Events

{
    "slug": "automatic-domain-changer",
    "previous_version": "2.0.4",
    "current_version": "3.0.1",
    "dormancy_days": 388,
    "active_installs": 10000
}

{
    "slug": "is-there-a-problem",
    "pattern": "puc_update_hijack",
    "kind": "builtin",
    "version": "1.1.6",
    "hit_count": 1,
    "first_hit": {
        "file": "is-there-a-problem.php",
        "line": 413,
        "snippet": "$myUpdateChecker = Puc_v4_Factory::buildUpdateChecker("
    },
    "explanation": "plugin calls `::buildUpdateChecker()` \u2014 the factory entry point of the Yahnis Elsts Plugin Update Checker library. A plugin distributed through wordpress.org that registers its own update source is bypassing the Plugin Review Team: every install polls the non-wp.org URL on cron and installs whatever JSON + zip it returns, with full plugin-author permissions. This is the mechanism behind the `anadnet`/quick-pagepost-redirect-plugin compromise (2021) where the author seeded 70,000+ installs through tagged releases and then removed the library from trunk to hide the persistence. Any URL argument pointing away from `downloads.wordpress.org`/`api.wordpress.org` is the hijack signal.",
    "shape": "github_self_distro",
    "url": "https://github.com/martinfeuillet/Is-there-a-problem",
    "url_host": "github.com",
    "slug_arg": "is_there_a_problem"
}

{
    "slug": "stonehenge-em-slider",
    "pattern": "puc_update_hijack",
    "kind": "builtin",
    "version": "1.8.7",
    "hit_count": 1,
    "first_hit": {
        "file": "stonehenge/class-updater.php",
        "line": 49,
        "snippet": "$UpdateChecker = Puc_v4_Factory::buildUpdateChecker("
    },
    "explanation": "plugin calls `::buildUpdateChecker()` \u2014 the factory entry point of the Yahnis Elsts Plugin Update Checker library. A plugin distributed through wordpress.org that registers its own update source is bypassing the Plugin Review Team: every install polls the non-wp.org URL on cron and installs whatever JSON + zip it returns, with full plugin-author permissions. This is the mechanism behind the `anadnet`/quick-pagepost-redirect-plugin compromise (2021) where the author seeded 70,000+ installs through tagged releases and then removed the library from trunk to hide the persistence. Any URL argument pointing away from `downloads.wordpress.org`/`api.wordpress.org` is the hijack signal.",
    "shape": "unparseable",
    "url": null,
    "url_host": null,
    "slug_arg": null
}

{
    "slug": "events-manager-email-users",
    "pattern": "puc_update_hijack",
    "kind": "builtin",
    "version": "4.8.2",
    "hit_count": 1,
    "first_hit": {
        "file": "stonehenge/class-updater.php",
        "line": 49,
        "snippet": "$UpdateChecker = Puc_v4_Factory::buildUpdateChecker("
    },
    "explanation": "plugin calls `::buildUpdateChecker()` \u2014 the factory entry point of the Yahnis Elsts Plugin Update Checker library. A plugin distributed through wordpress.org that registers its own update source is bypassing the Plugin Review Team: every install polls the non-wp.org URL on cron and installs whatever JSON + zip it returns, with full plugin-author permissions. This is the mechanism behind the `anadnet`/quick-pagepost-redirect-plugin compromise (2021) where the author seeded 70,000+ installs through tagged releases and then removed the library from trunk to hide the persistence. Any URL argument pointing away from `downloads.wordpress.org`/`api.wordpress.org` is the hijack signal.",
    "shape": "unparseable",
    "url": null,
    "url_host": null,
    "slug_arg": null
}

{
    "slug": "bolt-cta-button",
    "active_installs": 1000,
    "is_closed": false,
    "prt_committers": [
        "plugin-master"
    ],
    "first_touch": "2026-04-23 10:33:46",
    "last_touch": "2026-04-23 10:33:46",
    "commit_count": 1,
    "commits_sample": [
        {
            "committer": "plugin-master",
            "at": "2026-04-23 10:33:46",
            "message": "Adding Bolt CTA Button by ismeteroglu."
        }
    ],
    "lookback_days": 30,
    "explanation": "wp.org Plugin Review Team committer touched this plugin within the last 30 days. PRT commits are confirmation-grade signal: they only happen when wp.org has already triaged the plugin as an incident."
}

