WP Beacon

Events

800 events (filtered). · Last rule pass 10h ago. · 4 open / 4,675 resolved overall.

State: Open Resolved All
Severity: All Critical High · 1 Medium Low · 3 Info
Rule: All author_changed author_younger_than_plugin bulk_changelog_reuse bulk_committer_takeover closed_blob_scan closed_plugin_resurrection code_pattern code_scan_delta code_scan_match committer_younger_than_plugin compromised_committer_burst contributor_added domain_younger_than_plugin forum_complaint_cluster manual_audit_seed new_committer_young_account plugin_closed prt_forum_advisory recent_prt_intervention release_after_dormancy update_hijack_shape version_compare_trap
Critical code_scan_delta NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall (100k+ installs) Resolved 5mo ago
Slugninjafirewall
Previous version4.8.5
Current version4.8.5
New findings
PatternKindFileLineSnippetConfidence
hardcoded_ip_urlbuiltinlib/help.php250<p><strong>' . __('Block HTTP requests with an IP in the <code>HTTP_HOST</code> header', 'ninjafirewall'). '</strong><br />' . sprintf( __('This option will reject any request using an IP instead ofhigh
serialized_admin_rolebuiltinlib/utils.php1,319if ( strpos( $value, 's:13:"administrator"') === FALSE &&high
New finding count2
View raw JSON
{
    "slug": "ninjafirewall",
    "previous_version": "4.8.5",
    "current_version": "4.8.5",
    "new_findings": [
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "lib/help.php",
            "line": 250,
            "snippet": "<p><strong>' . __('Block HTTP requests with an IP in the <code>HTTP_HOST</code> header', 'ninjafirewall'). '</strong><br />' . sprintf( __('This option will reject any request using an IP instead of",
            "confidence": "high"
        },
        {
            "pattern": "serialized_admin_role",
            "kind": "builtin",
            "file": "lib/utils.php",
            "line": 1319,
            "snippet": "if ( strpos( $value, 's:13:\"administrator\"') === FALSE &&",
            "confidence": "high"
        }
    ],
    "new_finding_count": 2
}
Critical code_scan_delta Flexible SSL for CloudFlare (100k+ installs) Resolved 5mo ago
Slugcloudflare-flexible-ssl
Previous version1.3.1
Current version1.3.1
New findings
PatternKindFileLineSnippetConfidence
PluginAUTHioc:code_patternplugin.php4* Plugin URI: https://icwp.io/cloudflaresslpluginauthorhigh
PluginAUTHioc:code_patternplugin.php9* Author URI: https://icwp.io/cloudflaresslpluginauthorhigh
New finding count2
View raw JSON
{
    "slug": "cloudflare-flexible-ssl",
    "previous_version": "1.3.1",
    "current_version": "1.3.1",
    "new_findings": [
        {
            "pattern": "PluginAUTH",
            "kind": "ioc:code_pattern",
            "file": "plugin.php",
            "line": 4,
            "snippet": "* Plugin URI: https://icwp.io/cloudflaresslpluginauthor",
            "confidence": "high"
        },
        {
            "pattern": "PluginAUTH",
            "kind": "ioc:code_pattern",
            "file": "plugin.php",
            "line": 9,
            "snippet": "* Author URI: https://icwp.io/cloudflaresslpluginauthor",
            "confidence": "high"
        }
    ],
    "new_finding_count": 2
}
Critical code_scan_delta GTM4WP – A Google Tag Manager (GTM) plugin for WordPress (700k+ installs) Resolved 5mo ago
Slugduracelltomi-google-tag-manager
Previous version1.22.3
Current version1.22.3
New findings
PatternKindFileLineSnippetConfidence
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php647'http://112.74.195.169/upload/xmlfiles/STUDIO_X8_HD.XML' => [ 'BLU', 'Studio X8 HD', 'Android', DeviceType::MOBILE ],high
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php699'http://221.176.65.117/uaprof/CMDC_M601.xml' => [ 'China Mobile', 'M601', 'Android', DeviceType::TABLET ],high
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php701'http://221.176.65.117/uaprof/CMCC-M812.xml' => [ 'China Mobile Device', 'and M812', 'Android', DeviceType::MOBILE ],high
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php702'http://221.176.65.117/uaprof/M821.xml' => [ 'China Mobile Device', 'and M821', 'Android', DeviceType::MOBILE ],high
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php703'http://221.176.65.117/uaprof/M823.xml' => [ 'China Mobile Device', 'and M823', 'Android', DeviceType::MOBILE ],high
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php722'http://122.200.68.229/docs/mini3ix.xml' => [ 'Dell', 'Mini 3ix', 'Android', DeviceType::MOBILE ],high
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php754'http://211.42.201.70/ua_profile/FLY-2040i.xml' => [ 'Fly', '2040', null, DeviceType::MOBILE ],high
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php755'http://211.42.201.70/ua_profile/FLY-2040L.xml' => [ 'Fly', '2040', null, DeviceType::MOBILE ],high
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php758'http://211.42.201.70/ua_profile/Fly-E300.xml' => [ 'Fly', 'E300', null, DeviceType::MOBILE ],high
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php814'http://211.42.201.70/ua_profile/Fly-LX610.xml' => [ 'Fly', 'LX610', null, DeviceType::MOBILE ],high
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php817'http://211.42.201.70/ua_profile/FLY-MX200i.xml' => [ 'Fly', 'MX200', null, DeviceType::MOBILE ],high
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php818'http://211.42.201.70/ua_profile/FLY-MX230.xml' => [ 'Fly', 'MX230', null, DeviceType::MOBILE ],high
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php819'http://211.42.201.70/ua_profile/FLY-MX300.xml' => [ 'Fly', 'MX300', null, DeviceType::MOBILE ],high
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php820'http://211.42.201.70/ua_profile/FLY-MX330.xml' => [ 'Fly', 'MX330', null, DeviceType::MOBILE ],high
hardcoded_ip_urlbuiltinintegration/whichbrowser/data/profiles.php821'http://211.42.201.70/ua_profile/FLY-SL300m.xml' => [ 'Fly', 'SL300', null, DeviceType::MOBILE ],high
New finding count38
View raw JSON
{
    "slug": "duracelltomi-google-tag-manager",
    "previous_version": "1.22.3",
    "current_version": "1.22.3",
    "new_findings": [
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 647,
            "snippet": "'http://112.74.195.169/upload/xmlfiles/STUDIO_X8_HD.XML'                                              => [ 'BLU', 'Studio X8 HD', 'Android', DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 699,
            "snippet": "'http://221.176.65.117/uaprof/CMDC_M601.xml'                                                          => [ 'China Mobile', 'M601', 'Android', DeviceType::TABLET ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 701,
            "snippet": "'http://221.176.65.117/uaprof/CMCC-M812.xml'                                                          => [ 'China Mobile Device', 'and M812', 'Android', DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 702,
            "snippet": "'http://221.176.65.117/uaprof/M821.xml'                                                               => [ 'China Mobile Device', 'and M821', 'Android', DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 703,
            "snippet": "'http://221.176.65.117/uaprof/M823.xml'                                                               => [ 'China Mobile Device', 'and M823', 'Android', DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 722,
            "snippet": "'http://122.200.68.229/docs/mini3ix.xml'                                                              => [ 'Dell', 'Mini 3ix', 'Android', DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 754,
            "snippet": "'http://211.42.201.70/ua_profile/FLY-2040i.xml'                                                       => [ 'Fly', '2040', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 755,
            "snippet": "'http://211.42.201.70/ua_profile/FLY-2040L.xml'                                                       => [ 'Fly', '2040', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 758,
            "snippet": "'http://211.42.201.70/ua_profile/Fly-E300.xml'                                                        => [ 'Fly', 'E300', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 814,
            "snippet": "'http://211.42.201.70/ua_profile/Fly-LX610.xml'                                                       => [ 'Fly', 'LX610', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 817,
            "snippet": "'http://211.42.201.70/ua_profile/FLY-MX200i.xml'                                                      => [ 'Fly', 'MX200', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 818,
            "snippet": "'http://211.42.201.70/ua_profile/FLY-MX230.xml'                                                       => [ 'Fly', 'MX230', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 819,
            "snippet": "'http://211.42.201.70/ua_profile/FLY-MX300.xml'                                                       => [ 'Fly', 'MX300', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 820,
            "snippet": "'http://211.42.201.70/ua_profile/FLY-MX330.xml'                                                       => [ 'Fly', 'MX330', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 821,
            "snippet": "'http://211.42.201.70/ua_profile/FLY-SL300m.xml'                                                      => [ 'Fly', 'SL300', null, DeviceType::MOBILE ],",
            "confidence": "high"
        }
