2010-04-21
Plugins joined5
Spread days365
Earliest join2024-04-23 16:03:28
Latest join2025-04-23 18:46:40
Combined installs1,500,000
Sample plugins
SlugActive installsFirst commit at
instagram-feed1,000,0002024-06-12 11:35:17
custom-facebook-feed200,0002025-04-23 18:46:40
custom-twitter-feeds100,0002024-10-03 14:09:24
feeds-for-youtube100,0002024-04-23 16:03:28
reviews-feed100,0002024-04-25 15:14:13
View raw JSON
{
    "committer": "ahmedgeek",
    "member_since": "2010-04-21",
    "plugins_joined": 5,
    "spread_days": 365,
    "earliest_join": "2024-04-23 16:03:28",
    "latest_join": "2025-04-23 18:46:40",
    "combined_installs": 1500000,
    "sample_plugins": [
        {
            "slug": "instagram-feed",
            "active_installs": 1000000,
            "first_commit_at": "2024-06-12 11:35:17"
        },
        {
            "slug": "custom-facebook-feed",
            "active_installs": 200000,
            "first_commit_at": "2025-04-23 18:46:40"
        },
        {
            "slug": "custom-twitter-feeds",
            "active_installs": 100000,
            "first_commit_at": "2024-10-03 14:09:24"
        },
        {
            "slug": "feeds-for-youtube",
            "active_installs": 100000,
            "first_commit_at": "2024-04-23 16:03:28"
        },
        {
            "slug": "reviews-feed",
            "active_installs": 100000,
            "first_commit_at": "2024-04-25 15:14:13"
        }
    ]
}
Low contributor_added EDD – Status Board Resolved · reviewed_benign_contributor 12d ago
Slugedd-status-board
New contributorssmub
Active installs10
View raw JSON
{
    "slug": "edd-status-board",
    "new_contributors": [
        "smub"
    ],
    "active_installs": 10
}
Low plugin_closed EDD – Status Board Resolved · closure_author_request_benign 12d ago
Slugedd-status-board
Closed reasonauthor-request
Closed date2026-05-14 00:00:00
Active installs10
View raw JSON
{
    "slug": "edd-status-board",
    "closed_reason": "author-request",
    "closed_date": "2026-05-14 00:00:00",
    "active_installs": 10
}
Low plugin_closed EDD – Status Board Resolved · no_longer_matches 19d ago
Slugedd-status-board
Closed reasonauthor-request
Closed date2026-05-14 00:00:00
Active installs10
View raw JSON
{
    "slug": "edd-status-board",
    "closed_reason": "author-request",
    "closed_date": "2026-05-14 00:00:00",
    "active_installs": 10
}

Plugins authored (111)