{
    "slug": "fancy-image-show",
    "closed_reason": "",
    "closed_date": "2026-05-06 00:00:00",
    "active_installs": 80,
    "serial_offender_note": "Severity bumped low\u2192medium: author gopi_plus has 7 prior security-issue closures on wp.org."
}

{
    "slug": "fancy-image-show",
    "new_contributors": [
        "gopi_plus"
    ],
    "active_installs": 80,
    "serial_offender_note": "Severity bumped low\u2192medium: author gopi_plus has 7 prior security-issue closures on wp.org."
}

{
    "slug": "hero-posts-lite",
    "pattern": "puc_update_hijack",
    "kind": "builtin",
    "version": "1.0.6",
    "hit_count": 1,
    "first_hit": {
        "file": "bold-builder-light/bold-builder-light.php",
        "line": 79,
        "snippet": "$updateChecker = Puc_v4_Factory::buildUpdateChecker("
    },
    "explanation": "plugin calls `::buildUpdateChecker()` \u2014 the factory entry point of the Yahnis Elsts Plugin Update Checker library. A plugin distributed through wordpress.org that registers its own update source is bypassing the Plugin Review Team: every install polls the non-wp.org URL on cron and installs whatever JSON + zip it returns, with full plugin-author permissions. This is the mechanism behind the `anadnet`/quick-pagepost-redirect-plugin compromise (2021) where the author seeded 70,000+ installs through tagged releases and then removed the library from trunk to hide the persistence. Any URL argument pointing away from `downloads.wordpress.org`/`api.wordpress.org` is the hijack signal.",
    "shape": "unparseable",
    "url": null,
    "url_host": null,
    "slug_arg": null
}

{
    "slug": "stonehenge-em-osm",
    "pattern": "puc_update_hijack",
    "kind": "builtin",
    "version": "4.2.1",
    "hit_count": 3,
    "first_hit": {
        "file": "stonehenge/class-updater.php",
        "line": 49,
        "snippet": "$UpdateChecker = Puc_v4_Factory::buildUpdateChecker("
    },
    "explanation": "plugin calls `::buildUpdateChecker()` \u2014 the factory entry point of the Yahnis Elsts Plugin Update Checker library. A plugin distributed through wordpress.org that registers its own update source is bypassing the Plugin Review Team: every install polls the non-wp.org URL on cron and installs whatever JSON + zip it returns, with full plugin-author permissions. This is the mechanism behind the `anadnet`/quick-pagepost-redirect-plugin compromise (2021) where the author seeded 70,000+ installs through tagged releases and then removed the library from trunk to hide the persistence. Any URL argument pointing away from `downloads.wordpress.org`/`api.wordpress.org` is the hijack signal.",
    "shape": "unparseable",
    "url": null,
    "url_host": null,
    "slug_arg": null
}

{
    "slug": "yoo-slider",
    "pattern": "puc_update_hijack",
    "kind": "builtin",
    "version": "2.2.0",
    "hit_count": 1,
    "first_hit": {
        "file": "yoo-slider.php",
        "line": 56,
        "snippet": "$updateChecker = Puc_v4_Factory::buildUpdateChecker("
    },
    "explanation": "plugin calls `::buildUpdateChecker()` \u2014 the factory entry point of the Yahnis Elsts Plugin Update Checker library. A plugin distributed through wordpress.org that registers its own update source is bypassing the Plugin Review Team: every install polls the non-wp.org URL on cron and installs whatever JSON + zip it returns, with full plugin-author permissions. This is the mechanism behind the `anadnet`/quick-pagepost-redirect-plugin compromise (2021) where the author seeded 70,000+ installs through tagged releases and then removed the library from trunk to hide the persistence. Any URL argument pointing away from `downloads.wordpress.org`/`api.wordpress.org` is the hijack signal.",
    "shape": "unparseable",
    "url": null,
    "url_host": null,
    "slug_arg": null
}