    ],
    "new_finding_count": 38
}
Critical code_scan_delta Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More (1M+ installs) Resolved 5mo ago
Slugduplicator
Previous version1.5.16
Current version1.5.16
New findings
PatternKindFileLineSnippetConfidence
serialized_admin_rolebuiltininstaller/dup-installer/classes/config/class.conf.wp.php22const ADMIN_SERIALIZED_SECURITY_STRING = 'a:1:{s:13:"administrator";b:1;}';high
New finding count1
View raw JSON
{
    "slug": "duplicator",
    "previous_version": "1.5.16",
    "current_version": "1.5.16",
    "new_findings": [
        {
            "pattern": "serialized_admin_role",
            "kind": "builtin",
            "file": "installer/dup-installer/classes/config/class.conf.wp.php",
            "line": 22,
            "snippet": "const ADMIN_SERIALIZED_SECURITY_STRING = 'a:1:{s:13:\"administrator\";b:1;}';",
            "confidence": "high"
        }
    ],
    "new_finding_count": 1
}
Critical new_committer_young_account CHEQ Essentials (600 installs) Resolved 5mo ago
Slugcheq-essentials-go-to-market-security
Committereranfl
Display nameeranfl
Member since2024-10-20
First commit at2025-01-12 17:44:43
Account age at first commit84
Commit count7
Active installs700
View raw JSON
{
    "slug": "cheq-essentials-go-to-market-security",
    "committer": "eranfl",
    "display_name": "eranfl",
    "member_since": "2024-10-20",
    "first_commit_at": "2025-01-12 17:44:43",
    "account_age_at_first_commit": 84,
    "commit_count": 7,
    "active_installs": 700
}
Critical new_committer_young_account All Embed – Multi-Source Embed Widgets for Elementor (500 installs) Resolved 5mo ago
Slugall-embed-addons-for-elementor
Committerhazrath
Display namehazrath
Member since2025-12-02
First commit at2025-12-02 10:01:22
Account age at first commit0
Commit count20
Active installs500
View raw JSON
{
    "slug": "all-embed-addons-for-elementor",
    "committer": "hazrath",
    "display_name": "hazrath",
    "member_since": "2025-12-02",
    "first_commit_at": "2025-12-02 10:01:22",
    "account_age_at_first_commit": 0,
    "commit_count": 20,
    "active_installs": 500
}
Critical new_committer_young_account Accordion – Organize Content into Clean Collapsible Sections (600 installs) Resolved 5mo ago
Slugb-accordion
Committerprosanta10
Display nameProsanta Roy
Member since2025-10-23
First commit at2025-12-01 06:29:17
Account age at first commit39
Commit count18
Active installs500
View raw JSON
{
    "slug": "b-accordion",
    "committer": "prosanta10",
    "display_name": "Prosanta Roy",
    "member_since": "2025-10-23",
    "first_commit_at": "2025-12-01 06:29:17",
    "account_age_at_first_commit": 39,
    "commit_count": 18,
    "active_installs": 500
}
Critical new_committer_young_account Awesome FAQ – answer questions before customers ask (1k+ installs) Resolved 5mo ago
Slugfaq-and-answers
Committerprosanta10
Display nameProsanta Roy
Member since2025-10-23
First commit at2025-11-11 05:41:51
Account age at first commit19
Commit count25
Active installs500
View raw JSON
{
    "slug": "faq-and-answers",
    "committer": "prosanta10",
    "display_name": "Prosanta Roy",
    "member_since": "2025-10-23",
    "first_commit_at": "2025-11-11 05:41:51",
    "account_age_at_first_commit": 19,
    "commit_count": 25,
    "active_installs": 500
}
Critical new_committer_young_account OffCanvas / Drawer – add sleek slide-in panels to any page (900 installs) Resolved 5mo ago
Slugoffcanvas-block
Committerasadsuzan
Display nameasadsuzan
Member since2025-09-20
First commit at2025-11-11 03:35:01
Account age at first commit52
Commit count30
Active installs800
View raw JSON
{
    "slug": "offcanvas-block",
    "committer": "asadsuzan",
    "display_name": "asadsuzan",
    "member_since": "2025-09-20",
    "first_commit_at": "2025-11-11 03:35:01",
    "account_age_at_first_commit": 52,
    "commit_count": 30,
    "active_installs": 800
}
Critical new_committer_young_account Blank (800 installs) Resolved 5mo ago
Slugblank
Committerwebguyio
Display nameWeb Guy
Member since2025-09-01
First commit at2025-09-01 02:11:27
Account age at first commit0
Commit count2
Active installs800
View raw JSON
{
    "slug": "blank",
    "committer": "webguyio",
    "display_name": "Web Guy",
    "member_since": "2025-09-01",
    "first_commit_at": "2025-09-01 02:11:27",
    "account_age_at_first_commit": 0,
    "commit_count": 2,
    "active_installs": 800
}
Critical new_committer_young_account Portfolio Block – show off your work with stunning layouts (800 installs) Resolved 5mo ago
Slugportfolio-block
Committerruhulamin2026
Display nameRuhul Amin
Member since2025-09-20
First commit at2025-11-15 09:39:22
Account age at first commit56
Commit count32
Active installs700
View raw JSON
{
    "slug": "portfolio-block",
    "committer": "ruhulamin2026",
    "display_name": "Ruhul Amin",
    "member_since": "2025-09-20",
    "first_commit_at": "2025-11-15 09:39:22",
    "account_age_at_first_commit": 56,
    "commit_count": 32,
    "active_installs": 700
}
Critical bulk_committer_takeover Safe SVG (1M+ installs) Resolved 5mo ago
Committer10up
Member since2011-09-22
Plugins joined15
Spread days190
Earliest join2022-01-25 21:22:20
Latest join2022-08-04 18:03:10
Combined installs1,373,300
Sample plugins
SlugActive installsFirst commit at
safe-svg1,000,0002022-02-23 18:22:50
ads-txt100,0002022-04-20 01:05:00
simple-local-avatars100,0002022-04-25 09:48:41
simple-page-ordering100,0002022-04-28 16:25:47
safe-redirect-manager40,0002022-06-27 12:08:46
restricted-site-access10,0002022-02-08 18:42:57
elasticpress8,0002022-03-08 21:28:25
autoshare-for-twitter5,0002022-04-13 12:33:05
insert-special-characters3,0002022-01-27 16:33:57
convert-to-blocks2,0002022-07-28 17:35:30
View raw JSON
{
    "committer": "10up",
    "member_since": "2011-09-22",
    "plugins_joined": 15,
    "spread_days": 190,
    "earliest_join": "2022-01-25 21:22:20",
    "latest_join": "2022-08-04 18:03:10",
    "combined_installs": 1373300,
    "sample_plugins": [
        {
            "slug": "safe-svg",
            "active_installs": 1000000,
            "first_commit_at": "2022-02-23 18:22:50"
        },
        {
            "slug": "ads-txt",
            "active_installs": 100000,
            "first_commit_at": "2022-04-20 01:05:00"
        },
        {
            "slug": "simple-local-avatars",
            "active_installs": 100000,
            "first_commit_at": "2022-04-25 09:48:41"
        },
        {
            "slug": "simple-page-ordering",
            "active_installs": 100000,
            "first_commit_at": "2022-04-28 16:25:47"
        },
        {
            "slug": "safe-redirect-manager",
            "active_installs": 40000,
            "first_commit_at": "2022-06-27 12:08:46"
        },
        {
            "slug": "restricted-site-access",
            "active_installs": 10000,
            "first_commit_at": "2022-02-08 18:42:57"
        },
        {
            "slug": "elasticpress",
            "active_installs": 8000,
            "first_commit_at": "2022-03-08 21:28:25"
        },
        {
            "slug": "autoshare-for-twitter",
            "active_installs": 5000,
            "first_commit_at": "2022-04-13 12:33:05"
        },
        {
            "slug": "insert-special-characters",
            "active_installs": 3000,
            "first_commit_at": "2022-01-27 16:33:57"
        },
        {
            "slug": "convert-to-blocks",
            "active_installs": 2000,
            "first_commit_at": "2022-07-28 17:35:30"
        }
    ]
}
Critical bulk_committer_takeover WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel (100k+ installs) Resolved 5mo ago
Committerix3
Member since2014-08-26
Plugins joined14
Spread days177
Earliest join2025-06-11 20:25:27
Latest join2025-12-05 20:51:20
Combined installs280,400
Sample plugins
SlugActive installsFirst commit at
wp-all-export100,0002025-12-05 20:51:20
wp-all-import100,0002025-12-05 19:54:35
woocommerce-xml-csv-product-import20,0002025-06-11 20:44:33
yoast-seo-settings-xml-csv-import20,0002025-06-11 20:27:53
import-users-from-csv10,0002025-06-11 20:32:23
product-export-for-woocommerce10,0002025-06-11 20:48:18
import-xml-csv-settings-to-rank-math-seo7,0002025-06-11 20:28:10
csv-importer4,0002025-06-11 20:32:43
order-export-for-woocommerce3,0002025-06-11 20:50:15
export-wp-users-xml-csv2,0002025-06-11 20:39:15
View raw JSON
{
    "committer": "ix3",
    "member_since": "2014-08-26",
    "plugins_joined": 14,
    "spread_days": 177,
    "earliest_join": "2025-06-11 20:25:27",
    "latest_join": "2025-12-05 20:51:20",
    "combined_installs": 280400,
    "sample_plugins": [
        {
            "slug": "wp-all-export",
            "active_installs": 100000,
            "first_commit_at": "2025-12-05 20:51:20"
        },
        {
            "slug": "wp-all-import",
            "active_installs": 100000,
            "first_commit_at": "2025-12-05 19:54:35"
        },
        {
            "slug": "woocommerce-xml-csv-product-import",
            "active_installs": 20000,
            "first_commit_at": "2025-06-11 20:44:33"
        },
        {
            "slug": "yoast-seo-settings-xml-csv-import",
            "active_installs": 20000,
            "first_commit_at": "2025-06-11 20:27:53"
        },
        {
            "slug": "import-users-from-csv",
            "active_installs": 10000,
            "first_commit_at": "2025-06-11 20:32:23"
