Events

{
    "slug": "fluentform",
    "finding_count": 1,
    "findings": [
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "app/Modules/Payments/PaymentMethods/Stripe/StripeHandler.php",
            "line": 145,
            "snippet": "wp_enqueue_script('stripe_elements', 'https://js.stripe.com/v3/', array('jquery'), '3.0', true);",
            "confidence": "medium",
            "details": {
                "url": "https://js.stripe.com/v3/",
                "url_host": "js.stripe.com"
            }
        }
    ],
    "resolved_sha": "5a600146365db9ac75dca5328b6fc3e3b70c0f91"
}

{
    "slug": "mainwp-child",
    "finding_count": 47,
    "findings": [
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "class/class-mainwp-child-ithemes-security.php",
            "line": 422,
            "snippet": "$update_settings = isset( $_POST['settings'] ) ? json_decode( base64_decode( wp_unslash( $_POST['settings'] ) ), true ) : ''; // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions  -- base64_e",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "class/class-mainwp-child-ithemes-security.php",
            "line": 671,
            "snippet": "$data        = isset( $_POST['data'] ) ? json_decode( base64_decode( wp_unslash( $_POST['data'] ) ), true ) : array(); // phpcs:ignore WordPress.Security.NonceVerification,WordPress.Security.V",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "class/class-mainwp-child-timecapsule.php",
            "line": 1655,
            "snippet": "$data = isset( $_POST['data'] ) ? json_decode( base64_decode( wp_unslash( $_POST['data'] ) ), true ) : array(); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,Wor",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "class/class-mainwp-wordpress-seo.php",
            "line": 112,
            "snippet": "$file_url       = ! empty( $_POST['file_url'] ) ? sanitize_text_field( base64_decode( wp_unslash( $_POST['file_url'] ) ) ) : ''; // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions, Word",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "class/class-mainwp-wordpress-seo.php",
            "line": 136,
            "snippet": "$settings = ! empty( $_POST['settings'] ) ? base64_decode( wp_unslash( $_POST['settings'] ) ) : ''; // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions,WordPress.Security.ValidatedSa",
            "confidence": "medium"
        },
        {
            "pattern": "wpconfig_write",
            "kind": "builtin",
            "file": "class/class-mainwp-clone-install.php",
            "line": 280,
            "snippet": "$wpConfig = file_get_contents( ABSPATH . 'wp-config.php' ); //phpcs:ignore WordPress.WP.AlternativeFunctions",
            "confidence": "medium"
        },
        {
            "pattern": "wpconfig_write",
            "kind": "builtin",
            "file": "class/class-mainwp-clone-install.php",
            "line": 285,
            "snippet": "MainWP_Helper::file_put_contents( ABSPATH . 'wp-config.php', $wpConfig ); //phpcs:ignore WordPress.WP.AlternativeFunctions",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "class/class-mainwp-child-users.php",
            "line": 547,
            "snippet": "$new_password = isset( $_POST['new_password'] ) ? base64_decode( wp_unslash( $_POST['new_password'] ) ) : '';  //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, Word",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "class/class-mainwp-child-users.php",
            "line": 607,
            "snippet": "$new_user      = isset( $_POST['new_user'] ) ? json_decode( base64_decode( wp_unslash( $_POST['new_user'] ) ), true ) : '';  //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotS",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "class/class-mainwp-connect.php",
            "line": 518,
            "snippet": "$auth = static::connect_verify( $func . $nonce, base64_decode( $signature ), base64_decode( get_option( 'mainwp_child_pubkey' ) ), $algo ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunc",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "class/class-mainwp-child-keys-manager.php",
            "line": 163,
            "snippet": "$encodedValue = base64_decode( $encodedValue ); //phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions -- safe.",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "class/class-mainwp-child-keys-manager.php",
            "line": 177,
            "snippet": "$encryptedValue = base64_decode( $encodedValue ); //phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions -- safe.",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "class/class-mainwp-child-pagespeed.php",
            "line": 276,
            "snippet": "$settings = isset( $_POST['settings'] ) ? json_decode( base64_decode( wp_unslash( $_POST['settings'] ) ), true ) : array(); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions,WordPress.Secu",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "class/class-mainwp-child-wordfence.php",
            "line": 1551,
            "snippet": "$settings = isset( $_POST['settings'] ) ? json_decode( base64_decode( wp_unslash( $_POST['settings'] )), true ) : array(); // phpcs:ignore -- custom fix to pass through security rules of Dream",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "class/class-mainwp-child-wp-rocket.php",
            "line": 937,
            "snippet": "$options = isset( $_POST['settings'] ) ? json_decode( base64_decode( wp_unslash( $_POST['settings'] ) ), true ) : '';  //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitiz",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "8d6aa3845211ae7d39a690c5ef44bbea01e5837a"
}

{
    "slug": "woocommerce-gateway-stripe",
    "finding_count": 3,
    "findings": [
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "includes/payment-methods/class-wc-stripe-upe-payment-gateway.php",
            "line": 472,
            "snippet": "wp_register_script( 'stripe', 'https://js.stripe.com/clover/stripe.js', [], null, true );",
            "confidence": "medium",
            "details": {
                "url": "https://js.stripe.com/clover/stripe.js",
                "url_host": "js.stripe.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "includes/payment-methods/class-wc-stripe-express-checkout-element.php",
            "line": 398,
            "snippet": "wp_register_script( 'stripe', 'https://js.stripe.com/clover/stripe.js', '', null, true );",
            "confidence": "medium",
            "details": {
                "url": "https://js.stripe.com/clover/stripe.js",
                "url_host": "js.stripe.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "includes/abstracts/abstract-wc-stripe-payment-gateway.php",
            "line": 2219,
            "snippet": "wp_register_script( 'stripe', 'https://js.stripe.com/clover/stripe.js', [], null, true );",
            "confidence": "medium",
            "details": {
                "url": "https://js.stripe.com/clover/stripe.js",
                "url_host": "js.stripe.com"
            }
        }
    ],
    "resolved_sha": "dbbdeb60b4d3e9142473ec8c32fc572198e3af51"
}

{
    "slug": "better-wp-security",
    "finding_count": 1,
    "findings": [
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "lib/icon-fonts/init.php",
            "line": 44,
            "snippet": "wp_enqueue_style( 'ithemes-icon-font', \"$url/icon-fonts.css\" );",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "639e942e709ff22d93f34e1b8d356e1f1a5a7b31"
}

{
    "slug": "duracelltomi-google-tag-manager",
    "finding_count": 40,
    "findings": [
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "integration/vimeo.php",
            "line": 15,
            "snippet": "wp_enqueue_script( 'gtm4wp-vimeo-api', 'https://player.vimeo.com/api/player.js', array(), '1.0', $in_footer );",
            "confidence": "medium",
            "details": {
                "url": "https://player.vimeo.com/api/player.js",
                "url_host": "player.vimeo.com"
            }
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 647,
            "snippet": "'http://112.74.195.169/upload/xmlfiles/STUDIO_X8_HD.XML'                                              => [ 'BLU', 'Studio X8 HD', 'Android', DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 699,
            "snippet": "'http://221.176.65.117/uaprof/CMDC_M601.xml'                                                          => [ 'China Mobile', 'M601', 'Android', DeviceType::TABLET ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 701,
            "snippet": "'http://221.176.65.117/uaprof/CMCC-M812.xml'                                                          => [ 'China Mobile Device', 'and M812', 'Android', DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 702,
            "snippet": "'http://221.176.65.117/uaprof/M821.xml'                                                               => [ 'China Mobile Device', 'and M821', 'Android', DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 703,
            "snippet": "'http://221.176.65.117/uaprof/M823.xml'                                                               => [ 'China Mobile Device', 'and M823', 'Android', DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 722,
            "snippet": "'http://122.200.68.229/docs/mini3ix.xml'                                                              => [ 'Dell', 'Mini 3ix', 'Android', DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 754,
            "snippet": "'http://211.42.201.70/ua_profile/FLY-2040i.xml'                                                       => [ 'Fly', '2040', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 755,
            "snippet": "'http://211.42.201.70/ua_profile/FLY-2040L.xml'                                                       => [ 'Fly', '2040', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 758,
            "snippet": "'http://211.42.201.70/ua_profile/Fly-E300.xml'                                                        => [ 'Fly', 'E300', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 814,
            "snippet": "'http://211.42.201.70/ua_profile/Fly-LX610.xml'                                                       => [ 'Fly', 'LX610', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 817,
            "snippet": "'http://211.42.201.70/ua_profile/FLY-MX200i.xml'                                                      => [ 'Fly', 'MX200', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 818,
            "snippet": "'http://211.42.201.70/ua_profile/FLY-MX230.xml'                                                       => [ 'Fly', 'MX230', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 819,
            "snippet": "'http://211.42.201.70/ua_profile/FLY-MX300.xml'                                                       => [ 'Fly', 'MX300', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 820,
            "snippet": "'http://211.42.201.70/ua_profile/FLY-MX330.xml'                                                       => [ 'Fly', 'MX330', null, DeviceType::MOBILE ],",
            "confidence": "high"
        }
    ],
    "resolved_sha": "485c7d71dd677a92eac4c39fc5f796c0f484958f"
}