{
    "slug": "open-rdw-kenteken-voertuiginformatie",
    "pattern": "puc_update_hijack",
    "kind": "builtin",
    "version": "5.3.0",
    "hit_count": 2,
    "first_hit": {
        "file": "app/Updater.php",
        "line": 60,
        "snippet": "self::$updater      = Factory::buildUpdateChecker($metadataUrl, $fullPath, $slug);"
    },
    "explanation": "plugin calls `::buildUpdateChecker()` \u2014 the factory entry point of the Yahnis Elsts Plugin Update Checker library. A plugin distributed through wordpress.org that registers its own update source is bypassing the Plugin Review Team: every install polls the non-wp.org URL on cron and installs whatever JSON + zip it returns, with full plugin-author permissions. This is the mechanism behind the `anadnet`/quick-pagepost-redirect-plugin compromise (2021) where the author seeded 70,000+ installs through tagged releases and then removed the library from trunk to hide the persistence. Any URL argument pointing away from `downloads.wordpress.org`/`api.wordpress.org` is the hijack signal.",
    "shape": "unparseable",
    "url": null,
    "url_host": null,
    "slug_arg": null
}

{
    "slug": "social-media-feather",
    "new_contributors": [
        "sharethis"
    ],
    "active_installs": 10000
}

{
    "slug": "knit-pay",
    "previous_version": "9.3.3.0",
    "current_version": "9.3.4.0",
    "new_findings": [
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "gateways/SBIePay/AES128.php",
            "line": 20,
            "snippet": "$cipher_text = base64_decode( $cipher_text );",
            "confidence": "medium"
        }
    ],
    "new_finding_count": 1
}

{
    "slug": "wp-asset-clean-up",
    "previous_version": "1.4.0.3",
    "current_version": "1.4.0.4",
    "dormancy_days": 419,
    "active_installs": 100000
}

{
    "slug": "animation-addons-for-elementor",
    "new_contributors": [
        "raselsec"
    ],
    "active_installs": 10000
}

{
    "slug": "sg-cachepress",
    "new_contributors": [
        "asparuhtenev"
    ],
    "active_installs": 1000000
}

{
    "slug": "logo-slider-wp",
    "new_contributors": [
        "sudarshan955"
    ],
    "active_installs": 10000
}

{
    "committer": "bestweblayout",
    "member_since": "2013-11-27",
    "plugins_joined": 5,
    "spread_days": 118,
    "earliest_join": "2014-06-17 09:30:30",
    "latest_join": "2014-10-14 07:25:34",
    "combined_installs": 530,
    "sample_plugins": [
        {
            "slug": "drop-cap-shortcode",
            "active_installs": 500,
            "first_commit_at": "2014-06-17 09:30:30"
        },
        {
            "slug": "enhanced-search-form",
            "active_installs": 30,
            "first_commit_at": "2014-08-27 10:23:24"
        },
        {
            "slug": "better-delete-revision",
            "active_installs": 0,
            "first_commit_at": "2014-07-24 10:00:45"
        },
        {
            "slug": "force-ssl",
            "active_installs": 0,
            "first_commit_at": "2014-08-18 11:31:24"
        },
        {
            "slug": "post-star-rating",
            "active_installs": 0,
            "first_commit_at": "2014-10-14 07:25:34"
        }
    ]
}

{
    "committer": "daisyplugins",
    "member_since": "2024-05-17",
    "plugins_joined": 5,
    "spread_days": 226,
    "earliest_join": "2025-05-21 01:37:42",
    "latest_join": "2026-01-02 17:13:57",
    "combined_installs": 10240,
    "sample_plugins": [
        {
            "slug": "hide-titles",
            "active_installs": 9000,
            "first_commit_at": "2025-05-21 01:37:42"
        },
        {
            "slug": "turn-off-comments",
            "active_installs": 1000,
            "first_commit_at": "2025-05-21 01:40:11"
        },
        {
            "slug": "hide-admin-navbar",
            "active_installs": 100,
            "first_commit_at": "2025-05-21 01:43:42"
        },
        {
            "slug": "tap-to-top",
            "active_installs": 100,
            "first_commit_at": "2026-01-02 17:13:57"
        },
        {
            "slug": "about-post-author",
            "active_installs": 40,
            "first_commit_at": "2026-01-02 16:51:41"
        }
    ]
}