        },
        {
            "slug": "product-export-for-woocommerce",
            "active_installs": 10000,
            "first_commit_at": "2025-06-11 20:48:18"
        },
        {
            "slug": "import-xml-csv-settings-to-rank-math-seo",
            "active_installs": 7000,
            "first_commit_at": "2025-06-11 20:28:10"
        },
        {
            "slug": "csv-importer",
            "active_installs": 4000,
            "first_commit_at": "2025-06-11 20:32:43"
        },
        {
            "slug": "order-export-for-woocommerce",
            "active_installs": 3000,
            "first_commit_at": "2025-06-11 20:50:15"
        },
        {
            "slug": "export-wp-users-xml-csv",
            "active_installs": 2000,
            "first_commit_at": "2025-06-11 20:39:15"
        }
    ]
}
Critical bulk_committer_takeover WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel (100k+ installs) Resolved 5mo ago
Committersolideiglor
Member since2025-01-30
Plugins joined12
Spread days302
Earliest join2025-04-03 00:21:41
Latest join2026-01-30 23:26:43
Combined installs266,400
Sample plugins
SlugActive installsFirst commit at
wp-all-export100,0002025-06-04 18:44:50
wp-all-import100,0002025-04-03 00:21:41
woocommerce-xml-csv-product-import20,0002025-09-04 00:50:11
yoast-seo-settings-xml-csv-import20,0002026-01-13 15:16:06
product-export-for-woocommerce10,0002025-09-04 01:34:47
import-xml-csv-settings-to-rank-math-seo7,0002026-01-13 15:23:43
order-export-for-woocommerce3,0002025-09-04 01:24:50
export-wp-users-xml-csv2,0002026-01-12 14:49:10
wp-job-manager-xml-csv-listings-import2,0002026-01-30 15:14:00
import-xml-csv-settings-to-all-in-one-seo-pack1,0002026-01-30 13:33:48
View raw JSON
{
    "committer": "solideiglor",
    "member_since": "2025-01-30",
    "plugins_joined": 12,
    "spread_days": 302,
    "earliest_join": "2025-04-03 00:21:41",
    "latest_join": "2026-01-30 23:26:43",
    "combined_installs": 266400,
    "sample_plugins": [
        {
            "slug": "wp-all-export",
            "active_installs": 100000,
            "first_commit_at": "2025-06-04 18:44:50"
        },
        {
            "slug": "wp-all-import",
            "active_installs": 100000,
            "first_commit_at": "2025-04-03 00:21:41"
        },
        {
            "slug": "woocommerce-xml-csv-product-import",
            "active_installs": 20000,
            "first_commit_at": "2025-09-04 00:50:11"
        },
        {
            "slug": "yoast-seo-settings-xml-csv-import",
            "active_installs": 20000,
            "first_commit_at": "2026-01-13 15:16:06"
        },
        {
            "slug": "product-export-for-woocommerce",
            "active_installs": 10000,
            "first_commit_at": "2025-09-04 01:34:47"
        },
        {
            "slug": "import-xml-csv-settings-to-rank-math-seo",
            "active_installs": 7000,
            "first_commit_at": "2026-01-13 15:23:43"
        },
        {
            "slug": "order-export-for-woocommerce",
            "active_installs": 3000,
            "first_commit_at": "2025-09-04 01:24:50"
        },
        {
            "slug": "export-wp-users-xml-csv",
            "active_installs": 2000,
            "first_commit_at": "2026-01-12 14:49:10"
        },
        {
            "slug": "wp-job-manager-xml-csv-listings-import",
            "active_installs": 2000,
            "first_commit_at": "2026-01-30 15:14:00"
        },
        {
            "slug": "import-xml-csv-settings-to-all-in-one-seo-pack",
            "active_installs": 1000,
            "first_commit_at": "2026-01-30 13:33:48"
        }
    ]
}
Critical bulk_committer_takeover Mailonix – Email Template Customizer for WooCommerce (20k+ installs) Resolved 5mo ago
Committermrt3vn
Member since2015-10-27
Plugins joined10
Spread days14
Earliest join2024-05-06 08:18:12
Latest join2024-05-21 04:26:41
Combined installs48,800
Sample plugins
SlugActive installsFirst commit at
email-template-customizer-for-woo20,0002024-05-09 03:13:37
bulky-bulk-edit-products-for-woo10,0002024-05-21 04:26:41
exmage-wp-image-links7,0002024-05-06 08:18:29
clear-autoptimize-cache-automatically4,0002024-05-06 08:19:05
product-size-chart-for-woo3,0002024-05-06 08:18:12
product-pre-orders-for-woo2,0002024-05-06 08:18:17
bopo-woo-product-bundle-builder1,0002024-05-21 04:26:24
fewc-extra-checkout-fields-for-woocommerce7002024-05-06 08:18:23
pofily-woo-product-filters7002024-05-21 04:26:17
wpbulky-wp-bulk-edit-post-types4002024-05-21 04:26:33
View raw JSON
{
    "committer": "mrt3vn",
    "member_since": "2015-10-27",
    "plugins_joined": 10,
    "spread_days": 14,
    "earliest_join": "2024-05-06 08:18:12",
    "latest_join": "2024-05-21 04:26:41",
    "combined_installs": 48800,
    "sample_plugins": [
        {
            "slug": "email-template-customizer-for-woo",
            "active_installs": 20000,
            "first_commit_at": "2024-05-09 03:13:37"
        },
        {
            "slug": "bulky-bulk-edit-products-for-woo",
            "active_installs": 10000,
            "first_commit_at": "2024-05-21 04:26:41"
        },
        {
            "slug": "exmage-wp-image-links",
            "active_installs": 7000,
            "first_commit_at": "2024-05-06 08:18:29"
        },
        {
            "slug": "clear-autoptimize-cache-automatically",
            "active_installs": 4000,
            "first_commit_at": "2024-05-06 08:19:05"
        },
        {
            "slug": "product-size-chart-for-woo",
            "active_installs": 3000,
            "first_commit_at": "2024-05-06 08:18:12"
        },
        {
            "slug": "product-pre-orders-for-woo",
            "active_installs": 2000,
            "first_commit_at": "2024-05-06 08:18:17"
        },
        {
            "slug": "bopo-woo-product-bundle-builder",
            "active_installs": 1000,
            "first_commit_at": "2024-05-21 04:26:24"
        },
        {
            "slug": "fewc-extra-checkout-fields-for-woocommerce",
            "active_installs": 700,
            "first_commit_at": "2024-05-06 08:18:23"
        },
        {
            "slug": "pofily-woo-product-filters",
            "active_installs": 700,
            "first_commit_at": "2024-05-21 04:26:17"
        },
        {
            "slug": "wpbulky-wp-bulk-edit-post-types",
            "active_installs": 400,
            "first_commit_at": "2024-05-21 04:26:33"
        }
    ]
}
Critical bulk_committer_takeover BlossomThemes Toolkit (30k+ installs) Resolved 5mo ago
Committerprakhadkash
Member since—
Plugins joined14
Spread days76
Earliest join2024-07-04 05:32:41
Latest join2024-09-18 06:08:00
Combined installs145,500
Sample plugins
SlugActive installsFirst commit at
blossomthemes-toolkit30,0002024-07-30 09:24:53
blossomthemes-email-newsletter20,0002024-09-18 05:12:46
rara-one-click-demo-import20,0002024-07-30 09:31:09
wp-travel-engine20,0002024-07-04 05:32:41
demo-importer-plus10,0002024-09-18 06:08:00
mega-elements-addons-for-elementor10,0002024-07-30 08:38:41
raratheme-companion10,0002024-07-30 09:27:29
wte-elementor-widgets10,0002024-07-30 07:46:41
delicious-recipes4,0002024-07-18 07:55:42
travel-agency-companion4,0002024-07-30 08:26:57
View raw JSON
{
    "committer": "prakhadkash",
    "member_since": null,
    "plugins_joined": 14,
    "spread_days": 76,
    "earliest_join": "2024-07-04 05:32:41",
    "latest_join": "2024-09-18 06:08:00",
    "combined_installs": 145500,
    "sample_plugins": [
        {
            "slug": "blossomthemes-toolkit",
            "active_installs": 30000,
            "first_commit_at": "2024-07-30 09:24:53"
        },
        {
            "slug": "blossomthemes-email-newsletter",
            "active_installs": 20000,
            "first_commit_at": "2024-09-18 05:12:46"
        },
        {
            "slug": "rara-one-click-demo-import",
            "active_installs": 20000,
            "first_commit_at": "2024-07-30 09:31:09"
        },
        {
            "slug": "wp-travel-engine",
            "active_installs": 20000,
            "first_commit_at": "2024-07-04 05:32:41"
        },
        {
            "slug": "demo-importer-plus",
            "active_installs": 10000,
            "first_commit_at": "2024-09-18 06:08:00"
        },
        {
            "slug": "mega-elements-addons-for-elementor",
            "active_installs": 10000,
            "first_commit_at": "2024-07-30 08:38:41"
        },
        {
            "slug": "raratheme-companion",
            "active_installs": 10000,
            "first_commit_at": "2024-07-30 09:27:29"
        },
        {
            "slug": "wte-elementor-widgets",
            "active_installs": 10000,
            "first_commit_at": "2024-07-30 07:46:41"
        },
        {
            "slug": "delicious-recipes",
            "active_installs": 4000,
            "first_commit_at": "2024-07-18 07:55:42"
        },
        {
            "slug": "travel-agency-companion",
            "active_installs": 4000,
            "first_commit_at": "2024-07-30 08:26:57"
        }
    ]
}
Critical bulk_committer_takeover Custom CSS and JavaScript (10k+ installs) Resolved 5mo ago
Committeraspengrovestudios
Member since2018-05-08
Plugins joined10
Spread days101
Earliest join2021-02-14 23:46:52
Latest join2021-05-27 17:05:19
Combined installs43,800
Sample plugins
SlugActive installsFirst commit at