Plugin Version Installs Last updated Status
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More ·wpforms-lite 2.0.2 5M+ 3d ago Active
WP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin ·wp-mail-smtp 4.9.0 4M+ 2mo ago Active
WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager ·insert-headers-and-footers 2.3.9 3M+ 24d ago Active
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) ·all-in-one-seo-pack 5.0.1.1 2M+ 23d ago Active
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More ·duplicator 5.0.4 1M+ 2d ago Active
Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation ·optinmonster 2.17.1 1M+ 1mo ago Active
One Click Demo Import ·one-click-demo-import 3.4.1 1M+ 5mo ago Active
Smash Balloon Social Photo Feed – Easy Social Feeds Plugin ·instagram-feed 6.13.0 1M+ 20d ago Active
Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more ·easy-wp-smtp 2.15.1 500k+ 1mo ago Active
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery ·nextgen-gallery 4.5.1 300k+ 2d ago Active
WP Mail Logging ·wp-mail-logging 1.16.0 300k+ 7mo ago Active
PDF Embedder – PDF Viewer & Embed PDF Files for WordPress ·pdf-embedder 5.0.2 300k+ 1mo ago Active
ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) ·google-analytics-dashboard-for-wp 10.3.0 300k+ 4d ago Active
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress ·custom-facebook-feed 4.13.0 200k+ 10d ago Active
WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) ·wpconsent-cookies-banner-privacy-suite 1.1.9 200k+ 19d ago Active
Table of Contents Plus – Automatic Table of Contents for Posts & Pages ·table-of-contents-plus 202609.1 200k+ 3d ago Active
UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds ·userfeedback-lite 1.12.0 200k+ 4d ago Active
Custom Twitter Feeds – A Tweets Widget or X Feed Widget ·custom-twitter-feeds 2.9.0 100k+ 6d ago Active
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More ·envira-gallery-lite 1.16.0 100k+ 12d ago Active
404 to 301 – Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring ·404-to-301 4.0.4 100k+ 20d ago Active
Feeds for YouTube (YouTube video, channel, and gallery plugin) ·feeds-for-youtube 2.9.0 100k+ 10d ago Active
Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More ·reviews-feed 2.13.0 100k+ 4d ago Active
Feeds for TikTok (TikTok feed, video, and gallery plugin) ·feeds-for-tiktok 1.7.2 70k+ 1mo ago Active
Sydney Toolbox ·sydney-toolbox 1.36 50k+ 1y ago Active
SearchWP Live Ajax Search ·searchwp-live-ajax-search 1.8.8 50k+ 1mo ago Active
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy ·easy-digital-downloads 3.7.0 40k+ 1mo ago Active
WP Call Button – Easy Click to Call Button for WordPress ·wp-call-button 1.4.4 40k+ 6mo ago Active
aThemes Starter Sites ·athemes-starter-sites 1.4.2 40k+ 1mo ago Active
File Upload Types by WPForms ·file-upload-types 1.5.0 40k+ 3mo ago Active
Contact Form & SMTP Plugin for WordPress by PirateForms ·pirate-forms 2.6.1 30k+ 1y ago Active
Slider by Soliloquy – Responsive Image Slider for WordPress ·soliloquy-lite 2.8.4 30k+ 1mo ago Active
Universally – AI Translation & Multilingual SEO: Translate Your Site into 110+ Languages ·universally-language-translation-multilingual-tool 1.0.9 20k+ 4d ago Active
WP Lightbox 2 ·wp-lightbox-2 3.0.7 20k+ 7mo ago Active
Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers ·rafflepress 1.12.26 20k+ 17d ago Active
Transients Manager ·transients-manager 2.0.7 20k+ 1y ago Active
Change Mail Sender ·cb-change-mail-sender 1.3.0 20k+ 1y ago Active
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) ·charitable 1.8.12.3 10k+ 23d ago Active
Login for Google Apps ·google-apps-login 3.5.2 10k+ 1y ago Active
FOMO & Social Proof Notifications by TrustPulse – Best WordPress FOMO Plugin ·trustpulse-api 1.2.5 10k+ 1y ago Active
WP101 Video Tutorial Plugin ·wp101 5.4.1 10k+ 1y ago Active
Sugar Calendar – Events Calendar, Event Tickets, and Events Management Platform ·sugar-calendar-lite 3.14.0 10k+ 4d ago Active
Product Labels, Quick View, Buy Now, Pre-Orders, Frequently Bought Together & More for WooCommerce – Merchant ·merchant 2.3.2 9k+ 3d ago Active
PushEngage – Web Push Notifications, WooCommerce Automation & Chat Widget ·pushengage 4.2.10 9k+ 9d ago Active
ActiveLayer Anti-Spam: Spam Protection for Forms & Comments ·activelayer-anti-spam-spam-protection-for-forms-comments 1.7.1 9k+ 5d ago Active
Stripe Payment Forms by WP Simple Pay – Accept Credit Card Payments + Subscriptions with Stripe ·stripe 4.17.3 8k+ 3mo ago Active
aThemes Addons for Elementor – Widgets, Sliders, Galleries & Form Styler ·athemes-addons-for-elementor-lite 1.2.1 7k+ 1mo ago Active
aThemes Blocks ·athemes-blocks 1.1.5 6k+ 25d ago Active
SearchWP Modal Search Form ·searchwp-modal-search-form 0.5.7 5k+ 9mo ago Active
WPChat – Live Chat & Messaging Widget for Customer Support ·smashballoon-wpchat-livechat-customer-support 1.4.3 5k+ 6d ago Active