{
    "slug": "clickcease-click-fraud-protection",
    "committer_slug": "pinidayan",
    "committer_display_name": "pinidayan",
    "committer_employer": null,
    "committer_member_since": "2025-12-09",
    "committer_first_commit": "2026-05-03 10:00:30",
    "committer_commit_count": 1,
    "plugin_listed_author": "eranfl",
    "earliest_plugin_commit": "2019-01-28 18:50:35",
    "plugin_age_at_join_days": 2651,
    "committer_age_at_join_days": 145,
    "active_installs": 10000
}

{
    "slug": "nginx-cache",
    "previous_version": "1.0.7",
    "current_version": "1.0.8",
    "dormancy_days": 523,
    "active_installs": 10000
}

{
    "slug": "jetpack",
    "new_contributors": [
        "jenhooks"
    ],
    "active_installs": 3000000
}

{
    "slug": "visa-acceptance-solutions",
    "finding_count": 52,
    "findings": [
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "vendor-prefixed/phpseclib3/Common/Functions/Strings.php",
            "line": 279,
            "snippet": "$str .= pack(PHP_INT_SIZE == 4 ? 'N' : 'J', $xor ^ eval('return 0b' . $part . ';'));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "vendor-prefixed/phpseclib3/Common/Functions/Strings.php",
            "line": 404,
            "snippet": "public static function base64_decode($data)",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "vendor-prefixed/phpseclib3/File/X509.php",
            "line": 469,
            "snippet": "$cert['tbsCertificate']['subjectPublicKeyInfo'] = new Element(base64_decode(preg_replace('#-.+-|[\\r\\n]#', '', $cert['tbsCertificate']['subjectPublicKeyInfo']['subjectPublicKey'])));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "vendor-prefixed/phpseclib3/File/X509.php",
            "line": 2032,
            "snippet": "$csr['certificationRequestInfo']['subjectPKInfo'] = new Element(base64_decode(preg_replace('#-.+-|[\\r\\n]#', '', $csr['certificationRequestInfo']['subjectPKInfo']['subjectPublicKey'])))",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "vendor-prefixed/phpseclib3/File/X509.php",
            "line": 2070,
            "snippet": "$temp = preg_match('#^[a-zA-Z\\d/+]*={0,2}$#', $temp) ? Strings::base64_decode($temp) : false;",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "vendor-prefixed/phpseclib3/File/X509.php",
            "line": 2117,
            "snippet": "$spkac['publicKeyAndChallenge']['spki'] = new Element(base64_decode(preg_replace('#-.+-|[\\r\\n]#', '', $spkac['publicKeyAndChallenge']['spki']['subjectPublicKey'])));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "vendor-prefixed/phpseclib3/File/X509.php",
            "line": 3249,
            "snippet": "$publicKey = base64_decode(preg_replace('#-.+-|[\\r\\n]#', '', $this->publicKey->toString($format)));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "vendor-prefixed/phpseclib3/File/ASN1.php",
            "line": 1376,
            "snippet": "$temp = preg_match('#^[a-zA-Z\\d/+]*={0,2}$#', $temp) ? Strings::base64_decode($temp) : false;",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "vendor-prefixed/phpseclib3/Math/BigInteger/Engines/BCMath/Reductions/EvalBarrett.php",
            "line": 57,
            "snippet": "eval('$func = function ($n) { ' . $code . '};');",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "vendor-prefixed/phpseclib3/Math/BigInteger/Engines/BCMath/Reductions/EvalBarrett.php",
            "line": 92,
            "snippet": "eval('$func = function ($n) { ' . $code . '};');",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "vendor-prefixed/phpseclib3/Math/BigInteger/Engines/Engine.php",
            "line": 1060,
            "snippet": "return eval('return function(' . static::class . ' $x) use ($func, $class) {",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "vendor-prefixed/phpseclib3/Math/BigInteger/Engines/Engine.php",
            "line": 1067,
            "snippet": "return eval('return function(' . static::class . ' $x) use ($n, $fqengine, $class) {",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "vendor-prefixed/phpseclib3/Math/BigInteger/Engines/PHP/Reductions/EvalBarrett.php",
            "line": 65,
            "snippet": "eval('$func = function ($x) { ' . $code . '};');",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "vendor-prefixed/phpseclib3/Math/BigInteger/Engines/PHP/Reductions/EvalBarrett.php",
            "line": 131,
            "snippet": "eval('$func = function ($n) { ' . $code . '};');",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "vendor-prefixed/phpseclib3/Crypt/Common/SymmetricKey.php",
            "line": 2930,
            "snippet": "eval('$func = function ($_action, $_text) { ' . $init_crypt . 'if ($_action == \"encrypt\") { ' . $encrypt . ' } else { ' . $decrypt . ' }};');",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "8d12ca41fa4d00a785b1cb64f43008ae3374a4f9"
}