custom-css-and-javascript10,0002021-02-26 17:11:03
shortcodes-for-divi10,0002021-05-27 17:05:19
replace-image9,0002021-02-26 20:58:19
product-sales-report-for-woocommerce6,0002021-02-15 19:29:48
image-upload-for-bbpress3,0002021-03-01 15:01:59
donations-for-woocommerce2,0002021-03-06 00:41:28
automatically-update-permalinks1,0002021-03-09 00:26:26
export-order-items-for-woocommerce1,0002021-02-14 23:46:52
password-strength-for-woocommerce1,0002021-03-08 23:02:21
disable-user-registration-notification-emails8002021-03-09 00:03:19
View raw JSON
{
    "committer": "aspengrovestudios",
    "member_since": "2018-05-08",
    "plugins_joined": 10,
    "spread_days": 101,
    "earliest_join": "2021-02-14 23:46:52",
    "latest_join": "2021-05-27 17:05:19",
    "combined_installs": 43800,
    "sample_plugins": [
        {
            "slug": "custom-css-and-javascript",
            "active_installs": 10000,
            "first_commit_at": "2021-02-26 17:11:03"
        },
        {
            "slug": "shortcodes-for-divi",
            "active_installs": 10000,
            "first_commit_at": "2021-05-27 17:05:19"
        },
        {
            "slug": "replace-image",
            "active_installs": 9000,
            "first_commit_at": "2021-02-26 20:58:19"
        },
        {
            "slug": "product-sales-report-for-woocommerce",
            "active_installs": 6000,
            "first_commit_at": "2021-02-15 19:29:48"
        },
        {
            "slug": "image-upload-for-bbpress",
            "active_installs": 3000,
            "first_commit_at": "2021-03-01 15:01:59"
        },
        {
            "slug": "donations-for-woocommerce",
            "active_installs": 2000,
            "first_commit_at": "2021-03-06 00:41:28"
        },
        {
            "slug": "automatically-update-permalinks",
            "active_installs": 1000,
            "first_commit_at": "2021-03-09 00:26:26"
        },
        {
            "slug": "export-order-items-for-woocommerce",
            "active_installs": 1000,
            "first_commit_at": "2021-02-14 23:46:52"
        },
        {
            "slug": "password-strength-for-woocommerce",
            "active_installs": 1000,
            "first_commit_at": "2021-03-08 23:02:21"
        },
        {
            "slug": "disable-user-registration-notification-emails",
            "active_installs": 800,
            "first_commit_at": "2021-03-09 00:03:19"
        }
    ]
}
Critical new_committer_young_account Sold Individually for WooCommerce Product Variations (800 installs) Resolved 5mo ago
Slugwoo-sold-individually-for-variations
Committernakedcatplugins
Display nameNaked Cat Plugins
Member since2025-04-10
First commit at2025-04-19 16:18:33
Account age at first commit9
Commit count3
Active installs800
View raw JSON
{
    "slug": "woo-sold-individually-for-variations",
    "committer": "nakedcatplugins",
    "display_name": "Naked Cat Plugins",
    "member_since": "2025-04-10",
    "first_commit_at": "2025-04-19 16:18:33",
    "account_age_at_first_commit": 9,
    "commit_count": 3,
    "active_installs": 800
}
Critical new_committer_young_account Shop as Client for WooCommerce – Manual, Phone & Email Orders (600 installs) Resolved 5mo ago
Slugshop-as-client
Committernakedcatplugins
Display nameNaked Cat Plugins
Member since2025-04-10
First commit at2025-04-14 10:59:51
Account age at first commit4
Commit count31
Active installs600
View raw JSON
{
    "slug": "shop-as-client",
    "committer": "nakedcatplugins",
    "display_name": "Naked Cat Plugins",
    "member_since": "2025-04-10",
    "first_commit_at": "2025-04-14 10:59:51",
    "account_age_at_first_commit": 4,
    "commit_count": 31,
    "active_installs": 600
}
Critical new_committer_young_account Portugal CTT Tracking for WooCommerce (500 installs) Resolved 5mo ago
Slugportugal-ctt-tracking-woocommerce
Committernakedcatplugins
Display nameNaked Cat Plugins
Member since2025-04-10
First commit at2025-05-09 14:06:39
Account age at first commit29
Commit count9
Active installs600
View raw JSON
{
    "slug": "portugal-ctt-tracking-woocommerce",
    "committer": "nakedcatplugins",
    "display_name": "Naked Cat Plugins",
    "member_since": "2025-04-10",
    "first_commit_at": "2025-05-09 14:06:39",
    "account_age_at_first_commit": 29,
    "commit_count": 9,
    "active_installs": 600
}
Critical new_committer_young_account Stock Exporter for WooCommerce (1k+ installs) Resolved 5mo ago
Slugstock-exporter-for-woocommerce
Committernakedcatplugins
Display nameNaked Cat Plugins
Member since2025-04-10
First commit at2025-04-19 15:55:22
Account age at first commit9
Commit count3
Active installs1,000
View raw JSON
{
    "slug": "stock-exporter-for-woocommerce",
    "committer": "nakedcatplugins",
    "display_name": "Naked Cat Plugins",
    "member_since": "2025-04-10",
    "first_commit_at": "2025-04-19 15:55:22",
    "account_age_at_first_commit": 9,
    "commit_count": 3,
    "active_installs": 1000
}
Critical new_committer_young_account StreamCast – bring live radio to your site with a sleek player (1k+ installs) Resolved 5mo ago
Slugstreamcast
Committertaninrahman
Display nameTanin Rahman
Member since2025-01-25
First commit at2025-04-14 08:47:11
Account age at first commit79
Commit count30
Active installs1,000
View raw JSON
{
    "slug": "streamcast",
    "committer": "taninrahman",
    "display_name": "Tanin Rahman",
    "member_since": "2025-01-25",
    "first_commit_at": "2025-04-14 08:47:11",
    "account_age_at_first_commit": 79,
    "commit_count": 30,
    "active_installs": 1000
}
Critical new_committer_young_account Flat Rate per State/Country/Region for WooCommerce (1k+ installs) Resolved 5mo ago
Slugflat-rate-per-countryregion-for-woocommerce
Committernakedcatplugins
Display nameNaked Cat Plugins
Member since2025-04-10
First commit at2025-04-18 16:47:20
Account age at first commit8
Commit count5
Active installs1,000
View raw JSON
{
    "slug": "flat-rate-per-countryregion-for-woocommerce",
    "committer": "nakedcatplugins",
    "display_name": "Naked Cat Plugins",
    "member_since": "2025-04-10",
    "first_commit_at": "2025-04-18 16:47:20",
    "account_age_at_first_commit": 8,
    "commit_count": 5,
    "active_installs": 1000
}
Critical new_committer_young_account Business Card Block – present your team and contact info in style (1k+ installs) Resolved 5mo ago
Slugbusiness-card-block
Committerruhulamin2026
Display nameRuhul Amin
Member since2025-09-20
First commit at2025-12-04 11:39:33
Account age at first commit75
Commit count15
Active installs1,000
View raw JSON
{
    "slug": "business-card-block",
    "committer": "ruhulamin2026",
    "display_name": "Ruhul Amin",
    "member_since": "2025-09-20",
    "first_commit_at": "2025-12-04 11:39:33",
    "account_age_at_first_commit": 75,
    "commit_count": 15,
    "active_installs": 1000
}
Critical new_committer_young_account Canonical Link (2k+ installs) Resolved 5mo ago
Slugcanonical-link
Committerwebguyio
Display nameWeb Guy
Member since2025-09-01
First commit at2025-09-01 02:11:45
Account age at first commit0
Commit count2
Active installs2,000
View raw JSON
{
    "slug": "canonical-link",
    "committer": "webguyio",
    "display_name": "Web Guy",
    "member_since": "2025-09-01",
    "first_commit_at": "2025-09-01 02:11:45",
    "account_age_at_first_commit": 0,
    "commit_count": 2,
    "active_installs": 2000
}
Critical bulk_committer_takeover Safe SVG (1M+ installs) Resolved 5mo ago
Committer10up
Member since2011-09-22
Plugins joined12
Spread days182
Earliest join2022-01-27 16:33:57
Latest join2022-07-28 17:35:30
Combined installs1,372,000
Sample plugins
SlugActive installsFirst commit at
safe-svg1,000,0002022-02-23 18:22:50
ads-txt100,0002022-04-20 01:05:00
simple-local-avatars100,0002022-04-25 09:48:41
simple-page-ordering100,0002022-04-28 16:25:47
safe-redirect-manager40,0002022-06-27 12:08:46
restricted-site-access10,0002022-02-08 18:42:57
elasticpress8,0002022-03-08 21:28:25
autoshare-for-twitter6,0002022-04-13 12:33:05
insert-special-characters3,0002022-01-27 16:33:57
convert-to-blocks2,0002022-07-28 17:35:30
View raw JSON
{
    "committer": "10up",
    "member_since": "2011-09-22",
    "plugins_joined": 12,
    "spread_days": 182,
    "earliest_join": "2022-01-27 16:33:57",
    "latest_join": "2022-07-28 17:35:30",
    "combined_installs": 1372000,
    "sample_plugins": [
        {
            "slug": "safe-svg",
            "active_installs": 1000000,
            "first_commit_at": "2022-02-23 18:22:50"
        },
        {
            "slug": "ads-txt",
            "active_installs": 100000,
            "first_commit_at": "2022-04-20 01:05:00"
        },
        {
            "slug": "simple-local-avatars",
            "active_installs": 100000,
            "first_commit_at": "2022-04-25 09:48:41"
        },
        {
            "slug": "simple-page-ordering",
            "active_installs": 100000,
            "first_commit_at": "2022-04-28 16:25:47"
        },
        {
            "slug": "safe-redirect-manager",
            "active_installs": 40000,
            "first_commit_at": "2022-06-27 12:08:46"
        },
        {
            "slug": "restricted-site-access",
            "active_installs": 10000,
            "first_commit_at": "2022-02-08 18:42:57"
        },
        {
            "slug": "elasticpress",
            "active_installs": 8000,