{
    "slug": "woocommerce-paypal-payments",
    "finding_count": 2,
    "findings": [
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "modules/ppcp-fraud-protection/src/Recaptcha/Recaptcha.php",
            "line": 83,
            "snippet": "wp_enqueue_script('ppcp-recaptcha', 'https://www.google.com/recaptcha/api.js?render=' . esc_attr($this->integration->get_option('site_key_v3')), array(), $this->asset_version, \\true);",
            "confidence": "medium",
            "details": {
                "url": "https://www.google.com/recaptcha/api.js?render=",
                "url_host": "www.google.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "modules/ppcp-settings/src/Service/ScriptDataHandler.php",
            "line": 92,
            "snippet": "wp_enqueue_script('ppcp-paylater-configurator-lib', 'https://www.paypalobjects.com/merchant-library/merchant-configurator.js', array('wp-i18n'), $script_asset_file['version'], \\true);",
            "confidence": "medium",
            "details": {
                "url": "https://www.paypalobjects.com/merchant-library/merchant-configurator.js",
                "url_host": "www.paypalobjects.com"
            }
        }
    ],
    "resolved_sha": "f3b70bf7cdab0447af3c5a98b7d72ab32aef52d1"
}

{
    "slug": "smart-slider-3",
    "finding_count": 77,
    "findings": [
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "nextend/library/libraries/zip/reader.php",
            "line": 142,
            "snippet": "$data = gzinflate($data);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_string_long",
            "kind": "builtin",
            "file": "nextend/library/libraries/zip/reader.php",
            "line": 114,
            "snippet": "$centralDirectoryData = unpack('vmadeversion/vextractversion/vflag/vcompressmethod/vmodtime/vmoddate/Vcrc/Vcompressedsize/Vuncompressedsize/vfilenamelength/vextrafieldlength/vcommentlength",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "nextend/library/libraries/base64.php",
            "line": 13,
            "snippet": "return base64_decode($data);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_string_long",
            "kind": "builtin",
            "file": "library/smartslider/plugins/widget/bullet/bullet.php",
            "line": 62,
            "snippet": "new N2ElementStyle($thumbnail, 'widget-bullet-thumbnail-style', n2_('Style'), 'eyJuYW1lIjoiU3RhdGljIiwiZGF0YSI6W3siYmFja2dyb3VuZGNvbG9yIjoiMDAwMDAwODAiLCJwYWRkaW5nIjoiM3wqfDN8KnwzfCp8M3wqfHB4I",
            "confidence": "medium"
        },
        {
            "pattern": "base64_string_long",
            "kind": "builtin",
            "file": "library/smartslider/plugins/widgetthumbnail/default/default.php",
            "line": 18,
            "snippet": "'widget-thumbnail-style-bar'               => 'eyJuYW1lIjoiU3RhdGljIiwiZGF0YSI6W3siYmFja2dyb3VuZGNvbG9yIjoiMjQyNDI0ZmYiLCJwYWRkaW5nIjoiM3wqfDN8KnwzfCp8M3wqfHB4IiwiYm94c2hhZG93IjoiMHwqfDB8K",
            "confidence": "medium"
        },
        {
            "pattern": "base64_string_long",
            "kind": "builtin",
            "file": "library/smartslider/plugins/widgetthumbnail/default/default.php",
            "line": 19,
            "snippet": "'widget-thumbnail-style-slides'            => 'eyJuYW1lIjoiU3RhdGljIiwiZGF0YSI6W3siYmFja2dyb3VuZGNvbG9yIjoiMDAwMDAwMDAiLCJwYWRkaW5nIjoiMHwqfDB8KnwwfCp8MHwqfHB4IiwiYm94c2hhZG93IjoiMHwqfDB8K",
            "confidence": "medium"
        },
        {
            "pattern": "base64_string_long",
            "kind": "builtin",
            "file": "library/smartslider/plugins/widgetthumbnail/default/default.php",
            "line": 26,
            "snippet": "'widget-thumbnail-title-style'             => 'eyJuYW1lIjoiU3RhdGljIiwiZGF0YSI6W3siYmFja2dyb3VuZGNvbG9yIjoiMDAwMDAwYWIiLCJwYWRkaW5nIjoiM3wqfDEwfCp8M3wqfDEwfCp8cHgiLCJib3hzaGFkb3ciOiIwfCp8M",
            "confidence": "medium"
        },
        {
            "pattern": "base64_string_long",
            "kind": "builtin",
            "file": "library/smartslider/plugins/widgetthumbnail/default/default.php",
            "line": 28,
            "snippet": "'widget-thumbnail-title-font'              => 'eyJuYW1lIjoiU3RhdGljIiwiZGF0YSI6W3siY29sb3IiOiJmZmZmZmZmZiIsInNpemUiOiIxMnx8cHgiLCJ0c2hhZG93IjoiMHwqfDB8KnwwfCp8MDAwMDAwYWIiLCJhZm9udCI6Ik1vb",
            "confidence": "medium"
        },
        {
            "pattern": "base64_string_long",
            "kind": "builtin",
            "file": "library/smartslider/plugins/widgetthumbnail/default/default.php",
            "line": 30,
            "snippet": "'widget-thumbnail-description-font'        => 'eyJuYW1lIjoiU3RhdGljIiwiZGF0YSI6W3siY29sb3IiOiJmZmZmZmZmZiIsInNpemUiOiIxMnx8cHgiLCJ0c2hhZG93IjoiMHwqfDB8KnwwfCp8MDAwMDAwYWIiLCJhZm9udCI6Ik1vb",
            "confidence": "medium"
        },
        {
            "pattern": "base64_string_long",
            "kind": "builtin",
            "file": "library/smartslider/plugins/widgetarrow/image/image.php",
            "line": 21,
            "snippet": "'widget-arrow-style'                    => 'eyJuYW1lIjoiU3RhdGljIiwiZGF0YSI6W3siYmFja2dyb3VuZGNvbG9yIjoiMDAwMDAwYWIiLCJwYWRkaW5nIjoiMjB8KnwxMHwqfDIwfCp8MTB8KnxweCIsImJveHNoYWRvdyI6IjB8Knww",
            "confidence": "medium"
        },
        {
            "pattern": "base64_string_long",
            "kind": "builtin",
            "file": "library/smartslider/plugins/widgetarrow/image/image.php",
            "line": 291,
            "snippet": "'widget-arrow-style'              => 'eyJuYW1lIjoiU3RhdGljIiwiZGF0YSI6W3siYmFja2dyb3VuZGNvbG9yIjoiMDAwMDAwYWIiLCJwYWRkaW5nIjoiMnwqfDJ8KnwyfCp8MnwqfHB4IiwiYm94c2hhZG93IjoiMHwqfDB8KnwwfCp8MH",
            "confidence": "medium"
        },
        {
            "pattern": "base64_string_long",
            "kind": "builtin",
            "file": "library/smartslider/plugins/widgetbar/horizontal/horizontal.php",
            "line": 17,
            "snippet": "'widget-bar-style'            => 'eyJuYW1lIjoiU3RhdGljIiwiZGF0YSI6W3siYmFja2dyb3VuZGNvbG9yIjoiMDAwMDAwYWIiLCJwYWRkaW5nIjoiNXwqfDIwfCp8NXwqfDIwfCp8cHgiLCJib3hzaGFkb3ciOiIwfCp8MHwqfDB8KnwwfC",
            "confidence": "medium"
        },
        {
            "pattern": "base64_string_long",
            "kind": "builtin",
            "file": "library/smartslider/plugins/widgetbar/horizontal/horizontal.php",
            "line": 19,
            "snippet": "'widget-bar-font-title'       => 'eyJuYW1lIjoiU3RhdGljIiwiZGF0YSI6W3siY29sb3IiOiJmZmZmZmZmZiIsInNpemUiOiIxNHx8cHgiLCJ0c2hhZG93IjoiMHwqfDB8KnwwfCp8MDAwMDAwYzciLCJhZm9udCI6Ik1vbnRzZXJyYXQiLC",
            "confidence": "medium"
        },
        {
            "pattern": "base64_string_long",
            "kind": "builtin",
            "file": "library/smartslider/plugins/widgetbar/horizontal/horizontal.php",
            "line": 21,
            "snippet": "'widget-bar-font-description' => 'eyJuYW1lIjoiU3RhdGljIiwiZGF0YSI6W3siY29sb3IiOiJmZmZmZmZmZiIsInNpemUiOiIxNHx8cHgiLCJ0c2hhZG93IjoiMHwqfDB8KnwwfCp8MDAwMDAwYzciLCJhZm9udCI6Ik1vbnRzZXJyYXQiLC",
            "confidence": "medium"
        },
        {
            "pattern": "base64_string_long",
            "kind": "builtin",
            "file": "library/smartslider/plugins/widgetbar/horizontal/horizontal.php",
            "line": 201,
            "snippet": "'widget-bar-style'           => 'eyJuYW1lIjoiU3RhdGljIiwiZGF0YSI6W3siYmFja2dyb3VuZGNvbG9yIjoiMDAwMDAwYWIiLCJwYWRkaW5nIjoiMjB8KnwyMHwqfDIwfCp8MjB8KnxweCIsImJveHNoYWRvdyI6IjB8KnwwfCp8MHwqfDB",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "317b1c44350209e244b6fe5213671b55e1a3a374"
}