{
    "slug": "pdf-print",
    "finding_count": 21,
    "findings": [
        {
            "pattern": "preg_replace_e_mod",
            "kind": "builtin",
            "file": "mpdf/mpdf.php",
            "line": 7198,
            "snippet": "$html = preg_replace('/\\{DATE\\s+(.*?)\\}/e',\"date('\\\\1')\",$html );",
            "confidence": "medium"
        },
        {
            "pattern": "preg_replace_e_mod",
            "kind": "builtin",
            "file": "mpdf/mpdf.php",
            "line": 7273,
            "snippet": "$html = preg_replace('/\\{DATE\\s+(.*?)\\}/e',\"date('\\\\1')\",$html );",
            "confidence": "medium"
        },
        {
            "pattern": "preg_replace_e_mod",
            "kind": "builtin",
            "file": "mpdf/mpdf.php",
            "line": 10920,
            "snippet": "$hd = preg_replace('/\\{DATE\\s+(.*?)\\}/e',\"date('\\\\1')\",$hd);",
            "confidence": "medium"
        },
        {
            "pattern": "preg_replace_e_mod",
            "kind": "builtin",
            "file": "mpdf/mpdf.php",
            "line": 11628,
            "snippet": "$html = preg_replace('/\\{DATE\\s+(.*?)\\}/e',\"date('\\\\1')\",$html );",
            "confidence": "medium"
        },
        {
            "pattern": "preg_replace_e_mod",
            "kind": "builtin",
            "file": "mpdf/mpdf.php",
            "line": 12063,
            "snippet": "$hd = preg_replace('/\\{DATE\\s+(.*?)\\}/e',\"date('\\\\1')\",$hd);",
            "confidence": "medium"
        },
        {
            "pattern": "preg_replace_e_mod",
            "kind": "builtin",
            "file": "mpdf/mpdf.php",
            "line": 29348,
            "snippet": "$t = preg_replace('/BT (\\d+\\.\\d\\d+) (\\d+\\.\\d\\d+) Td/e',\"\\$this->columnAdjustAdd('Td',_MPDFK,$xadj,$yadj,'\\\\1','\\\\2')\",$t);",
            "confidence": "medium"
        },
        {
            "pattern": "preg_replace_e_mod",
            "kind": "builtin",
            "file": "mpdf/mpdf.php",
            "line": 29349,
            "snippet": "$t = preg_replace('/(\\d+\\.\\d\\d+) (\\d+\\.\\d\\d+) (\\d+\\.\\d\\d+) ([\\-]{0,1}\\d+\\.\\d\\d+) re/e',\"\\$this->columnAdjustAdd('re',_MPDFK,$xadj,$yadj,'\\\\1','\\\\2','\\\\3','\\\\4')\",$t);",
            "confidence": "medium"
        },
        {
            "pattern": "preg_replace_e_mod",
            "kind": "builtin",
            "file": "mpdf/mpdf.php",
            "line": 29350,
            "snippet": "$t = preg_replace('/(\\d+\\.\\d\\d+) (\\d+\\.\\d\\d+) l/e',\"\\$this->columnAdjustAdd('l',_MPDFK,$xadj,$yadj,'\\\\1','\\\\2')\",$t);",
            "confidence": "medium"
        },
        {
            "pattern": "preg_replace_e_mod",
            "kind": "builtin",
            "file": "mpdf/mpdf.php",