            "first_commit_at": "2022-03-08 21:28:25"
        },
        {
            "slug": "autoshare-for-twitter",
            "active_installs": 6000,
            "first_commit_at": "2022-04-13 12:33:05"
        },
        {
            "slug": "insert-special-characters",
            "active_installs": 3000,
            "first_commit_at": "2022-01-27 16:33:57"
        },
        {
            "slug": "convert-to-blocks",
            "active_installs": 2000,
            "first_commit_at": "2022-07-28 17:35:30"
        }
    ]
}
Critical bulk_committer_takeover Trakoo – Orders Tracking for WooCommerce (10k+ installs) Resolved 5mo ago
Committerlodai
Member since—
Plugins joined11
Spread days364
Earliest join2023-12-30 02:46:59
Latest join2024-12-28 03:20:00
Combined installs42,000
Sample plugins
SlugActive installsFirst commit at
woo-orders-tracking10,0002024-09-28 01:59:38
woo-cart-all-in-one6,0002024-10-28 02:00:25
woo-notification6,0002023-12-30 02:46:59
clear-autoptimize-cache-automatically4,0002024-12-28 03:20:00
woo-abandoned-cart-recovery4,0002024-10-22 08:36:01
import-shopify-to-woocommerce3,0002024-11-25 10:30:32
product-size-chart-for-woo3,0002024-10-01 07:01:54
product-pre-orders-for-woo2,0002024-04-13 03:03:46
woo-free-shipping-bar2,0002024-01-29 06:40:00
w2s-migrate-woo-to-shopify1,0002024-12-24 04:40:58
View raw JSON
{
    "committer": "lodai",
    "member_since": null,
    "plugins_joined": 11,
    "spread_days": 364,
    "earliest_join": "2023-12-30 02:46:59",
    "latest_join": "2024-12-28 03:20:00",
    "combined_installs": 42000,
    "sample_plugins": [
        {
            "slug": "woo-orders-tracking",
            "active_installs": 10000,
            "first_commit_at": "2024-09-28 01:59:38"
        },
        {
            "slug": "woo-cart-all-in-one",
            "active_installs": 6000,
            "first_commit_at": "2024-10-28 02:00:25"
        },
        {
            "slug": "woo-notification",
            "active_installs": 6000,
            "first_commit_at": "2023-12-30 02:46:59"
        },
        {
            "slug": "clear-autoptimize-cache-automatically",
            "active_installs": 4000,
            "first_commit_at": "2024-12-28 03:20:00"
        },
        {
            "slug": "woo-abandoned-cart-recovery",
            "active_installs": 4000,
            "first_commit_at": "2024-10-22 08:36:01"
        },
        {
            "slug": "import-shopify-to-woocommerce",
            "active_installs": 3000,
            "first_commit_at": "2024-11-25 10:30:32"
        },
        {
            "slug": "product-size-chart-for-woo",
            "active_installs": 3000,
            "first_commit_at": "2024-10-01 07:01:54"
        },
        {
            "slug": "product-pre-orders-for-woo",
            "active_installs": 2000,
            "first_commit_at": "2024-04-13 03:03:46"
        },
        {
            "slug": "woo-free-shipping-bar",
            "active_installs": 2000,
            "first_commit_at": "2024-01-29 06:40:00"
        },
        {
            "slug": "w2s-migrate-woo-to-shopify",
            "active_installs": 1000,
            "first_commit_at": "2024-12-24 04:40:58"
        }
    ]
}
Critical bulk_committer_takeover Getwid – Gutenberg Blocks (50k+ installs) Resolved 5mo ago
Committerjetmonsters
Member since2021-10-08
Plugins joined15
Spread days26
Earliest join2021-10-27 13:11:42
Latest join2021-11-22 23:25:34
Combined installs195,000
Sample plugins
SlugActive installsFirst commit at
getwid50,0002021-10-27 14:13:09
jetsticky-for-elementor30,0002021-11-16 12:56:44
mp-timetable30,0002021-10-28 14:48:12
stratum20,0002021-10-27 13:11:42
jetwidgets-for-elementor10,0002021-11-18 11:56:55
motopress-hotel-booking-lite10,0002021-11-11 09:25:29
mphb-elementor10,0002021-11-22 23:16:49
mphb-styles10,0002021-11-22 23:25:34
jetwoo-widgets-for-elementor8,0002021-11-18 12:01:50
another-mailchimp-widget5,0002021-11-22 22:37:15
View raw JSON
{
    "committer": "jetmonsters",
    "member_since": "2021-10-08",
    "plugins_joined": 15,
    "spread_days": 26,
    "earliest_join": "2021-10-27 13:11:42",
    "latest_join": "2021-11-22 23:25:34",
    "combined_installs": 195000,
    "sample_plugins": [
        {
            "slug": "getwid",
            "active_installs": 50000,
            "first_commit_at": "2021-10-27 14:13:09"
        },
        {
            "slug": "jetsticky-for-elementor",
            "active_installs": 30000,
            "first_commit_at": "2021-11-16 12:56:44"
        },
        {
            "slug": "mp-timetable",
            "active_installs": 30000,
            "first_commit_at": "2021-10-28 14:48:12"
        },
        {
            "slug": "stratum",
            "active_installs": 20000,
            "first_commit_at": "2021-10-27 13:11:42"
        },
        {
            "slug": "jetwidgets-for-elementor",
            "active_installs": 10000,
            "first_commit_at": "2021-11-18 11:56:55"
        },
        {
            "slug": "motopress-hotel-booking-lite",
            "active_installs": 10000,
            "first_commit_at": "2021-11-11 09:25:29"
        },
        {
            "slug": "mphb-elementor",
            "active_installs": 10000,
            "first_commit_at": "2021-11-22 23:16:49"
        },
        {
            "slug": "mphb-styles",
            "active_installs": 10000,
            "first_commit_at": "2021-11-22 23:25:34"
        },
        {
            "slug": "jetwoo-widgets-for-elementor",
            "active_installs": 8000,
            "first_commit_at": "2021-11-18 12:01:50"
        },
        {
            "slug": "another-mailchimp-widget",
            "active_installs": 5000,
            "first_commit_at": "2021-11-22 22:37:15"
        }
    ]
}
Critical bulk_committer_takeover BlossomThemes Toolkit (30k+ installs) Resolved 5mo ago
Committerprakhadkash
Member since—
Plugins joined13
Spread days76
Earliest join2024-07-04 05:32:41
Latest join2024-09-18 06:08:00
Combined installs145,000
Sample plugins
SlugActive installsFirst commit at
blossomthemes-toolkit30,0002024-07-30 09:24:53
blossomthemes-email-newsletter20,0002024-09-18 05:12:46
rara-one-click-demo-import20,0002024-07-30 09:31:09
wp-travel-engine20,0002024-07-04 05:32:41
demo-importer-plus10,0002024-09-18 06:08:00
mega-elements-addons-for-elementor10,0002024-07-30 08:38:41
raratheme-companion10,0002024-07-30 09:27:29
wte-elementor-widgets10,0002024-07-30 07:46:41
delicious-recipes4,0002024-07-18 07:55:42
travel-agency-companion4,0002024-07-30 08:26:57
View raw JSON
{
    "committer": "prakhadkash",
    "member_since": null,
    "plugins_joined": 13,
    "spread_days": 76,
    "earliest_join": "2024-07-04 05:32:41",
    "latest_join": "2024-09-18 06:08:00",
    "combined_installs": 145000,
    "sample_plugins": [
        {
            "slug": "blossomthemes-toolkit",
            "active_installs": 30000,
            "first_commit_at": "2024-07-30 09:24:53"
        },
        {
            "slug": "blossomthemes-email-newsletter",
            "active_installs": 20000,
            "first_commit_at": "2024-09-18 05:12:46"
        },
        {
            "slug": "rara-one-click-demo-import",
            "active_installs": 20000,
            "first_commit_at": "2024-07-30 09:31:09"
        },
        {
            "slug": "wp-travel-engine",
            "active_installs": 20000,
            "first_commit_at": "2024-07-04 05:32:41"
        },
        {
            "slug": "demo-importer-plus",
            "active_installs": 10000,
            "first_commit_at": "2024-09-18 06:08:00"
        },
        {
            "slug": "mega-elements-addons-for-elementor",
            "active_installs": 10000,
            "first_commit_at": "2024-07-30 08:38:41"
        },
        {
            "slug": "raratheme-companion",
            "active_installs": 10000,
            "first_commit_at": "2024-07-30 09:27:29"
        },
        {
            "slug": "wte-elementor-widgets",
            "active_installs": 10000,
            "first_commit_at": "2024-07-30 07:46:41"
        },
        {
            "slug": "delicious-recipes",
            "active_installs": 4000,
            "first_commit_at": "2024-07-18 07:55:42"
        },
        {
            "slug": "travel-agency-companion",
            "active_installs": 4000,
            "first_commit_at": "2024-07-30 08:26:57"
        }
    ]
}
Critical bulk_committer_takeover WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel (100k+ installs) Resolved 5mo ago
Committerix3
Member since2014-08-26
Plugins joined12
Spread days177
Earliest join2025-06-11 20:25:27
Latest join2025-12-05 20:51:20
Combined installs279,000
Sample plugins
SlugActive installsFirst commit at
wp-all-export100,0002025-12-05 20:51:20
wp-all-import100,0002025-12-05 19:54:35
woocommerce-xml-csv-product-import20,0002025-06-11 20:44:33
yoast-seo-settings-xml-csv-import20,0002025-06-11 20:27:53
import-users-from-csv10,0002025-06-11 20:32:23
product-export-for-woocommerce10,0002025-06-11 20:48:18
import-xml-csv-settings-to-rank-math-seo7,0002025-06-11 20:28:10
csv-importer4,0002025-06-11 20:32:43
order-export-for-woocommerce3,0002025-06-11 20:50:15
export-wp-users-xml-csv2,0002025-06-11 20:39:15
View raw JSON
{
    "committer": "ix3",
    "member_since": "2014-08-26",
    "plugins_joined": 12,
    "spread_days": 177,
    "earliest_join": "2025-06-11 20:25:27",
    "latest_join": "2025-12-05 20:51:20",
    "combined_installs": 279000,
