WordPress.org

{
    "slug": "health-check",
    "active_installs": 300000,
    "critical_matches": 1,
    "high_matches": 0,
    "lookback_days": 90,
    "sample_threads": [
        {
            "title": "ross Site Scripting (XSS) vulnerability",
            "date": "2026-04-16 07:08:46",
            "url": "https://wordpress.org/support/topic/ross-site-scripting-xss-vulnerability/",
            "starter": "memt-network",
            "keyword": "hacked"
        }
    ],
    "explanation": "Cluster of support-forum threads in the last 90 days containing user-reported attack vocabulary. Critical when any thread mentions explicit compromise terms (hacked / backdoor / admin user added); high when two or more mention symptom-class terms (redirect to spam / vendor alerts)."
}

{
    "slug": "theme-check",
    "finding_count": 2,
    "findings": [
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "checks/class-bad-things-check.php",
            "line": 34,
            "snippet": "'/(?<![_|a-z0-9|\\.])eval\\s?\\(/i' => __( 'eval() is not allowed.', 'theme-check' ),",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "checks/class-bad-things-check.php",
            "line": 37,
            "snippet": "'/base64_decode/'                => __( 'base64_decode() is not allowed', 'theme-check' ),",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "9e34e8835b18df99112a85e4eaec4a8fa043d640"
}

{
    "slug": "classic-editor",
    "finding_count": 1,
    "findings": [
        {
            "pattern": "Upgrade",
            "kind": "ioc:changelog_phrase",
            "file": "readme.txt",
            "line": 72,
            "snippet": "* Fixed condition for displaying of the after upgrade notice on the \"What's New\" screen. Shown when the classic editor is selected and users cannot switch editors.",
            "confidence": "low"
        }
    ],
    "triage_note_2026_05_03": "classic-editor: single Upgrade hit on \"after upgrade notice\" text. Automattic-owned classic editor compatibility plugin."
}