{
    "slug": "wp-reviews-plugin-for-google",
    "finding_count": 7,
    "findings": [
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "trustindex-plugin.class.php",
            "line": 6095,
            "snippet": "wp_enqueue_style('trustindex-widget-preview-'.$fileName, \"https://cdn.trustindex.io/assets/widget-presetted-css/v2/$fileName\", [], true);",
            "confidence": "medium",
            "details": {
                "url": "https://cdn.trustindex.io/assets/widget-presetted-css/v2/$fileName",
                "url_host": "cdn.trustindex.io"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "trustindex-plugin.class.php",
            "line": 6146,
            "snippet": "wp_enqueue_script('trustindex-loader-js', 'https://cdn.trustindex.io/loader.js', [], true, [",
            "confidence": "medium",
            "details": {
                "url": "https://cdn.trustindex.io/loader.js",
                "url_host": "cdn.trustindex.io"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "wp-reviews-plugin-for-google.php",
            "line": 81,
            "snippet": "wp_register_script('trustindex-loader-js', 'https://cdn.trustindex.io/loader.js', [], true, [",
            "confidence": "medium",
            "details": {
                "url": "https://cdn.trustindex.io/loader.js",
                "url_host": "cdn.trustindex.io"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "tabs/free-widget-configurator.php",
            "line": 476,
            "snippet": "wp_enqueue_style('trustindex-widget-preview-css', 'https://cdn.trustindex.io/assets/ti-preview-box.css', [], true);",
            "confidence": "medium",
            "details": {
                "url": "https://cdn.trustindex.io/assets/ti-preview-box.css",
                "url_host": "cdn.trustindex.io"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "tabs/my-reviews.php",
            "line": 142,
            "snippet": "wp_enqueue_style('trustindex-widget-css', 'https://cdn.trustindex.io/assets/widget-presetted-css/4-light-background.css', [], true);",
            "confidence": "medium",
            "details": {
                "url": "https://cdn.trustindex.io/assets/widget-presetted-css/4-light-background.css",
                "url_host": "cdn.trustindex.io"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "tabs/my-reviews.php",
            "line": 143,
            "snippet": "wp_enqueue_script('trustindex-review-js', 'https://cdn.trustindex.io/assets/js/trustindex-review.js', [], true, true);",
            "confidence": "medium",
            "details": {
                "url": "https://cdn.trustindex.io/assets/js/trustindex-review.js",
                "url_host": "cdn.trustindex.io"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "tabs/rate-us.php",
            "line": 3,
            "snippet": "wp_enqueue_script('trustindex-js', 'https://cdn.trustindex.io/loader.js', [], true, true);",
            "confidence": "medium",
            "details": {
                "url": "https://cdn.trustindex.io/loader.js",
                "url_host": "cdn.trustindex.io"
            }
        }
    ],
    "resolved_sha": "309145b6a734c63580269341f73ef50d4fc86122"
}

{
    "slug": "gtranslate",
    "finding_count": 2,
    "findings": [
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "gtranslate.php",
            "line": 197,
            "snippet": "wp_enqueue_script('gt_widget_script_' . $unique_id, 'https://cdn.gtranslate.net/widgets/latest/base.js', array(), '', true);",
            "confidence": "medium",
            "details": {
                "url": "https://cdn.gtranslate.net/widgets/latest/base.js",
                "url_host": "cdn.gtranslate.net"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "gtranslate.php",
            "line": 352,
            "snippet": "wp_enqueue_script('gt_widget_script_' . $unique_id, 'https://cdn.gtranslate.net/widgets/latest/' . $widget_short_name . '.js', array(), '', true);",
            "confidence": "medium",
            "details": {
                "url": "https://cdn.gtranslate.net/widgets/latest/",
                "url_host": "cdn.gtranslate.net"
            }
        }
    ],
    "resolved_sha": "d4527ef57c6098b18be5856be349feb439955344"
}

{
    "slug": "cookie-notice",
    "finding_count": 3,
    "findings": [
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "includes/welcome.php",
            "line": 119,
            "snippet": "wp_enqueue_script( 'cookie-notice-braintree-client', 'https://js.braintreegateway.com/web/3.71.0/js/client.min.js', [], null, false );",
            "confidence": "medium",
            "details": {
                "url": "https://js.braintreegateway.com/web/3.71.0/js/client.min.js",
                "url_host": "js.braintreegateway.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "includes/welcome.php",
            "line": 120,
            "snippet": "wp_enqueue_script( 'cookie-notice-braintree-hostedfields', 'https://js.braintreegateway.com/web/3.71.0/js/hosted-fields.min.js', [], null, false );",
            "confidence": "medium",
            "details": {
                "url": "https://js.braintreegateway.com/web/3.71.0/js/hosted-fields.min.js",
                "url_host": "js.braintreegateway.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "includes/welcome.php",
            "line": 121,
            "snippet": "wp_enqueue_script( 'cookie-notice-braintree-paypal', 'https://js.braintreegateway.com/web/3.71.0/js/paypal-checkout.min.js', [], null, false );",
            "confidence": "medium",
            "details": {
                "url": "https://js.braintreegateway.com/web/3.71.0/js/paypal-checkout.min.js",
                "url_host": "js.braintreegateway.com"
            }
        }
    ],
    "resolved_sha": "964b90725ad6475b5a32fb8dddad0b170f173aae"
}

{
    "slug": "custom-post-type-ui",
    "finding_count": 2,
    "findings": [
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "inc/utility.php",
            "line": 450,
            "snippet": "wp_enqueue_style( 'cptui-emailoctopus', 'https://emailoctopus.com/bundles/emailoctopuslist/css/formEmbed.css' ); // phpcs:ignore",
            "confidence": "medium",
            "details": {
                "url": "https://emailoctopus.com/bundles/emailoctopuslist/css/formEmbed.css",
                "url_host": "emailoctopus.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "inc/utility.php",
            "line": 452,
            "snippet": "wp_enqueue_script( 'cptui-emailoctopus-js', 'https://emailoctopus.com/bundles/emailoctopuslist/js/1.4/formEmbed.js', [ 'jquery' ], '', true ); // phpcs:ignore",
            "confidence": "medium",
            "details": {
                "url": "https://emailoctopus.com/bundles/emailoctopuslist/js/1.4/formEmbed.js",
                "url_host": "emailoctopus.com"
            }
        }
    ],
    "resolved_sha": "d073b2e9c15bfdb5ca0de39abeccb14bd649e01e"
}

{
    "slug": "wp-fastest-cache",
    "finding_count": 2,
    "findings": [
        {
            "pattern": "wpconfig_write",
            "kind": "builtin",
            "file": "inc/admin.php",
            "line": 381,
            "snippet": "if($wp_config = @file_get_contents(ABSPATH.\"wp-config.php\")){",
            "confidence": "medium"
        },
        {
            "pattern": "wpconfig_write",
            "kind": "builtin",
            "file": "inc/admin.php",
            "line": 384,
            "snippet": "if(!@file_put_contents(ABSPATH.\"wp-config.php\", $wp_config)){",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "bd19d41004740fb12b65cb53ac8924a49f3b732b"
}