            "line": 29351,
            "snippet": "$t = preg_replace('/q (\\d+\\.\\d\\d+) 0 0 (\\d+\\.\\d\\d+) (\\d+\\.\\d\\d+) (\\d+\\.\\d\\d+) cm \\/(I|FO)/e',\"\\$this->columnAdjustAdd('img',_MPDFK,$xadj,$yadj,'\\\\1','\\\\2','\\\\3','\\\\4','\\\\5')\",$t);",
            "confidence": "medium"
        },
        {
            "pattern": "preg_replace_e_mod",
            "kind": "builtin",
            "file": "mpdf/mpdf.php",
            "line": 29352,
            "snippet": "$t = preg_replace('/(\\d+\\.\\d\\d+) (\\d+\\.\\d\\d+) m/e',\"\\$this->columnAdjustAdd('draw',_MPDFK,$xadj,$yadj,'\\\\1','\\\\2')\",$t);",
            "confidence": "medium"
        },
        {
            "pattern": "preg_replace_e_mod",
            "kind": "builtin",
            "file": "mpdf/mpdf.php",
            "line": 29353,
            "snippet": "$t = preg_replace('/(\\d+\\.\\d\\d+) (\\d+\\.\\d\\d+) (\\d+\\.\\d\\d+) (\\d+\\.\\d\\d+) (\\d+\\.\\d\\d+) (\\d+\\.\\d\\d+) c/e',\"\\$this->columnAdjustAdd('bezier',_MPDFK,$xadj,$yadj,'\\\\1','\\\\2','\\\\3','\\\\4','\\\\5','\\\\6')\",$t);",
            "confidence": "medium"
        },
        {
            "pattern": "preg_replace_e_mod",
            "kind": "builtin",
            "file": "mpdf/mpdf.php",
            "line": 30228,
            "snippet": "$t = preg_replace('/BT (\\d+\\.\\d\\d+) (\\d+\\.\\d\\d+) Td/e',\"\\$this->blockAdjust('Td',_MPDFK,$xadj[$p],$yadj[$p],'\\\\1','\\\\2')\",$t);",
            "confidence": "medium"
        },
        {
            "pattern": "preg_replace_e_mod",
            "kind": "builtin",
            "file": "mpdf/mpdf.php",
            "line": 30229,
            "snippet": "$t = preg_replace('/(\\d+\\.\\d\\d+) (\\d+\\.\\d\\d+) (\\d+\\.\\d\\d+) ([\\-]{0,1}\\d+\\.\\d\\d+) re/e',\"\\$this->blockAdjust('re',_MPDFK,$xadj[$p],$yadj[$p],'\\\\1','\\\\2','\\\\3','\\\\4')\",$t);",
            "confidence": "medium"
        },
        {
            "pattern": "preg_replace_e_mod",
            "kind": "builtin",
            "file": "mpdf/mpdf.php",
            "line": 30230,
            "snippet": "$t = preg_replace('/(\\d+\\.\\d\\d+) (\\d+\\.\\d\\d+) l/e',\"\\$this->blockAdjust('l',_MPDFK,$xadj[$p],$yadj[$p],'\\\\1','\\\\2')\",$t);",
            "confidence": "medium"
        },
        {
            "pattern": "preg_replace_e_mod",
            "kind": "builtin",
            "file": "mpdf/mpdf.php",
            "line": 30231,
            "snippet": "$t = preg_replace('/q (\\d+\\.\\d\\d+) 0 0 (\\d+\\.\\d\\d+) (\\d+\\.\\d\\d+) (\\d+\\.\\d\\d+) cm \\/(I|FO)/e',\"\\$this->blockAdjust('img',_MPDFK,$xadj[$p],$yadj[$p],'\\\\1','\\\\2','\\\\3','\\\\4','\\\\5')\",$t);",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "d32c15a70a06ec61d3ea9fd7593df9273e0e27b5"
}