    "sample_plugins": [
        {
            "slug": "wp-all-export",
            "active_installs": 100000,
            "first_commit_at": "2025-12-05 20:51:20"
        },
        {
            "slug": "wp-all-import",
            "active_installs": 100000,
            "first_commit_at": "2025-12-05 19:54:35"
        },
        {
            "slug": "woocommerce-xml-csv-product-import",
            "active_installs": 20000,
            "first_commit_at": "2025-06-11 20:44:33"
        },
        {
            "slug": "yoast-seo-settings-xml-csv-import",
            "active_installs": 20000,
            "first_commit_at": "2025-06-11 20:27:53"
        },
        {
            "slug": "import-users-from-csv",
            "active_installs": 10000,
            "first_commit_at": "2025-06-11 20:32:23"
        },
        {
            "slug": "product-export-for-woocommerce",
            "active_installs": 10000,
            "first_commit_at": "2025-06-11 20:48:18"
        },
        {
            "slug": "import-xml-csv-settings-to-rank-math-seo",
            "active_installs": 7000,
            "first_commit_at": "2025-06-11 20:28:10"
        },
        {
            "slug": "csv-importer",
            "active_installs": 4000,
            "first_commit_at": "2025-06-11 20:32:43"
        },
        {
            "slug": "order-export-for-woocommerce",
            "active_installs": 3000,
            "first_commit_at": "2025-06-11 20:50:15"
        },
        {
            "slug": "export-wp-users-xml-csv",
            "active_installs": 2000,
            "first_commit_at": "2025-06-11 20:39:15"
        }
    ]
}
Critical bulk_committer_takeover WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel (100k+ installs) Resolved 5mo ago
Committersolideiglor
Member since2025-01-30
Plugins joined10
Spread days302
Earliest join2025-04-03 00:21:41
Latest join2026-01-30 15:14:00
Combined installs265,000
Sample plugins
SlugActive installsFirst commit at
wp-all-export100,0002025-06-04 18:44:50
wp-all-import100,0002025-04-03 00:21:41
woocommerce-xml-csv-product-import20,0002025-09-04 00:50:11
yoast-seo-settings-xml-csv-import20,0002026-01-13 15:16:06
product-export-for-woocommerce10,0002025-09-04 01:34:47
import-xml-csv-settings-to-rank-math-seo7,0002026-01-13 15:23:43
order-export-for-woocommerce3,0002025-09-04 01:24:50
export-wp-users-xml-csv2,0002026-01-12 14:49:10
wp-job-manager-xml-csv-listings-import2,0002026-01-30 15:14:00
import-xml-csv-settings-to-all-in-one-seo-pack1,0002026-01-30 13:33:48
View raw JSON
{
    "committer": "solideiglor",
    "member_since": "2025-01-30",
    "plugins_joined": 10,
    "spread_days": 302,
    "earliest_join": "2025-04-03 00:21:41",
    "latest_join": "2026-01-30 15:14:00",
    "combined_installs": 265000,
    "sample_plugins": [
        {
            "slug": "wp-all-export",
            "active_installs": 100000,
            "first_commit_at": "2025-06-04 18:44:50"
        },
        {
            "slug": "wp-all-import",
            "active_installs": 100000,
            "first_commit_at": "2025-04-03 00:21:41"
        },
        {
            "slug": "woocommerce-xml-csv-product-import",
            "active_installs": 20000,
            "first_commit_at": "2025-09-04 00:50:11"
        },
        {
            "slug": "yoast-seo-settings-xml-csv-import",
            "active_installs": 20000,
            "first_commit_at": "2026-01-13 15:16:06"
        },
        {
            "slug": "product-export-for-woocommerce",
            "active_installs": 10000,
            "first_commit_at": "2025-09-04 01:34:47"
        },
        {
            "slug": "import-xml-csv-settings-to-rank-math-seo",
            "active_installs": 7000,
            "first_commit_at": "2026-01-13 15:23:43"
        },
        {
            "slug": "order-export-for-woocommerce",
            "active_installs": 3000,
            "first_commit_at": "2025-09-04 01:24:50"
        },
        {
            "slug": "export-wp-users-xml-csv",
            "active_installs": 2000,
            "first_commit_at": "2026-01-12 14:49:10"
        },
        {
            "slug": "wp-job-manager-xml-csv-listings-import",
            "active_installs": 2000,
            "first_commit_at": "2026-01-30 15:14:00"
        },
        {
            "slug": "import-xml-csv-settings-to-all-in-one-seo-pack",
            "active_installs": 1000,
            "first_commit_at": "2026-01-30 13:33:48"
        }
    ]
}
Critical code_pattern WP Webhooks – Automate repetitive tasks by creating powerful automation workflows directly within WordPress (20k+ installs) Resolved 5mo ago
Slugwp-webhooks
Patternserialized_admin_role
Kindbuiltin
Version3.4.1
Hit count4
First hit
File
core/includes/integrations/wordpress/triggers/create_user.php
Line
249
Snippet
0 => 'a:1:{s:13:"administrator";b:1;}',
Explanationplugin source contains `s:13:"administrator"` — the PHP-serialized representation of the `administrator` role meta value. Used to bypass `wp_insert_user()` by writing directly to `wp_usermeta` with a hand-crafted capabilities string. Near-zero FP because legit code uses `WP_User::set_role()` instead of building the serialized form by hand.
View raw JSON
{
    "slug": "wp-webhooks",
    "pattern": "serialized_admin_role",
    "kind": "builtin",
    "version": "3.4.1",
    "hit_count": 4,
    "first_hit": {
        "file": "core/includes/integrations/wordpress/triggers/create_user.php",
        "line": 249,
        "snippet": "0 => 'a:1:{s:13:\"administrator\";b:1;}',"
    },
    "explanation": "plugin source contains `s:13:\"administrator\"` \u2014 the PHP-serialized representation of the `administrator` role meta value. Used to bypass `wp_insert_user()` by writing directly to `wp_usermeta` with a hand-crafted capabilities string. Near-zero FP because legit code uses `WP_User::set_role()` instead of building the serialized form by hand."
}
Critical code_scan_delta WP Webhooks – Automate repetitive tasks by creating powerful automation workflows directly within WordPress (20k+ installs) Resolved 5mo ago
Slugwp-webhooks
Previous version3.4.0
Current version3.4.1
New findings
PatternKindFileLineSnippetConfidence
serialized_admin_rolebuiltincore/includes/integrations/wordpress/triggers/create_user.php2490 => 'a:1:{s:13:"administrator";b:1;}',high
serialized_admin_rolebuiltincore/includes/integrations/wordpress/triggers/update_user.php2690 => 'a:1:{s:13:"administrator";b:1;}',high
serialized_admin_rolebuiltincore/includes/integrations/wordpress/triggers/deleted_user.php3060 => 'a:1:{s:13:"administrator";b:1;}',high
serialized_admin_rolebuiltincore/includes/integrations/wordpress/triggers/login_user.php2650 => 'a:1:{s:13:"administrator";b:1;}',high
New finding count4
View raw JSON
{
    "slug": "wp-webhooks",
    "previous_version": "3.4.0",
    "current_version": "3.4.1",
    "new_findings": [
        {
            "pattern": "serialized_admin_role",
            "kind": "builtin",
            "file": "core/includes/integrations/wordpress/triggers/create_user.php",
            "line": 249,
            "snippet": "0 => 'a:1:{s:13:\"administrator\";b:1;}',",
            "confidence": "high"
        },
        {
            "pattern": "serialized_admin_role",
            "kind": "builtin",
            "file": "core/includes/integrations/wordpress/triggers/update_user.php",
            "line": 269,
            "snippet": "0 => 'a:1:{s:13:\"administrator\";b:1;}',",
            "confidence": "high"
        },
        {
            "pattern": "serialized_admin_role",
            "kind": "builtin",
            "file": "core/includes/integrations/wordpress/triggers/deleted_user.php",
            "line": 306,
            "snippet": "0 => 'a:1:{s:13:\"administrator\";b:1;}',",
            "confidence": "high"
        },
        {
            "pattern": "serialized_admin_role",
            "kind": "builtin",
            "file": "core/includes/integrations/wordpress/triggers/login_user.php",
            "line": 265,
            "snippet": "0 => 'a:1:{s:13:\"administrator\";b:1;}',",
            "confidence": "high"
        }
    ],
    "new_finding_count": 4
}
Critical code_scan_delta Photo Gallery by 10Web – Mobile-Friendly Image Gallery (100k+ installs) Resolved 5mo ago
Slugphoto-gallery
Previous version1.8.39
Current version1.8.40
New findings
PatternKindFileLineSnippetConfidenceDetails
remote_enqueuebuiltinfrontend/views/view.php17wp_register_script( 'instagram-embed', 'https://www.instagram.com/embed.js' );medium
Url
https://www.instagram.com/embed.js
Url host
www.instagram.com
New finding count1
Serial offender noteSeverity bumped high→critical: author 10web has 6 prior security-issue closures on wp.org.
View raw JSON
{
    "slug": "photo-gallery",
    "previous_version": "1.8.39",
    "current_version": "1.8.40",
    "new_findings": [
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "frontend/views/view.php",
            "line": 17,
            "snippet": "wp_register_script( 'instagram-embed', 'https://www.instagram.com/embed.js' );",
            "confidence": "medium",
            "details": {
                "url": "https://www.instagram.com/embed.js",
                "url_host": "www.instagram.com"
            }
        }
    ],
    "new_finding_count": 1,
    "serial_offender_note": "Severity bumped high\u2192critical: author 10web has 6 prior security-issue closures on wp.org."