{
    "slug": "essential-addons-for-elementor-lite",
    "finding_count": 2,
    "findings": [
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "includes/Elements/Login_Register.php",
            "line": 6182,
            "snippet": "wp_register_script('eael-recaptcha-v3', \"https://www.recaptcha.net/recaptcha/api.js?{$recaptcha_api_args1}\", false, EAEL_PLUGIN_VERSION, false);",
            "confidence": "medium",
            "details": {
                "url": "https://www.recaptcha.net/recaptcha/api.js?{$recaptcha_api_args1}",
                "url_host": "www.recaptcha.net"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "includes/Traits/Enqueue.php",
            "line": 48,
            "snippet": "wp_register_script('eael-recaptcha', \"https://www.recaptcha.net/recaptcha/api.js?{$recaptcha_api_args}\", false, EAEL_PLUGIN_VERSION, false);",
            "confidence": "medium",
            "details": {
                "url": "https://www.recaptcha.net/recaptcha/api.js?{$recaptcha_api_args}",
                "url_host": "www.recaptcha.net"
            }
        }
    ],
    "resolved_sha": "0c014dc1fa52f91db5cd9e472c5a7d140a7d9ae9"
}

{
    "slug": "insert-headers-and-footers",
    "finding_count": 4,
    "findings": [
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "includes/generator/class-wpcode-generator-style.php",
            "line": 280,
            "snippet": "$enqueue      = 'true' === $styles_enqueue[ $key ] ? \"wp_enqueue_style( '$style' );\" : '';",
            "confidence": "medium"
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "includes/generator/class-wpcode-generator-style.php",
            "line": 285,
            "snippet": "wp_register_style( '$style', '$styles_urls[$key]', {$this->array_to_code_string($dependencies)}, '$styles_versions[$key]'$media );",
            "confidence": "medium"
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "includes/generator/class-wpcode-generator-script.php",
            "line": 279,
            "snippet": "$enqueue      = 'true' === $scripts_enqueue[ $key ] ? \"wp_enqueue_script( '$script_name' );\" : '';",
            "confidence": "medium"
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "includes/generator/class-wpcode-generator-script.php",
            "line": 283,
            "snippet": "wp_register_script( '$script_name', '$scripts_urls[$key]', {$this->array_to_code_string($dependencies)}, '$scripts_versions[$key]', $scripts_locations[$key] );",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "ce01147183d9a621f4f1d3b4cd7d4447fd5f1257"
}

{
    "slug": "invoize",
    "author_slug": "wpsora",
    "burst_start": "2026-05-05 00:06:54",
    "burst_end": "2026-05-05 00:41:07",
    "burst_commits": 16,
    "burst_window_minutes": 90,
    "tenure_days": 194,
    "distinct_messages": 16,
    "avg_message_length": 11.3,
    "top_message": "wrong folder and files",
    "top_message_count": 1,
    "prt_revert": null,
    "explanation": "Established author committed 16 revisions inside a 90-minute window with low-entropy commit messages. Pattern matches the June 2024 wp.org credential-stuffing wave shape; bumped to critical when followed by a wp.org Plugin Review Team revert within 7 days."
}

{
    "committer": "tripathytanmay",
    "member_since": "2021-01-14",
    "plugins_joined": 6,
    "spread_days": 33,
    "earliest_join": "2021-02-12 05:17:20",
    "latest_join": "2021-03-17 08:05:22",
    "combined_installs": 800,
    "sample_plugins": [
        {
            "slug": "checkout-address-autofill-for-woocommerce",
            "active_installs": 400,
            "first_commit_at": "2021-02-26 10:26:34"
        },
        {
            "slug": "catalog-mode-for-woocommerce",
            "active_installs": 300,
            "first_commit_at": "2021-02-17 07:29:48"
        },
        {
            "slug": "coupon-by-roles-for-woocommerce",
            "active_installs": 100,
            "first_commit_at": "2021-02-17 13:20:58"
        },
        {
            "slug": "integrate-caldera-forms-salesforce",
            "active_installs": 0,
            "first_commit_at": "2021-02-17 10:54:44"
        },
        {
            "slug": "woo-mailchimp-newsletter-discount",
            "active_installs": 0,
            "first_commit_at": "2021-03-17 08:05:22"
        },
        {
            "slug": "zetamatic-integration-hubspot-caldera-forms",
            "active_installs": 0,
            "first_commit_at": "2021-02-12 05:17:20"
        }
    ]
}

{
    "committer": "codedart",
    "member_since": "2015-08-23",
    "plugins_joined": 5,
    "spread_days": 52,
    "earliest_join": "2016-02-01 17:07:40",
    "latest_join": "2016-03-25 12:58:59",
    "combined_installs": 12800,
    "sample_plugins": [
        {
            "slug": "simple-embed-code",
            "active_installs": 10000,
            "first_commit_at": "2016-02-01 17:07:40"
        },
        {
            "slug": "artiss-currency-converter",
            "active_installs": 1000,
            "first_commit_at": "2016-03-08 13:24:12"
        },
        {
            "slug": "artiss-transient-cleaner",
            "active_installs": 1000,
            "first_commit_at": "2016-02-27 14:40:12"
        },
        {
            "slug": "plugins-list",
            "active_installs": 800,
            "first_commit_at": "2016-03-24 14:53:30"
        },
        {
            "slug": "wp-readme-parser",
            "active_installs": 0,
            "first_commit_at": "2016-03-25 12:58:59"
        }
    ],
    "triage_note_2026_05_03": "codedart is a legacy handle of David Artiss (now @dartiss). All slugs are artiss-* family; his own original plugins."
}

{
    "committer": "noahkagan",
    "member_since": "2014-09-15",
    "plugins_joined": 7,
    "spread_days": 58,
    "earliest_join": "2015-05-07 19:53:05",
    "latest_join": "2015-07-05 15:51:40",
    "combined_installs": 74000,
    "sample_plugins": [
        {
            "slug": "underconstruction",
            "active_installs": 40000,
            "first_commit_at": "2015-07-05 15:51:40"
        },
        {
            "slug": "social-media-widget",
            "active_installs": 30000,
            "first_commit_at": "2015-06-10 04:22:35"
        },
        {
            "slug": "mail-subscribe-list",
            "active_installs": 3000,
            "first_commit_at": "2015-05-09 15:45:46"
        },
        {
            "slug": "simple-popup-plugin",
            "active_installs": 1000,
            "first_commit_at": "2015-05-08 22:58:45"
        },
        {
            "slug": "google-analyticator",
            "active_installs": 0,
            "first_commit_at": "2015-05-13 05:01:09"
        },
        {
            "slug": "social-popup",
            "active_installs": 0,
            "first_commit_at": "2015-05-07 19:53:05"
        },
        {
            "slug": "wp-google-fonts",
            "active_installs": 0,
            "first_commit_at": "2015-06-02 21:43:44"
        }
    ],
    "triage_note_2026_05_03": "Noah Kagan / AppSumo Sumo Group 2015 plugin acquisitions; underconstruction has since transferred again to @grimmdude. Historical handoff, no malicious code."
}

{
    "committer": "rrv4813",
    "member_since": "2016-12-01",
    "plugins_joined": 5,
    "spread_days": 36,
    "earliest_join": "2016-12-28 06:15:16",
    "latest_join": "2017-02-02 23:29:04",
    "combined_installs": 101000,
    "sample_plugins": [
        {
            "slug": "blogvault-real-time-backup",
            "active_installs": 80000,
            "first_commit_at": "2017-02-02 23:29:04"
        },
        {
            "slug": "bv-cloudways-automated-migration",
            "active_installs": 20000,
            "first_commit_at": "2017-02-02 18:37:46"
        },
        {
            "slug": "bv-pantheon-migration",
            "active_installs": 1000,
            "first_commit_at": "2017-02-02 18:45:07"
        },
        {
            "slug": "savvii-wp-migrate",
            "active_installs": 0,
            "first_commit_at": "2016-12-28 06:15:16"
        },
        {
            "slug": "wp-site-migrate",
            "active_installs": 0,
            "first_commit_at": "2017-02-02 18:33:19"
        }
    ],
    "triage_note_2026_05_03": "rrv4813 = BlogVault team member. All slugs are bv-* / blogvault-* internal portfolio. Same-company contributor add."
}