{
    "slug": "css-javascript-toolbox",
    "finding_count": 3,
    "findings": [
        {
            "pattern": "createfunc",
            "kind": "builtin",
            "file": "css-js-toolbox.php",
            "line": 248,
            "snippet": "add_action( 'admin_notices', create_function( '', $importHTMLFileCode ) );",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "models/template.php",
            "line": 44,
            "snippet": "$code = base64_decode($code64);",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "framework/php/evaluator/evaluator.inc.php",
            "line": 51,
            "snippet": "$unusedResult = eval(\"?>{$code}\");",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "a2777d9bf81c3052fdf0abd2b36039798f698ced"
}

{
    "slug": "post-to-google-my-business",
    "finding_count": 4,
    "findings": [
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "vendor-prefixed/firebase/php-jwt/src/JWT.php",
            "line": 274,
            "snippet": "$key = base64_decode((string) end($lines));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "vendor-prefixed/firebase/php-jwt/src/JWT.php",
            "line": 334,
            "snippet": "$key = base64_decode((string) end($lines));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "vendor-prefixed/firebase/php-jwt/src/JWT.php",
            "line": 415,
            "snippet": "return \\base64_decode(self::convertBase64UrlToBase64($input));",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "vendor-prefixed/mustache/mustache/src/Cache/NoopCache.php",
            "line": 49,
            "snippet": "eval('?>' . $value);",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "5774488f164ca6195d275a4c280ed9aa787e4440"
}

{
    "slug": "auth0",
    "finding_count": 5,
    "findings": [
        {
            "pattern": "$allowed_IPs",
            "kind": "ioc:code_pattern",
            "file": "lib/WP_Auth0_Routes.php",
            "line": 281,
            "snippet": "$allowed_ips = $this->a0_options->get('migration_ips');",
            "confidence": "medium"
        },
        {
            "pattern": "$allowed_IPs",
            "kind": "ioc:code_pattern",
            "file": "lib/WP_Auth0_Routes.php",
            "line": 282,
            "snippet": "if (!$this->ip_check->connection_is_valid($allowed_ips)) {",
            "confidence": "medium"
        },
        {
            "pattern": "$allowed_IPs",
            "kind": "ioc:code_pattern",
            "file": "lib/WP_Auth0_Ip_Check.php",
            "line": 200,
            "snippet": "$allowed_ips = array_merge($valid_ips, $default_ips);",
            "confidence": "medium"
        },
        {
            "pattern": "$allowed_IPs",
            "kind": "ioc:code_pattern",
            "file": "lib/WP_Auth0_Ip_Check.php",
            "line": 201,
            "snippet": "$allowed_ips = array_unique($allowed_ips);",
            "confidence": "medium"
        },
        {
            "pattern": "$allowed_IPs",
            "kind": "ioc:code_pattern",
            "file": "lib/WP_Auth0_Ip_Check.php",
            "line": 203,
            "snippet": "foreach ($this->process_ip_list($allowed_ips) as $range) {",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "5ce94962c6278ef5e9669beb3c4a04d3fed947b2"
}

{
    "slug": "popup-by-supsystic",
    "finding_count": 7,
    "findings": [
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "classes/Twig/Environment.php",
            "line": 334,
            "snippet": "eval('?>' . $this->compileSource($this->getLoader()->getSource($name), $name));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "modules/subscribe/models/subscribe.php",
            "line": 760,
            "snippet": "$grouping[$listParentGroupGroupIds[1]]['groups'][] = base64_decode($listParentGroupGroupIds[2]);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "modules/subscribe/models/subscribe.php",
            "line": 769,
            "snippet": "$grouping[$listParentGroupGroupIds[1]]['groups'][] = base64_decode($listParentGroupGroupIds[2]);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "modules/popup/models/popup.php",
            "line": 107,
            "snippet": "if (base64_decode($row['params'], true)) {",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "modules/popup/models/popup.php",
            "line": 108,
            "snippet": "$row['params'] = $this->_prepareParamsAfterDb(utilsPps::unserialize(base64_decode($row['params'])));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "modules/popup/models/popup.php",
            "line": 115,
            "snippet": "if (base64_decode($row['params']['tpl'][$txtField], true)) {",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "modules/popup/models/popup.php",
            "line": 116,
            "snippet": "$row['params']['tpl'][$txtField] = stripslashes(base64_decode($row['params']['tpl'][$txtField]));",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "799e260ca2ae75b2b7d63f462e0ae1726ddb3d77"
}