}
Critical new_committer_young_account Video Gallery for WooCommerce – Add Product Video & Featured Video (4k+ installs) Resolved 5mo ago
Slugvideo-wc-gallery
Committernitramix
Display nameNitramix
Member since2025-12-03
First commit at2025-12-09 22:13:33
Account age at first commit6
Commit count11
Active installs3,000
View raw JSON
{
    "slug": "video-wc-gallery",
    "committer": "nitramix",
    "display_name": "Nitramix",
    "member_since": "2025-12-03",
    "first_commit_at": "2025-12-09 22:13:33",
    "account_age_at_first_commit": 6,
    "commit_count": 11,
    "active_installs": 3000
}
Critical new_committer_young_account Related Products for WooCommerce (3k+ installs) Resolved 5mo ago
Slugwoo-related-products-refresh-on-reload
Committervikrantsant
Display nameVikrant Sant
Member since2025-08-11
First commit at2025-10-02 10:56:20
Account age at first commit52
Commit count1
Active installs3,000
View raw JSON
{
    "slug": "woo-related-products-refresh-on-reload",
    "committer": "vikrantsant",
    "display_name": "Vikrant Sant",
    "member_since": "2025-08-11",
    "first_commit_at": "2025-10-02 10:56:20",
    "account_age_at_first_commit": 52,
    "commit_count": 1,
    "active_installs": 3000
}
Critical new_committer_young_account Page Loader (2k+ installs) Resolved 5mo ago
Slugpage-loader
Committerpluginers
Display namepluginers
Member since2024-07-31
First commit at2024-08-22 15:16:34
Account age at first commit22
Commit count1
Active installs3,000
View raw JSON
{
    "slug": "page-loader",
    "committer": "pluginers",
    "display_name": "pluginers",
    "member_since": "2024-07-31",
    "first_commit_at": "2024-08-22 15:16:34",
    "account_age_at_first_commit": 22,
    "commit_count": 1,
    "active_installs": 3000
}
Critical new_committer_young_account WP CTA – Call Now Button, Sticky Button & Call to Action Builder (2k+ installs) Resolved 5mo ago
Slugeasy-sticky-sidebar
Committermandeeps1987
Display namemandeeps1987
Member since2026-02-11
First commit at2026-02-11 17:52:35
Account age at first commit0
Commit count37
Active installs2,000
View raw JSON
{
    "slug": "easy-sticky-sidebar",
    "committer": "mandeeps1987",
    "display_name": "mandeeps1987",
    "member_since": "2026-02-11",
    "first_commit_at": "2026-02-11 17:52:35",
    "account_age_at_first_commit": 0,
    "commit_count": 37,
    "active_installs": 2000
}
Critical new_committer_young_account Advance Custom HTML – Show Off Code Snippets with Live Preview (10k+ installs) Resolved 5mo ago
Slugadvance-custom-html
Committertaninrahman
Display nameTanin Rahman
Member since2025-01-25
First commit at2025-01-26 04:46:28
Account age at first commit1
Commit count1
Active installs10,000
View raw JSON
{
    "slug": "advance-custom-html",
    "committer": "taninrahman",
    "display_name": "Tanin Rahman",
    "member_since": "2025-01-25",
    "first_commit_at": "2025-01-26 04:46:28",
    "account_age_at_first_commit": 1,
    "commit_count": 1,
    "active_installs": 10000
}
Critical new_committer_young_account Document Embedder Addons for Elementor – Embed Documents in Elementor Websites (6k+ installs) Resolved 5mo ago
Slugdocument-embedder-addons-for-elementor
Committerhazrath
Display namehazrath
Member since2025-12-02
First commit at2025-12-02 10:16:08
Account age at first commit0
Commit count28
Active installs6,000
View raw JSON
{
    "slug": "document-embedder-addons-for-elementor",
    "committer": "hazrath",
    "display_name": "hazrath",
    "member_since": "2025-12-02",
    "first_commit_at": "2025-12-02 10:16:08",
    "account_age_at_first_commit": 0,
    "commit_count": 28,
    "active_installs": 6000
}
Critical bulk_committer_takeover Getwid – Gutenberg Blocks (50k+ installs) Resolved 5mo ago
Committerjetmonsters
Member since2021-10-08
Plugins joined12
Spread days26
Earliest join2021-10-27 13:11:42
Latest join2021-11-22 23:25:34
Combined installs201,000
Sample plugins
SlugActive installsFirst commit at
getwid50,0002021-10-27 14:13:09
jetsticky-for-elementor30,0002021-11-16 12:56:44
mp-timetable30,0002021-10-28 14:48:12
stratum30,0002021-10-27 13:11:42
jetwidgets-for-elementor10,0002021-11-18 11:56:55
motopress-hotel-booking-lite10,0002021-11-11 09:25:29
mphb-elementor10,0002021-11-22 23:16:49
mphb-styles10,0002021-11-22 23:25:34
jetwoo-widgets-for-elementor8,0002021-11-18 12:01:50
another-mailchimp-widget5,0002021-11-22 22:37:15
View raw JSON
{
    "committer": "jetmonsters",
    "member_since": "2021-10-08",
    "plugins_joined": 12,
    "spread_days": 26,
    "earliest_join": "2021-10-27 13:11:42",
    "latest_join": "2021-11-22 23:25:34",
    "combined_installs": 201000,
    "sample_plugins": [
        {
            "slug": "getwid",
            "active_installs": 50000,
            "first_commit_at": "2021-10-27 14:13:09"
        },
        {
            "slug": "jetsticky-for-elementor",
            "active_installs": 30000,
            "first_commit_at": "2021-11-16 12:56:44"
        },
        {
            "slug": "mp-timetable",
            "active_installs": 30000,
            "first_commit_at": "2021-10-28 14:48:12"
        },
        {
            "slug": "stratum",
            "active_installs": 30000,
            "first_commit_at": "2021-10-27 13:11:42"
        },
        {
            "slug": "jetwidgets-for-elementor",
            "active_installs": 10000,
            "first_commit_at": "2021-11-18 11:56:55"
        },
        {
            "slug": "motopress-hotel-booking-lite",
            "active_installs": 10000,
            "first_commit_at": "2021-11-11 09:25:29"
        },
        {
            "slug": "mphb-elementor",
            "active_installs": 10000,
            "first_commit_at": "2021-11-22 23:16:49"
        },
        {
            "slug": "mphb-styles",
            "active_installs": 10000,
            "first_commit_at": "2021-11-22 23:25:34"
        },
        {
            "slug": "jetwoo-widgets-for-elementor",
            "active_installs": 8000,
            "first_commit_at": "2021-11-18 12:01:50"
        },
        {
            "slug": "another-mailchimp-widget",
            "active_installs": 5000,
            "first_commit_at": "2021-11-22 22:37:15"
        }
    ]
}
Critical bulk_committer_takeover BlossomThemes Toolkit (30k+ installs) Resolved 5mo ago
Committerprakhadkash
Member since—
Plugins joined12
Spread days76
Earliest join2024-07-04 05:32:41
Latest join2024-09-18 06:08:00
Combined installs144,000
Sample plugins
SlugActive installsFirst commit at
blossomthemes-toolkit30,0002024-07-30 09:24:53
blossomthemes-email-newsletter20,0002024-09-18 05:12:46
rara-one-click-demo-import20,0002024-07-30 09:31:09
wp-travel-engine20,0002024-07-04 05:32:41
demo-importer-plus10,0002024-09-18 06:08:00
mega-elements-addons-for-elementor10,0002024-07-30 08:38:41
raratheme-companion10,0002024-07-30 09:27:29
wte-elementor-widgets10,0002024-07-30 07:46:41
delicious-recipes4,0002024-07-18 07:55:42
travel-agency-companion4,0002024-07-30 08:26:57
View raw JSON
{
    "committer": "prakhadkash",
    "member_since": null,
    "plugins_joined": 12,
    "spread_days": 76,
    "earliest_join": "2024-07-04 05:32:41",
    "latest_join": "2024-09-18 06:08:00",
    "combined_installs": 144000,
    "sample_plugins": [
        {
            "slug": "blossomthemes-toolkit",
            "active_installs": 30000,
            "first_commit_at": "2024-07-30 09:24:53"
        },
        {
            "slug": "blossomthemes-email-newsletter",
            "active_installs": 20000,
            "first_commit_at": "2024-09-18 05:12:46"
        },
        {
            "slug": "rara-one-click-demo-import",
            "active_installs": 20000,
            "first_commit_at": "2024-07-30 09:31:09"
        },
        {
            "slug": "wp-travel-engine",
            "active_installs": 20000,
            "first_commit_at": "2024-07-04 05:32:41"
        },
        {
            "slug": "demo-importer-plus",
            "active_installs": 10000,
            "first_commit_at": "2024-09-18 06:08:00"
        },
        {
            "slug": "mega-elements-addons-for-elementor",
            "active_installs": 10000,
            "first_commit_at": "2024-07-30 08:38:41"
        },
        {
            "slug": "raratheme-companion",
            "active_installs": 10000,
            "first_commit_at": "2024-07-30 09:27:29"
        },
        {
            "slug": "wte-elementor-widgets",
            "active_installs": 10000,
            "first_commit_at": "2024-07-30 07:46:41"
        },
        {
            "slug": "delicious-recipes",
            "active_installs": 4000,
            "first_commit_at": "2024-07-18 07:55:42"
        },
        {
            "slug": "travel-agency-companion",
            "active_installs": 4000,
            "first_commit_at": "2024-07-30 08:26:57"
        }
    ]
}
Critical bulk_committer_takeover WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel (100k+ installs) Resolved 5mo ago
Committerix3
Member since2014-08-26
Plugins joined11
Spread days177
Earliest join2025-06-11 20:25:27
Latest join2025-12-05 20:51:20
Combined installs278,000
Sample plugins
SlugActive installsFirst commit at
wp-all-export100,0002025-12-05 20:51:20
wp-all-import100,0002025-12-05 19:54:35
woocommerce-xml-csv-product-import20,0002025-06-11 20:44:33
yoast-seo-settings-xml-csv-import20,0002025-06-11 20:27:53
import-users-from-csv10,0002025-06-11 20:32:23
product-export-for-woocommerce10,0002025-06-11 20:48:18
import-xml-csv-settings-to-rank-math-seo7,0002025-06-11 20:28:10
csv-importer4,0002025-06-11 20:32:43
order-export-for-woocommerce3,0002025-06-11 20:50:15
export-wp-users-xml-csv2,0002025-06-11 20:39:15
View raw JSON
{
    "committer": "ix3",
    "member_since": "2014-08-26",
    "plugins_joined": 11,
    "spread_days": 177,
    "earliest_join": "2025-06-11 20:25:27",
    "latest_join": "2025-12-05 20:51:20",
    "combined_installs": 278000,
    "sample_plugins": [
        {
            "slug": "wp-all-export",
            "active_installs": 100000,
            "first_commit_at": "2025-12-05 20:51:20"
        },
        {
            "slug": "wp-all-import",
            "active_installs": 100000,
            "first_commit_at": "2025-12-05 19:54:35"
        },
        {
            "slug": "woocommerce-xml-csv-product-import",
            "active_installs": 20000,
            "first_commit_at": "2025-06-11 20:44:33"
        },
        {
            "slug": "yoast-seo-settings-xml-csv-import",
            "active_installs": 20000,
            "first_commit_at": "2025-06-11 20:27:53"
        },
        {
            "slug": "import-users-from-csv",
            "active_installs": 10000,
            "first_commit_at": "2025-06-11 20:32:23"
        },
        {
            "slug": "product-export-for-woocommerce",
            "active_installs": 10000,
            "first_commit_at": "2025-06-11 20:48:18"
        },
        {