{
    "committer": "pbaylies",
    "member_since": "2011-05-02",
    "plugins_joined": 5,
    "spread_days": 0,
    "earliest_join": "2012-12-13 16:30:54",
    "latest_join": "2012-12-13 20:20:30",
    "combined_installs": 800,
    "sample_plugins": [
        {
            "slug": "all-in-one-seo-pack-importer",
            "active_installs": 500,
            "first_commit_at": "2012-12-13 19:52:52"
        },
        {
            "slug": "display-name-author-permalink",
            "active_installs": 200,
            "first_commit_at": "2012-12-13 20:09:12"
        },
        {
            "slug": "ft-calendar",
            "active_installs": 100,
            "first_commit_at": "2012-12-13 18:59:36"
        },
        {
            "slug": "moderate-selected-posts",
            "active_installs": 0,
            "first_commit_at": "2012-12-13 20:20:30"
        },
        {
            "slug": "simplemap",
            "active_installs": 0,
            "first_commit_at": "2012-12-13 16:30:54"
        }
    ],
    "triage_note_2026_05_03": "Peter Baylies (Purcado dev), 2012 oldtimer cohort. All 5 plugins committed same day = original portfolio publication on wp.org account creation."
}

{
    "slug": "wp-antivirus-site-protection",
    "reason": "Anchor for audit #27 \u2014 SiteGuarding 27-plugin portfolio (2013-2020 era), wp.org mass-closed 2020-05-04 \u2192 2020-06-05. Connected to audit #25 (lulub5592 burner) and #26 (dalielsam burner) via SafetyBis Ltd / DRAFIELO LIMITED corporate trail and shared C2 infrastructure (siteguarding.com, cmsplughub.com NS = NS1.SITEGUARDING.COM). Manually seeded for portfolio-level audit linkage.",
    "linked_audits": [
        25,
        26
    ],
    "portfolio_size": 27,
    "portfolio_install_base": "4690+"
}

{
    "slug": "jetpack",
    "finding_count": 8,
    "findings": [
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "extensions/blocks/pinterest/pinterest.php",
            "line": 241,
            "snippet": "wp_enqueue_script( 'pinterest-pinit', 'https://assets.pinterest.com/js/pinit.js', array(), JETPACK__VERSION, true );",
            "confidence": "medium",
            "details": {
                "url": "https://assets.pinterest.com/js/pinit.js",
                "url_host": "assets.pinterest.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "extensions/blocks/tock/tock.php",
            "line": 51,
            "snippet": "wp_enqueue_script( 'tock-widget', 'https://www.exploretock.com/tock.js', array(), JETPACK__VERSION, true );",
            "confidence": "medium",
            "details": {
                "url": "https://www.exploretock.com/tock.js",
                "url_host": "www.exploretock.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "extensions/blocks/eventbrite/eventbrite.php",
            "line": 121,
            "snippet": "wp_enqueue_script( 'eventbrite-widget', 'https://www.eventbrite.com/static/widgets/eb_widgets.js', array(), JETPACK__VERSION, true );",
            "confidence": "medium",
            "details": {
                "url": "https://www.eventbrite.com/static/widgets/eb_widgets.js",
                "url_host": "www.eventbrite.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "extensions/blocks/eventbrite/eventbrite.php",
            "line": 210,
            "snippet": "wp_enqueue_script( 'eventbrite-widget', 'https://www.eventbrite.com/static/widgets/eb_widgets.js', array(), JETPACK__VERSION, true );",
            "confidence": "medium",
            "details": {
                "url": "https://www.eventbrite.com/static/widgets/eb_widgets.js",
                "url_host": "www.eventbrite.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "extensions/blocks/calendly/calendly.php",
            "line": 87,
            "snippet": "wp_enqueue_style( 'jetpack-calendly-external-css', 'https://assets.calendly.com/assets/external/widget.css', null, JETPACK__VERSION );",
            "confidence": "medium",
            "details": {
                "url": "https://assets.calendly.com/assets/external/widget.css",
                "url_host": "assets.calendly.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "modules/videopress/shortcode.php",
            "line": 176,
            "snippet": "wp_register_script( 'videopress', 'https://v0.wordpress.com/js/videopress.js', array( 'jquery', 'swfobject' ), '1.09', false );",
            "confidence": "medium",
            "details": {
                "url": "https://v0.wordpress.com/js/videopress.js",
                "url_host": "v0.wordpress.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "modules/shortcodes/tweet.php",
            "line": 174,
            "snippet": "wp_register_script( 'twitter-widgets', 'https://platform.twitter.com/widgets.js', array(), JETPACK__VERSION, true );",
            "confidence": "medium",
            "details": {
                "url": "https://platform.twitter.com/widgets.js",
                "url_host": "platform.twitter.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "modules/gravatar-hovercards.php",
            "line": 273,
            "snippet": "wp_enqueue_script( 'grofiles-cards', 'https://secure.gravatar.com/js/gprofiles.js', array(), GROFILES__CACHE_BUSTER, true );",
            "confidence": "medium",
            "details": {
                "url": "https://secure.gravatar.com/js/gprofiles.js",
                "url_host": "secure.gravatar.com"
            }
        }
    ],
    "triage_note_2026_05_03": "jetpack: remote_enqueue matches are intentional widget integrations (pinterest, eventbrite, calendly, twitter, gravatar, videopress). Automattic-owned, intentional vendor JS embeds."
}

{
    "slug": "seo-by-rank-math",
    "finding_count": 2,
    "findings": [
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "includes/3rdparty/divi/class-divi.php",
            "line": 113,
            "snippet": "wp_register_script( 'rm-react', \"{$path}react{$suffix}.js\", [ 'wp-polyfill', 'react' ], '16.13.1', true );",
            "confidence": "medium"
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "includes/3rdparty/divi/class-divi.php",
            "line": 114,
            "snippet": "wp_register_script( 'rm-react-dom', \"{$path}react-dom{$suffix}.js\", [ 'rm-react', 'react-dom' ], '16.13.1', true );",
            "confidence": "medium"
        }
    ],
    "triage_note_2026_05_03": "seo-by-rank-math: remote_enqueue uses templated $path variable for local React script registration; no remote URL."
}

{
    "slug": "wordfence",
    "finding_count": 37,
    "findings": [
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wfActivityReport.php",
            "line": 592,
            "snippet": "$paramKey = base64_decode($actionData['paramKey']);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wfActivityReport.php",
            "line": 593,
            "snippet": "$paramValue = base64_decode($actionData['paramValue']);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wfUtils.php",
            "line": 3791,
            "snippet": "$intermediate = base64_decode($intermediate);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wfJWT.php",
            "line": 21,
            "snippet": "$decodedHeader = base64_decode($header);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wfJWT.php",
            "line": 32,
            "snippet": "$decodedBody = base64_decode($body);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wfJWT.php",
            "line": 91,
            "snippet": "$decodedHeader = base64_decode($header);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wfJWT.php",
            "line": 107,
            "snippet": "$decodedBody = base64_decode($body);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wfJWT.php",
            "line": 179,
            "snippet": "return base64_decode(strtr($data, '-_', '+/'));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wordfenceURLHoover.php",
            "line": 604,
            "snippet": "$skipList = new wfBinaryList(base64_decode(wfConfig::get('wfsbskip', '')));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wfLog.php",
            "line": 1356,
            "snippet": "$actionData[$key] = base64_decode($actionData[$key]);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wordfenceClass.php",
            "line": 1182,
            "snippet": "$iwpRequest = json_decode(trim(base64_decode($iwpRequestDataArray[1])), true);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wordfenceClass.php",
            "line": 7588,
            "snippet": "$waf->whitelistRuleForParam(base64_decode($_POST['path']), base64_decode($_POST['paramKey']),",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wordfenceClass.php",
            "line": 8116,
            "snippet": "$paramKey = base64_decode($actionData['paramKey']);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wordfenceClass.php",
            "line": 8117,
            "snippet": "$paramValue = base64_decode($actionData['paramValue']);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wordfenceClass.php",
            "line": 8356,
            "snippet": "$value['path'] = base64_decode($path);",
            "confidence": "medium"
        }
    ],
    "triage_note_2026_05_03": "wordfence: 37 base64_decode hits, all in legitimate JWT decode (lib/wfJWT.php), activity-report parameters, URL hoover skip-list. Standard security-plugin internals."
}

{
    "slug": "image-optimizer-x",
    "reason": "C2 sibling of wp-advanced-math-captcha audit #25 \u2014 CMSPlughubAPI_LicenseValidator.php ships side-channel update endpoint at api.cmsplughub.com (NS = NS1.SITEGUARDING.COM). Manually seeded for audit linkage.",
    "linked_audit": 25
}