Disable New User Notification Emails ·disable-new-user-notifications 2.0.0 4k+ 5y ago Active
Gallery Carousel Without JetPack ·carousel-without-jetpack 0.7.5 4k+ 8y ago Active
Embed Files from Google Drive ·google-drive-embedder 5.3.0 4k+ 1y ago Active
Intranet & Private Site – All-In-One Intranet ·all-in-one-intranet 1.10.0 3k+ 1mo ago Active
AffiliateWP – Affiliate Area Tabs ·affiliatewp-affiliate-area-tabs 1.4.2 3k+ 1y ago Active
Athemes Toolbox ·athemes-toolbox 1.08 3k+ 5y ago Active
Compact Archives ·compact-archives 4.1.1 2k+ 7mo ago Active
Affiliate Area Shortcodes by AffiliateWP ·affiliatewp-affiliate-area-shortcodes 1.3.1 2k+ 1y ago Active
AffiliateWP – Order Details For Affiliates ·affiliatewp-order-details-for-affiliates 1.3.0 2k+ 1y ago Active
AffiliateWP – Leaderboard ·affiliatewp-leaderboard 1.2.0 1k+ 1y ago Active
Airi Demo Importer ·airi-demo-importer 1.0.3 1k+ 6y ago Active
AffiliateWP – Affiliate Info ·affiliatewp-affiliate-info 1.2.0 1k+ 1y ago Active
AffiliateWP – Allowed Products ·affiliatewp-allowed-products 1.3.0 1k+ 1y ago Active
AffiliateWP – Affiliate Product Rates ·affiliatewp-affiliate-product-rates 1.2.1 1k+ 1y ago Active
AffiliateWP – WooCommerce Redirect Affiliates ·affiliatewp-woocommerce-redirect-affiliates 1.2.1 1k+ 1y ago Active
Batch Comment Spam Deletion ·batch-comment-spam-deletion 1.0.6 1k+ 8y ago Active
BuddyPress for LearnDash ·buddypress-learndash 1.3.0 1k+ 6y ago Active
EDD Auto Register ·edd-auto-register 1.4.5 800 2y ago Active
AffiliateWP – External Referral Links ·affiliatewp-external-referral-links 1.2.2 700 1y ago Active
BP Auto Group Join ·bp-auto-group-join 1.0.4 700 5y ago Active
BuddyPress Edit Activity ·buddypress-edit-activity 1.1.1 700 6y ago Active
AffiliateWP Checkout Referrals ·affiliatewp-checkout-referrals 1.2.2 600 1y ago Active
AffiliateWP – Allow Own Referrals ·affiliatewp-allow-own-referrals 1.2.1 500 1y ago Active
Beacon Lead Magnets and Lead Capture ·beacon-by 1.5.9 500 9mo ago Active
AffiliateWP – Force Pending Referrals ·affiliatewp-force-pending-referrals 1.2.0 500 1y ago Active
Force Plugin Updates Check ·force-plugin-updates-check 1.0.2 400 8y ago Active
Simple Post Expiration ·simple-post-expiration 1.0.1 400 9y ago Active
All in One SEO Pack Importer ·all-in-one-seo-pack-importer .1.5.2 400 7y ago Active
AffiliateWP – Sign Up Bonus ·affiliatewp-sign-up-bonus 1.3.1 300 1y ago Active
Disable All WP Updates ·disable-all-wp-updates 1.1.0 300 5y ago Active
AffiliateWP – Store Credit ·affiliatewp-store-credit 2.6.2 300 1y ago Active
WPControl – The Easiest Optimization Plugin for WordPress ·wpcontrol 1.0.1 200 4y ago Active
bbPress GDPR ·bbp-gdpr 1.0.2 100 7y ago Active
Restrict Uploads ·restrict-uploads 0.1.1 100 15y ago Active
Simple Notices ·simple-notices 1.0.7 100 10y ago Active
Easy Digital Downloads – Terms Per Product ·edd-terms-per-product 1.0.7 90 5y ago Active
FT Calendar ·ft-calendar 1.6.1.1 90 7y ago Active
BuddyPress for Sensei ·sensei-buddypress 1.2.3 70 8y ago Active
BuddyPress GDPR ·bp-gdpr 1.0.1 60 7y ago Active
Easy Digital Downloads – Continue Shopping ·easy-digital-downloads-continue-shopping 1.0.4 60 5y ago Active
Featured Comments ·feature-comments 1.2.6 30 9y ago Active
Easy Digital Downloads – Digital Badge ·edd-digital-badge 1.0 30 9y ago Active
Prevent Skype Overwriting ·prevent-skype-overwriting 0.1 30 14y ago Active
Love It ·love-it 1.0.5 20 11y ago Active
404 to 301 – Logs Exporter ·404-to-301-logs-exporter 1.0.0 20 3mo ago Active
EDD TaxJar ·edd-taxjar 1.0.2 10 5y ago Active
Easy Digital Downloads – Lock Downloads to IP ·easy-digital-downloads-lock-downloads-to-ip 1.0.1 10 5y ago Active
404 to 301 – Redirects Importer ·404-to-301-redirects-importer 1.0.0 10 3mo ago Active
Easy Digital Downloads – Software Licensing – Renew All ·edd-sl-renew-all 1.0.2 10 10y ago Active
EDD – Status Board ·edd-status-board 1.1.9 10 — Closed
WordPress Full Screen Search Overlay ·full-screen-search-overlay 1.0.1 — — Closed
Sugar Calendar – WP All Import Add-on ·sugar-calendar-wp-all-import 1.0.1 — — Closed
Sugar Calendar – Google Maps ·sugar-event-calendar-google-maps 1.4.1 — — Closed
Sugar Calendar – Gravity Forms Bridge ·sugar-event-calendar-gravity-forms 1.2.0 — — Closed
Floating Social Bar ·floating-social-bar 1.1.7 — — Closed
Facebook Open Graph Meta in WordPress ·facebook-open-graph-meta-in-wordpress 0.2 — — Closed
AffiliateWP – Show Affiliate Coupons ·affiliatewp-show-affiliate-coupons 1.0.7 — — Closed
EZP Coming Soon Page ·easy-pie-coming-soon 1.0.7.4 — — Closed
EZP Maintenance Mode ·easy-pie-maintenance-mode 1.0.2 — — Closed
SimpleMap Store Locator ·simplemap 2.6.1 — — Closed
YouTube Subscribe Bar ·subscribe-bar-youtube 1.1.0 — — Closed
Google Analytics Dashboard ·google-analytics-dashboard 2.1.1 — — Closed