            "slug": "import-xml-csv-settings-to-rank-math-seo",
            "active_installs": 7000,
            "first_commit_at": "2025-06-11 20:28:10"
        },
        {
            "slug": "csv-importer",
            "active_installs": 4000,
            "first_commit_at": "2025-06-11 20:32:43"
        },
        {
            "slug": "order-export-for-woocommerce",
            "active_installs": 3000,
            "first_commit_at": "2025-06-11 20:50:15"
        },
        {
            "slug": "export-wp-users-xml-csv",
            "active_installs": 2000,
            "first_commit_at": "2025-06-11 20:39:15"
        }
    ]
}
Critical bulk_committer_takeover Safe SVG (1M+ installs) Resolved 5mo ago
Committer10up
Member since2011-09-22
Plugins joined11
Spread days182
Earliest join2022-01-27 16:33:57
Latest join2022-07-28 17:35:30
Combined installs1,371,000
Sample plugins
SlugActive installsFirst commit at
safe-svg1,000,0002022-02-23 18:22:50
ads-txt100,0002022-04-20 01:05:00
simple-local-avatars100,0002022-04-25 09:48:41
simple-page-ordering100,0002022-04-28 16:25:47
safe-redirect-manager40,0002022-06-27 12:08:46
restricted-site-access10,0002022-02-08 18:42:57
elasticpress8,0002022-03-08 21:28:25
autoshare-for-twitter6,0002022-04-13 12:33:05
insert-special-characters3,0002022-01-27 16:33:57
convert-to-blocks2,0002022-07-28 17:35:30
View raw JSON
{
    "committer": "10up",
    "member_since": "2011-09-22",
    "plugins_joined": 11,
    "spread_days": 182,
    "earliest_join": "2022-01-27 16:33:57",
    "latest_join": "2022-07-28 17:35:30",
    "combined_installs": 1371000,
    "sample_plugins": [
        {
            "slug": "safe-svg",
            "active_installs": 1000000,
            "first_commit_at": "2022-02-23 18:22:50"
        },
        {
            "slug": "ads-txt",
            "active_installs": 100000,
            "first_commit_at": "2022-04-20 01:05:00"
        },
        {
            "slug": "simple-local-avatars",
            "active_installs": 100000,
            "first_commit_at": "2022-04-25 09:48:41"
        },
        {
            "slug": "simple-page-ordering",
            "active_installs": 100000,
            "first_commit_at": "2022-04-28 16:25:47"
        },
        {
            "slug": "safe-redirect-manager",
            "active_installs": 40000,
            "first_commit_at": "2022-06-27 12:08:46"
        },
        {
            "slug": "restricted-site-access",
            "active_installs": 10000,
            "first_commit_at": "2022-02-08 18:42:57"
        },
        {
            "slug": "elasticpress",
            "active_installs": 8000,
            "first_commit_at": "2022-03-08 21:28:25"
        },
        {
            "slug": "autoshare-for-twitter",
            "active_installs": 6000,
            "first_commit_at": "2022-04-13 12:33:05"
        },
        {
            "slug": "insert-special-characters",
            "active_installs": 3000,
            "first_commit_at": "2022-01-27 16:33:57"
        },
        {
            "slug": "convert-to-blocks",
            "active_installs": 2000,
            "first_commit_at": "2022-07-28 17:35:30"
        }
    ]
}
Critical bulk_committer_takeover Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy (30k+ installs) Resolved 5mo ago
Committerwedevs
Member since2014-12-22
Plugins joined11
Spread days353
Earliest join2024-02-01 15:46:33
Latest join2025-01-20 11:59:50
Combined installs137,000
Sample plugins
SlugActive installsFirst commit at
dokan-lite40,0002024-10-08 07:59:20
woocommerce-conversion-tracking20,0002024-12-09 09:55:22
wp-user-frontend20,0002024-10-15 03:05:01
subscribe210,0002025-01-20 11:59:50
wemail10,0002024-10-08 06:46:45
wp-recaptcha-integration10,0002024-10-28 09:37:43
texty9,0002024-10-08 10:04:57
erp6,0002024-10-14 09:39:22
wedevs-project-manager6,0002024-12-12 06:02:51
wedocs4,0002024-02-01 15:46:33
View raw JSON
{
    "committer": "wedevs",
    "member_since": "2014-12-22",
    "plugins_joined": 11,
    "spread_days": 353,
    "earliest_join": "2024-02-01 15:46:33",
    "latest_join": "2025-01-20 11:59:50",
    "combined_installs": 137000,
    "sample_plugins": [
        {
            "slug": "dokan-lite",
            "active_installs": 40000,
            "first_commit_at": "2024-10-08 07:59:20"
        },
        {
            "slug": "woocommerce-conversion-tracking",
            "active_installs": 20000,
            "first_commit_at": "2024-12-09 09:55:22"
        },
        {
            "slug": "wp-user-frontend",
            "active_installs": 20000,
            "first_commit_at": "2024-10-15 03:05:01"
        },
        {
            "slug": "subscribe2",
            "active_installs": 10000,
            "first_commit_at": "2025-01-20 11:59:50"
        },
        {
            "slug": "wemail",
            "active_installs": 10000,
            "first_commit_at": "2024-10-08 06:46:45"
        },
        {
            "slug": "wp-recaptcha-integration",
            "active_installs": 10000,
            "first_commit_at": "2024-10-28 09:37:43"
        },
        {
            "slug": "texty",
            "active_installs": 9000,
            "first_commit_at": "2024-10-08 10:04:57"
        },
        {
            "slug": "erp",
            "active_installs": 6000,
            "first_commit_at": "2024-10-14 09:39:22"
        },
        {
            "slug": "wedevs-project-manager",
            "active_installs": 6000,
            "first_commit_at": "2024-12-12 06:02:51"
        },
        {
            "slug": "wedocs",
            "active_installs": 4000,
            "first_commit_at": "2024-02-01 15:46:33"
        }
    ]
}
Critical new_committer_young_account Social Share Block – Help Visitors Spread Your Content Everywhere (2k+ installs) Resolved 5mo ago
Slugb-social-share
Committerprosanta10
Display nameProsanta Roy
Member since2025-10-23
First commit at2025-12-30 05:02:35
Account age at first commit68
Commit count16
Active installs2,000
View raw JSON
{
    "slug": "b-social-share",
    "committer": "prosanta10",
    "display_name": "Prosanta Roy",
    "member_since": "2025-10-23",
    "first_commit_at": "2025-12-30 05:02:35",
    "account_age_at_first_commit": 68,
    "commit_count": 16,
    "active_installs": 2000
}
Critical new_committer_young_account Maximum, Minimum and Multiple Quantity for WooCommerce Shops (3k+ installs) Resolved 5mo ago
Slugwoocommerce-max-quantity
Committernakedcatplugins
Display nameNaked Cat Plugins
Member since2025-04-10
First commit at2025-04-14 10:45:38
Account age at first commit4
Commit count3
Active installs3,000
View raw JSON
{
    "slug": "woocommerce-max-quantity",
    "committer": "nakedcatplugins",
    "display_name": "Naked Cat Plugins",
    "member_since": "2025-04-10",
    "first_commit_at": "2025-04-14 10:45:38",
    "account_age_at_first_commit": 4,
    "commit_count": 3,
    "active_installs": 3000
}
Critical code_pattern Content Egg – Affiliate Product Importer & Price Comparison (10k+ installs) Benign 5mo ago
Slugcontent-egg
Patternhardcoded_ip_url
Kindbuiltin
Version11.0.0
Hit count1
First hit
File
application/libs/admitad/AdmitadProducts.php
Line
22
Snippet
const API_URI_BASE = 'http://185.58.206.88/wp';
Explanationplugin source hardcodes a raw IPv4 URL (e.g. `https://94.156.79.8/...`) — legitimate plugins use DNS hostnames because IPs change. Hardcoded IPs in plugin code are almost always either dev leftovers or attacker C2 infrastructure. The June 2024 social-warfare keylogger (audit #14) used `https://94.156.79.8/sc-top.js` for the JS payload host, `/AddSites` for victim registration, `/CMSUsers` for filesystem-recon exfil. Operator infrastructure on raw IPs avoids domain registration / RDAP detection paths. Post-filtered to skip RFC1918/loopback/link-local ranges and `vendor/`/`tests/` paths.
View raw JSON
{
    "slug": "content-egg",
    "pattern": "hardcoded_ip_url",
    "kind": "builtin",
    "version": "11.0.0",
    "hit_count": 1,
    "first_hit": {
        "file": "application/libs/admitad/AdmitadProducts.php",
        "line": 22,
        "snippet": "const API_URI_BASE = 'http://185.58.206.88/wp';"
    },
    "explanation": "plugin source hardcodes a raw IPv4 URL (e.g. `https://94.156.79.8/...`) \u2014 legitimate plugins use DNS hostnames because IPs change. Hardcoded IPs in plugin code are almost always either dev leftovers or attacker C2 infrastructure. The June 2024 social-warfare keylogger (audit #14) used `https://94.156.79.8/sc-top.js` for the JS payload host, `/AddSites` for victim registration, `/CMSUsers` for filesystem-recon exfil. Operator infrastructure on raw IPs avoids domain registration / RDAP detection paths. Post-filtered to skip RFC1918/loopback/link-local ranges and `vendor/`/`tests/` paths."
}
Critical code_pattern Content Egg – Affiliate Product Importer & Price Comparison (10k+ installs) Benign 5mo ago
Slugcontent-egg
Patternunserialize_after_remote_call
Kindbuiltin
Version11.0.0
Hit count1
First hit
File
application/libs/RestClient.php
Line
240
Snippet
L224: $error_mess .= ' Server replay: ' . \wp_remote_retrieve_body($response); → L240: $res = @unserialize($response);
Explanationa remote HTTP fetch (`wp_remote_*` / `curl_exec`) is followed by `@unserialize` within the same file — classic PHP Object Injection C2 gadget. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak. A real finding regardless of author intent: any plugin that deserializes remote responses without validation is a latent RCE chain if the remote endpoint is ever compromised.
View raw JSON
{
    "slug": "content-egg",
    "pattern": "unserialize_after_remote_call",
    "kind": "builtin",
    "version": "11.0.0",
    "hit_count": 1,
    "first_hit": {
        "file": "application/libs/RestClient.php",
        "line": 240,
        "snippet": "L224: $error_mess .= ' Server replay: ' . \\wp_remote_retrieve_body($response);  \u2192  L240: $res = @unserialize($response);"
    },
    "explanation": "a remote HTTP fetch (`wp_remote_*` / `curl_exec`) is followed by `@unserialize` within the same file \u2014 classic PHP Object Injection C2 gadget. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak. A real finding regardless of author intent: any plugin that deserializes remote responses without validation is a latent RCE chain if the remote endpoint is ever compromised."
}
Critical code_pattern Core Framework (10k+ installs) Resolved 5mo ago
Slugcore-framework
PatternPluginAUTH
Kindioc:code_pattern
Version1.10.2
Hit count3
First hit
File
wp/App/Backend/Settings.php
Line
51
Snippet
if (isset($preset['pluginAuthor'])) {
Explanation—
View raw JSON
{
    "slug": "core-framework",
    "pattern": "PluginAUTH",
    "kind": "ioc:code_pattern",
    "version": "1.10.2",
    "hit_count": 3,
    "first_hit": {
        "file": "wp/App/Backend/Settings.php",
        "line": 51,
        "snippet": "if (isset($preset['pluginAuthor'])) {"
    },
    "explanation": null
}