{
    "committer": "mdawaffe",
    "member_since": "2004-10-07",
    "plugins_joined": 6,
    "spread_days": 0,
    "earliest_join": "2010-06-03 21:37:25",
    "latest_join": "2010-06-04 00:22:00",
    "combined_installs": 23000,
    "sample_plugins": [
        {
            "slug": "syntaxhighlighter",
            "active_installs": 20000,
            "first_commit_at": "2010-06-03 22:03:45"
        },
        {
            "slug": "disable-wpautop",
            "active_installs": 2000,
            "first_commit_at": "2010-06-04 00:22:00"
        },
        {
            "slug": "recent-posts",
            "active_installs": 400,
            "first_commit_at": "2010-06-04 00:18:44"
        },
        {
            "slug": "most-commented",
            "active_installs": 300,
            "first_commit_at": "2010-06-04 00:18:44"
        },
        {
            "slug": "recent-comments",
            "active_installs": 200,
            "first_commit_at": "2010-06-04 00:18:44"
        },
        {
            "slug": "syntaxhighlighter-plus",
            "active_installs": 100,
            "first_commit_at": "2010-06-03 21:37:25"
        }
    ]
}

{
    "committer": "mdawaffe",
    "member_since": "2004-10-07",
    "plugins_joined": 6,
    "spread_days": 0,
    "earliest_join": "2010-06-03 21:37:25",
    "latest_join": "2010-06-04 00:22:00",
    "combined_installs": 23000,
    "sample_plugins": [
        {
            "slug": "syntaxhighlighter",
            "active_installs": 20000,
            "first_commit_at": "2010-06-03 22:03:45"
        },
        {
            "slug": "disable-wpautop",
            "active_installs": 2000,
            "first_commit_at": "2010-06-04 00:22:00"
        },
        {
            "slug": "recent-posts",
            "active_installs": 400,
            "first_commit_at": "2010-06-04 00:18:44"
        },
        {
            "slug": "most-commented",
            "active_installs": 300,
            "first_commit_at": "2010-06-04 00:18:44"
        },
        {
            "slug": "recent-comments",
            "active_installs": 200,
            "first_commit_at": "2010-06-04 00:18:44"
        },
        {
            "slug": "syntaxhighlighter-plus",
            "active_installs": 100,
            "first_commit_at": "2010-06-03 21:37:25"
        }
    ]
}

{
    "slug": "modenapaymentgateway",
    "author_slug": "renemodena",
    "burst_start": "2026-04-28 13:18:26",
    "burst_end": "2026-04-28 14:25:38",
    "burst_commits": 14,
    "burst_window_minutes": 90,
    "tenure_days": 1257,
    "distinct_messages": 11,
    "avg_message_length": 30.5,
    "top_message": "refresh tag 4.3.2 from trunk",
    "top_message_count": 4,
    "prt_revert": null,
    "explanation": "Established author committed 14 revisions inside a 90-minute window with low-entropy commit messages. Pattern matches the June 2024 wp.org credential-stuffing wave shape; bumped to critical when followed by a wp.org Plugin Review Team revert within 7 days."
}

{
    "slug": "visual-builder",
    "author_slug": "dastan800",
    "burst_start": "2026-04-29 20:45:53",
    "burst_end": "2026-04-29 21:19:06",
    "burst_commits": 36,
    "burst_window_minutes": 90,
    "tenure_days": 514,
    "distinct_messages": 2,
    "avg_message_length": 6.3,
    "top_message": "update",
    "top_message_count": 33,
    "prt_revert": null,
    "explanation": "Established author committed 36 revisions inside a 90-minute window with low-entropy commit messages. Pattern matches the June 2024 wp.org credential-stuffing wave shape; bumped to critical when followed by a wp.org Plugin Review Team revert within 7 days."
}

{
    "slug": "modenapaymentgateway",
    "author_slug": "renemodena",
    "burst_start": "2026-04-28 13:18:26",
    "burst_end": "2026-04-28 14:25:38",
    "burst_commits": 14,
    "burst_window_minutes": 90,
    "tenure_days": 1257,
    "distinct_messages": 11,
    "avg_message_length": 30.5,
    "top_message": "refresh tag 4.3.2 from trunk",
    "top_message_count": 4,
    "prt_revert": null,
    "explanation": "Established author committed 14 revisions inside a 90-minute window with low-entropy commit messages. Pattern matches the June 2024 wp.org credential-stuffing wave shape; bumped to critical when followed by a wp.org Plugin Review Team revert within 7 days."
}

{
    "slug": "visual-builder",
    "author_slug": "dastan800",
    "burst_start": "2026-04-29 20:45:53",
    "burst_end": "2026-04-29 21:19:06",
    "burst_commits": 36,
    "burst_window_minutes": 90,
    "tenure_days": 514,
    "distinct_messages": 2,
    "avg_message_length": 6.3,
    "top_message": "update",
    "top_message_count": 33,
    "prt_revert": null,
    "explanation": "Established author committed 36 revisions inside a 90-minute window with low-entropy commit messages. Pattern matches the June 2024 wp.org credential-stuffing wave shape; bumped to critical when followed by a wp.org Plugin Review Team revert within 7 days."
}

{
    "committer": "stephenapproveme",
    "member_since": "2021-01-22",
    "plugins_joined": 7,
    "spread_days": 49,
    "earliest_join": "2021-01-26 17:09:52",
    "latest_join": "2021-03-17 16:13:50",
    "combined_installs": 4000,
    "sample_plugins": [
        {
            "slug": "gravity-signature-forms-add-on",
            "active_installs": 1000,
            "first_commit_at": "2021-01-26 17:09:52"
        },
        {
            "slug": "woocommerce-digital-signature",
            "active_installs": 1000,
            "first_commit_at": "2021-02-01 16:41:44"
        },
        {
            "slug": "wp-forms-signature-contract-add-on",
            "active_installs": 1000,
            "first_commit_at": "2021-02-01 17:59:33"
        },
        {
            "slug": "ninja-signature-contract-forms-add-on",
            "active_installs": 400,
            "first_commit_at": "2021-02-01 17:53:03"
        },
        {
            "slug": "digital-signature-contact-form-7-addon",
            "active_installs": 300,
            "first_commit_at": "2021-02-01 17:45:18"
        },
        {
            "slug": "forms-signature-formidable-online-contract-automation",
            "active_installs": 200,
            "first_commit_at": "2021-02-01 17:59:12"
        },
        {
            "slug": "e-signature-rtl-right-to-left",
            "active_installs": 100,
            "first_commit_at": "2021-03-17 16:13:50"
        }
    ]
}

{
    "committer": "leminhhung",
    "member_since": "2025-04-09",
    "plugins_joined": 6,
    "spread_days": 50,
    "earliest_join": "2025-12-05 08:09:30",
    "latest_join": "2026-01-24 08:24:12",
    "combined_installs": 17400,
    "sample_plugins": [
        {
            "slug": "woo-orders-tracking",
            "active_installs": 10000,
            "first_commit_at": "2026-01-20 02:40:43"
        },
        {
            "slug": "import-shopify-to-woocommerce",
            "active_installs": 3000,
            "first_commit_at": "2026-01-24 07:50:45"
        },
        {
            "slug": "product-size-chart-for-woo",
            "active_installs": 3000,
            "first_commit_at": "2026-01-13 03:47:30"
        },
        {
            "slug": "w2s-migrate-woo-to-shopify",
            "active_installs": 1000,
            "first_commit_at": "2026-01-24 08:24:12"
        },
        {
            "slug": "woo-advanced-product-information",
            "active_installs": 200,
            "first_commit_at": "2025-12-05 08:09:30"
        },
        {
            "slug": "woo-customer-coupons",
            "active_installs": 200,
            "first_commit_at": "2025-12-24 02:11:08"
        }
    ]
}

{
    "committer": "erdanish4",
    "member_since": "2018-06-25",
    "plugins_joined": 6,
    "spread_days": 2,
    "earliest_join": "2020-11-25 09:30:45",
    "latest_join": "2020-11-27 12:16:53",
    "combined_installs": 20300,
    "sample_plugins": [
        {
            "slug": "wp-job-manager-locations",
            "active_installs": 8000,
            "first_commit_at": "2020-11-25 10:02:33"
        },
        {
            "slug": "wp-job-manager-contact-listing",
            "active_installs": 6000,
            "first_commit_at": "2020-11-25 09:30:45"
        },
        {
            "slug": "woocommerce-simple-registration",
            "active_installs": 4000,
            "first_commit_at": "2020-11-25 09:52:57"
        },
        {
            "slug": "wp-job-manager-companies",
            "active_installs": 2000,
            "first_commit_at": "2020-11-27 09:11:47"
        },
        {
            "slug": "astoundify-recaptcha",
            "active_installs": 200,
            "first_commit_at": "2020-11-27 11:27:01"
        },
        {
            "slug": "simple-social-login",
            "active_installs": 100,
            "first_commit_at": "2020-11-27 12:16:53"
        }
    ]
}