SVN commit access (11)

Plugins this account has pushed commits to, reconstructed from plugins.svn.wordpress.org. A new name showing up here on an established plugin is the strongest ownership-transfer signal.

Plugin Primary author Installs Commits First Latest Status
Gallery Carousel Without JetPack smub 4k+ 23 14y ago 13y ago Active
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More smub 5M+ 7 9y ago 7y ago Active
Restrict Uploads smub 100 7 15y ago 15y ago Active
MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) chriscct7 2M+ 7 10y ago 10y ago Active
WP Lightbox 2 smub 20k+ 4 11y ago 11y ago Active
WordPress Full Screen Search Overlay smub — 4 10y ago 10y ago Closed
Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation smub 1M+ 4 6y ago 6y ago Active
WP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin smub 4M+ 4 9y ago 9y ago Active
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More smub 100k+ 3 9y ago 9y ago Active
Prevent Skype Overwriting smub 30 3 14y ago 14y ago Active
Slider by Soliloquy – Responsive Image Slider for WordPress smub 30k+ 2 9y ago 9y ago Active

Contributor on other plugins (31)

Plugins where this account is listed in the readme contributors (distinct from SVN commit access).

Plugin Primary author Version Installs
MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) chriscct7 11.3.0 2M+
Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode seedprod 6.20.9 600k+
Broken Link Checker by AIOSEO – Find & Fix Broken Internal, External & Video Links aioseo 1.3.0.1 300k+
Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce jkohlbach 13.5.7 80k+
Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included uncannyowl 7.6.1.1 40k+
WPVibe – WordPress MCP Server. Connect Claude, ChatGPT & Any AI Agent via MCP seedprod 1.17.3 30k+
Missed Scheduled Posts Publisher by WPBeginner wpbeginner 2.1.1 30k+
Search & Replace Everything by WPCode – Find and Replace Media, Text, Links, and More wpcodeteam 1.0.10 20k+
Wholesale Suite – B2B, Dynamic Pricing & WooCommerce Wholesale Prices jkohlbach 2.2.9 20k+
WP Editor benjaminprojas 1.2.9.3 20k+
Advanced Coupons for WooCommerce – BOGO Coupons, Store Credit & WooCommerce Coupon Plugin jkohlbach 4.7.5 20k+
Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools jkohlbach 2.4.5 8k+
Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers jkohlbach 2.8.1 6k+
All In One SEO Pack for WooCommerce jkohlbach 1.3.4 3k+
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors wcvendors 2.7.2.2 3k+
Invoice Gateway for WooCommerce – Invoice Payment Gateway jkohlbach 1.1.6 2k+
Import Shopify To WP wpbeginner 1.1.0 1k+
EDD Hide Download sumobi 1.2.11.1 600
AI Chatbot for WooCommerce – StoreAgent jkohlbach 1.1.8 600
SaveTo Wishlist Lite – WooCommerce Wishlist jkohlbach 1.1.4 500
Last Viewed Posts by WPBeginner jottlieb 1.0.2 500
Easy Digital Downloads – Additional Shortcodes cklosows 1.4.2 300
Database Reset Pro – Clean & Reset WordPress Database seedprod 1.0.2 300
Comment Moderation Role by WPBeginner wpbeginner 1.1.2 200
Easy Digital Downloads – Variable Pricing Descriptions sumobi 1.1 100
Duplicate Post by AIOSEO – Clone Posts, Duplicate Pages and Republish Content aioseo 1.0.1 100
MyPayKit – Payment Forms for Square seedprod 1.0.10 100
Sugar Calendar Bookings Scheduling Appointments Lite sugarcalendar 1.5.3 40
jQuery Tabber Widget noumaan 1.0.2 10
ClickSocial – Social Media Scheduler & Poster smashballoon 1.3.1 —
LedgerPort – QuickBooks Sync for WooCommerce – E-commerce Accounting Automation ledgerport 1.0.3 —