{
    "committer": "faysal61",
    "member_since": "2013-11-21",
    "plugins_joined": 8,
    "spread_days": 58,
    "earliest_join": "2026-02-05 14:10:32",
    "latest_join": "2026-04-05 12:43:54",
    "combined_installs": 3500,
    "sample_plugins": [
        {
            "slug": "better-chat-support",
            "active_installs": 1000,
            "first_commit_at": "2026-03-11 11:58:57"
        },
        {
            "slug": "chat-help",
            "active_installs": 1000,
            "first_commit_at": "2026-02-10 11:54:56"
        },
        {
            "slug": "domain-for-sale",
            "active_installs": 400,
            "first_commit_at": "2026-03-11 00:10:38"
        },
        {
            "slug": "chat-viber",
            "active_installs": 300,
            "first_commit_at": "2026-03-12 09:08:12"
        },
        {
            "slug": "eventful",
            "active_installs": 300,
            "first_commit_at": "2026-02-05 14:10:32"
        },
        {
            "slug": "eventful-for-elementor",
            "active_installs": 200,
            "first_commit_at": "2026-03-30 11:50:18"
        },
        {
            "slug": "greet-bubble",
            "active_installs": 200,
            "first_commit_at": "2026-04-05 12:43:54"
        },
        {
            "slug": "bizreview",
            "active_installs": 100,
            "first_commit_at": "2026-03-12 06:28:51"
        }
    ]
}

{
    "committer": "ehsanriyadh",
    "member_since": "2020-01-26",
    "plugins_joined": 5,
    "spread_days": 69,
    "earliest_join": "2025-03-26 12:30:41",
    "latest_join": "2025-06-03 13:33:12",
    "combined_installs": 18900,
    "sample_plugins": [
        {
            "slug": "wp-event-solution",
            "active_installs": 10000,
            "first_commit_at": "2025-03-26 12:30:41"
        },
        {
            "slug": "wp-cafe",
            "active_installs": 6000,
            "first_commit_at": "2025-04-12 16:30:36"
        },
        {
            "slug": "timetics",
            "active_installs": 2000,
            "first_commit_at": "2025-06-03 13:33:12"
        },
        {
            "slug": "eventin-divi-addon",
            "active_installs": 800,
            "first_commit_at": "2025-06-03 12:30:25"
        },
        {
            "slug": "wpcafe-multivendor",
            "active_installs": 100,
            "first_commit_at": "2025-06-03 09:34:20"
        }
    ]
}

{
    "committer": "mdawaffe",
    "member_since": "2004-10-07",
    "plugins_joined": 6,
    "spread_days": 0,
    "earliest_join": "2010-06-03 21:37:25",
    "latest_join": "2010-06-04 00:22:00",
    "combined_installs": 23000,
    "sample_plugins": [
        {
            "slug": "syntaxhighlighter",
            "active_installs": 20000,
            "first_commit_at": "2010-06-03 22:03:45"
        },
        {
            "slug": "disable-wpautop",
            "active_installs": 2000,
            "first_commit_at": "2010-06-04 00:22:00"
        },
        {
            "slug": "recent-posts",
            "active_installs": 400,
            "first_commit_at": "2010-06-04 00:18:44"
        },
        {
            "slug": "most-commented",
            "active_installs": 300,
            "first_commit_at": "2010-06-04 00:18:44"
        },
        {
            "slug": "recent-comments",
            "active_installs": 200,
            "first_commit_at": "2010-06-04 00:18:44"
        },
        {
            "slug": "syntaxhighlighter-plus",
            "active_installs": 100,
            "first_commit_at": "2010-06-03 21:37:25"
        }
    ]
}

{
    "committer": "flippy101",
    "member_since": "2020-05-12",
    "plugins_joined": 9,
    "spread_days": 89,
    "earliest_join": "2020-05-13 07:29:03",
    "latest_join": "2020-08-11 04:10:21",
    "combined_installs": 65200,
    "sample_plugins": [
        {
            "slug": "facebook-conversion-pixel",
            "active_installs": 40000,
            "first_commit_at": "2020-05-13 07:29:03"
        },
        {
            "slug": "easy-pricing-tables",
            "active_installs": 10000,
            "first_commit_at": "2020-08-11 04:10:21"
        },
        {
            "slug": "analytics-cat",
            "active_installs": 6000,
            "first_commit_at": "2020-05-26 04:11:46"
        },
        {
            "slug": "quiz-cat",
            "active_installs": 5000,
            "first_commit_at": "2020-05-21 07:43:26"
        },
        {
            "slug": "mailchimp-wp",
            "active_installs": 2000,
            "first_commit_at": "2020-07-09 04:48:51"
        },
        {
            "slug": "getresponse",
            "active_installs": 1000,
            "first_commit_at": "2020-07-09 04:52:47"
        },
        {
            "slug": "landing-page-cat",
            "active_installs": 700,
            "first_commit_at": "2020-06-10 02:47:05"
        },
        {
            "slug": "aweber-wp",
            "active_installs": 300,
            "first_commit_at": "2020-07-09 04:55:13"
        },
        {
            "slug": "campaign-monitor-wp",
            "active_installs": 200,
            "first_commit_at": "2020-07-09 04:57:11"
        }
    ]
}

{
    "committer": "wpcooltools",
    "member_since": "2025-10-09",
    "plugins_joined": 8,
    "spread_days": 15,
    "earliest_join": "2026-03-28 06:38:19",
    "latest_join": "2026-04-12 14:38:12",
    "combined_installs": 167000,
    "sample_plugins": [
        {
            "slug": "recent-posts-widget-with-thumbnails",
            "active_installs": 100000,
            "first_commit_at": "2026-04-12 14:38:12"
        },
        {
            "slug": "quick-featured-images",
            "active_installs": 50000,
            "first_commit_at": "2026-03-28 06:38:19"
        },
        {
            "slug": "definitely-allow-mobile-zooming",
            "active_installs": 8000,
            "first_commit_at": "2026-04-12 14:38:12"
        },
        {
            "slug": "speed-contact-bar",
            "active_installs": 5000,
            "first_commit_at": "2026-04-12 14:38:12"
        },
        {
            "slug": "ultimate-post-list",
            "active_installs": 2000,
            "first_commit_at": "2026-04-12 14:38:12"
        },
        {
            "slug": "widget-visibility-time-scheduler",
            "active_installs": 1000,
            "first_commit_at": "2026-04-12 14:38:12"
        },
        {
            "slug": "wp-sitemaps-config",
            "active_installs": 700,
            "first_commit_at": "2026-04-12 14:38:12"
        },
        {
            "slug": "purify-wp-menues",
            "active_installs": 300,
            "first_commit_at": "2026-04-12 14:38:12"
        }
    ]
}

{
    "committer": "barcavn2",
    "member_since": "2022-03-18",
    "plugins_joined": 8,
    "spread_days": 0,
    "earliest_join": "2025-02-14 08:07:24",
    "latest_join": "2025-02-14 08:25:53",
    "combined_installs": 13800,
    "sample_plugins": [
        {
            "slug": "mb-custom-post-type",
            "active_installs": 10000,
            "first_commit_at": "2025-02-14 08:22:37"
        },
        {
            "slug": "mb-relationships",
            "active_installs": 1000,
            "first_commit_at": "2025-02-14 08:14:36"
        },
        {
            "slug": "mb-rest-api",
            "active_installs": 1000,
            "first_commit_at": "2025-02-14 08:20:48"
        },
        {
            "slug": "meta-box-facetwp-integrator",
            "active_installs": 600,
            "first_commit_at": "2025-02-14 08:16:22"
        },
        {
            "slug": "meta-box-yoast-seo",
            "active_installs": 600,
            "first_commit_at": "2025-02-14 08:24:14"
        },
        {
            "slug": "meta-box-text-limiter",
            "active_installs": 400,
            "first_commit_at": "2025-02-14 08:25:53"
        },
        {
            "slug": "mb-rank-math",
            "active_installs": 100,
            "first_commit_at": "2025-02-14 08:07:24"
        },
        {
            "slug": "meta-box-beaver-themer-integrator",
            "active_installs": 100,
            "first_commit_at": "2025-02-14 08:12:32"
        }
    ]
}

{
    "committer": "mowpms",
    "member_since": "2024-11-11",
    "plugins_joined": 5,
    "spread_days": 72,
    "earliest_join": "2024-11-13 10:16:45",
    "latest_join": "2025-01-24 17:22:53",
    "combined_installs": 2400,
    "sample_plugins": [
        {
            "slug": "embed-sharepoint-onedrive-documents",
            "active_installs": 800,
            "first_commit_at": "2024-12-16 04:26:59"
        },
        {
            "slug": "login-with-azure",
            "active_installs": 600,
            "first_commit_at": "2024-12-23 09:33:15"
        },
        {
            "slug": "embed-power-bi-reports",
            "active_installs": 500,
            "first_commit_at": "2024-12-11 10:47:32"
        },
        {
            "slug": "embed-outlook-teams-calendar-events",
            "active_installs": 300,
            "first_commit_at": "2025-01-24 17:22:53"
        },
        {
            "slug": "object-data-sync-for-salesforce",
            "active_installs": 200,
            "first_commit_at": "2024-11-13 10:16:45"
        }
    ]
}

{
    "slug": "visual-builder",
    "author_slug": "dastan800",
    "burst_start": "2026-04-29 20:45:53",
    "burst_end": "2026-04-29 21:19:06",
    "burst_commits": 36,
    "burst_window_minutes": 90,
    "tenure_days": 514,
    "distinct_messages": 2,
    "avg_message_length": 6.3,
    "top_message": "update",
    "top_message_count": 33,
    "prt_revert": null,
    "explanation": "Established author committed 36 revisions inside a 90-minute window with low-entropy commit messages. Pattern matches the June 2024 wp.org credential-stuffing wave shape; bumped to critical when followed by a wp.org Plugin Review Team revert within 7 days."
}

{
    "committer": "kybernetikservices",
    "member_since": "2021-01-20",
    "plugins_joined": 7,
    "spread_days": 0,
    "earliest_join": "2021-02-21 18:21:08",
    "latest_join": "2021-02-21 21:11:21",
    "combined_installs": 166300,
    "sample_plugins": [
        {
            "slug": "recent-posts-widget-with-thumbnails",
            "active_installs": 100000,
            "first_commit_at": "2021-02-21 20:27:30"
        },
        {
            "slug": "quick-featured-images",
            "active_installs": 50000,
            "first_commit_at": "2021-02-21 20:06:26"
        },
        {
            "slug": "definitely-allow-mobile-zooming",
            "active_installs": 8000,
            "first_commit_at": "2021-02-21 18:21:08"
        },
        {
            "slug": "speed-contact-bar",
            "active_installs": 5000,
            "first_commit_at": "2021-02-21 20:43:11"
        },
        {
            "slug": "ultimate-post-list",
            "active_installs": 2000,
            "first_commit_at": "2021-02-21 20:56:05"
        },
        {
            "slug": "widget-visibility-time-scheduler",
            "active_installs": 1000,
            "first_commit_at": "2021-02-21 21:11:21"
        },
        {
            "slug": "purify-wp-menues",
            "active_installs": 300,
            "first_commit_at": "2021-02-21 19:45:55"
        }
    ]
}

{
    "slug": "ultimate-social-media-plus",
    "shape": "plugin_upgrader_install_from_s3",
    "vendor": "Inisev (committers: iclyde, shihabsoft)",
    "wp_org_author": "inisev",
    "active_installs": 10000,
    "remote_url": "https://shopify-js-bucket.s3.ap-south-1.amazonaws.com/sfsi_worker_premium_installer-0.0.1.zip",
    "file": "libs/controllers/sfsi_buttons_controller.php",
    "line": 1706,
    "ajax_endpoint": "wp_ajax_worker_plugin",
    "introduced_in": "3.5.4 by socialsharepro 2022-09-20 r2787689",
    "discovered_by": "wp beacon hunt-updaters (direct_upgrader_install/vendor_unknown)",
    "audit_rationale": "Plugin admin-AJAX endpoint installs sibling plugin from Inisev-controlled AWS S3 bucket using Plugin_Upgrader::install(). No signature verification, no domain-name validation, hardcoded URL. Single S3 PUT by anyone with bucket IAM access replaces the zip and grants RCE on every site that triggers the install path. Same architectural class as historical js-support-ticket case (Audit #23) but install-via-S3 instead of eval-via-curl. S3 zip is currently 404 but bucket is alive."
}

{
    "committer": "ampmode",
    "member_since": "2021-09-02",
    "plugins_joined": 5,
    "spread_days": 34,
    "earliest_join": "2023-03-29 21:30:06",
    "latest_join": "2023-05-03 19:25:11",
    "combined_installs": 11500,
    "sample_plugins": [
        {
            "slug": "simple-full-screen-background-image",
            "active_installs": 10000,
            "first_commit_at": "2023-03-29 22:04:50"
        },
        {
            "slug": "adsense-in-post-ads-by-oizuled",
            "active_installs": 600,
            "first_commit_at": "2023-05-03 19:25:11"
        },
        {
            "slug": "conditional-woo-checkout-field",
            "active_installs": 400,
            "first_commit_at": "2023-03-29 21:30:06"
        },
        {
            "slug": "subscriber-discounts-for-woocommerce",
            "active_installs": 300,
            "first_commit_at": "2023-04-04 13:22:09"
        },
        {
            "slug": "woo-free-product-sample",
            "active_installs": 200,
            "first_commit_at": "2023-04-04 13:08:23"
        }
    ]
}

{
    "slug": "js-support-ticket",
    "shape": "eval_after_remote_call",
    "file": "modules/proinstaller/controller.php",
    "line": 69,
    "snippet": "$response = curl_exec($ch); ... eval($response);",
    "remote_url": "https://setup.joomsky.com/jsticketwp/pro/index.php",
    "remote_url_obfuscation": "base64-encoded JCONSTINST constant in includes/includer.php:71",
    "ssl_verify": false,
    "vendor": "JoomSky / rabilal",
    "active_installs": 8000,
    "current_response_payload": "echo Please download new installer from www.joomsky.com",
    "audit_rationale": "Vendor-shipped permanent eval(remote-PHP) primitive: SSL verification disabled, URL base64-encoded in source. Server response is benign today but the architecture is a fully-armed update-hijack vector affecting 8000 installs.",
    "discovered_by": "wp beacon hunt-updaters (eval_after_remote_call pattern)"
}

{
    "committer": "omardabbas",
    "member_since": "2019-11-15",
    "plugins_joined": 7,
    "spread_days": 8,
    "earliest_join": "2019-12-17 20:38:31",
    "latest_join": "2019-12-26 20:35:50",
    "combined_installs": 21300,
    "sample_plugins": [
        {
            "slug": "eu-vat-for-woocommerce",
            "active_installs": 7000,
            "first_commit_at": "2019-12-25 15:46:52"
        },
        {
            "slug": "payment-gateways-per-product-categories-for-woocommerce",
            "active_installs": 5000,
            "first_commit_at": "2019-12-26 20:35:50"
        },
        {
            "slug": "product-quantity-for-woocommerce",
            "active_installs": 4000,
            "first_commit_at": "2019-12-17 20:38:31"
        },
        {
            "slug": "export-woocommerce",
            "active_installs": 3000,
            "first_commit_at": "2019-12-24 18:24:44"
        },
        {
            "slug": "bulk-price-converter-for-woocommerce",
            "active_installs": 1000,
            "first_commit_at": "2019-12-26 20:35:50"
        },
        {
            "slug": "product-xml-feeds-for-woocommerce",
            "active_installs": 1000,
            "first_commit_at": "2019-12-26 20:35:50"
        },
        {
            "slug": "msrp-for-woocommerce",
            "active_installs": 300,
            "first_commit_at": "2019-12-26 20:35:50"
        }
    ]
}

{
    "slug": "duracelltomi-google-tag-manager",
    "domain": "bluhelp.com",
    "domain_source": "c2_http_call",
    "domain_registered_at": "2025-08-10",
    "plugin_earliest_commit": "2013-09-22 17:52:53",
    "plugin_latest_release": "2025-12-15 14:45:45",
    "gap_days": 4339,
    "domain_age_at_release": 127,
    "active_installs": 700000
}

{
    "slug": "wp-fastest-cache",
    "domain": "maxcdn.com",
    "domain_source": "c2_http_call",
    "domain_registered_at": "2025-07-24",
    "plugin_earliest_commit": "2021-10-04 21:09:16",
    "plugin_latest_release": "2026-04-07 18:56:41",
    "gap_days": 1388,
    "domain_age_at_release": 257,
    "active_installs": 1000000
}

{
    "slug": "fluentform",
    "domain": "apip.cc",
    "domain_source": "c2_http_call",
    "domain_registered_at": "2024-07-18",
    "plugin_earliest_commit": "2017-12-26 21:18:58",
    "plugin_latest_release": "2026-04-28 04:32:22",
    "gap_days": 2395,
    "domain_age_at_release": 649,
    "active_installs": 700000
}