{
    "slug": "lifterlms",
    "finding_count": 1,
    "findings": [
        {
            "pattern": "backtick_exec",
            "kind": "builtin",
            "file": "includes/class-llms-block-library.php",
            "line": 170,
            "snippet": "$post_type = $post_type ? $post_type : 'post'; // If `$_GET` is not set it's because it's a basic post.",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "d2cd50af2e593a41304b531734f548fa5122ff9e"
}

{
    "slug": "wpo365-login",
    "finding_count": 16,
    "findings": [
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "Services/Options_Service.php",
            "line": 265,
            "snippet": "$camel_case_options = json_decode( base64_decode( $updated_options ), true ); // phpcs:ignore",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "OneLogin/extlib/xmlseclibs/xmlseclibs.php",
            "line": 264,
            "snippet": "return strtolower(sha1(base64_decode($data)));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "OneLogin/extlib/xmlseclibs/xmlseclibs.php",
            "line": 777,
            "snippet": "return ($digValue === base64_decode($digestValue));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "OneLogin/extlib/xmlseclibs/xmlseclibs.php",
            "line": 1141,
            "snippet": "return $objKey->verifySignature($this->signedInfo, base64_decode($sigValue));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "OneLogin/extlib/xmlseclibs/xmlseclibs.php",
            "line": 1569,
            "snippet": "return base64_decode($node->nodeValue);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "OneLogin/extlib/xmlseclibs/xmlseclibs.php",
            "line": 1749,
            "snippet": "$modulus = base64_decode($modulusNode->nodeValue);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "OneLogin/extlib/xmlseclibs/xmlseclibs.php",
            "line": 1752,
            "snippet": "$exponent = base64_decode($exponentNode->nodeValue);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "OneLogin/lib/Saml2/Response.php",
            "line": 72,
            "snippet": "$this->response = base64_decode($response);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "OneLogin/lib/Saml2/Utils.php",
            "line": 1031,
            "snippet": "$decodedData = base64_decode($data);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "OneLogin/lib/Saml2/Utils.php",
            "line": 1576,
            "snippet": "if ($objKey->verifySignature($signedQuery, base64_decode($getData['Signature'])) === 1) {",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "OneLogin/lib/Saml2/LogoutResponse.php",
            "line": 58,
            "snippet": "$decoded = base64_decode($response);",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "OneLogin/lib/Saml2/LogoutResponse.php",
            "line": 59,
            "snippet": "$inflated = @gzinflate($decoded);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "OneLogin/lib/Saml2/LogoutRequest.php",
            "line": 124,
            "snippet": "$decoded = base64_decode($request);",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "OneLogin/lib/Saml2/LogoutRequest.php",
            "line": 126,
            "snippet": "$inflated = @gzinflate($decoded);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "Core/WordPress_Helpers.php",
            "line": 105,
            "snippet": "$res = base64_decode( $res ); // phpcs:ignore",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "9d43a76dab31d795fcf7a9cd8bb33c8502836b1a"
}

{
    "slug": "quttera-web-malware-scanner",
    "finding_count": 7,
    "findings": [
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "external_scan_page.php",
            "line": 16,
            "snippet": "$cache_json = base64_decode($cache_encoded);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "qtrSettings.php",
            "line": 1148,
            "snippet": "$value = base64_decode($encoded_value, true);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "qtrAjaxHandler.php",
            "line": 857,
            "snippet": "$cache_json = base64_decode($cache_encoded);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "qtrPatternsDb.php",
            "line": 112,
            "snippet": "$step1  = base64_decode($body);",
            "confidence": "medium"
        },
        {
            "pattern": "hex_string_long",
            "kind": "builtin",
            "file": "qtrMimetype.php",
            "line": 37,
            "snippet": "array(\"helpfile\", \"\\x49\\x6e\\x6e\\x6f\\x20\\x53\\x65\\x74\\x75\\x70\\x20\\x55\\x6e\\x69\\x6e\\x73\\x74\\x61\\x6c\\x6c\\x20\\x4c\\x6f\\x67\", 0, \".chm\")",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "dashboard.php",
            "line": 151,
            "snippet": "$cache_json = base64_decode($cache_encoded);",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "qtrExternalScanReport.php",
            "line": 292,
            "snippet": "str_contains($s, 'eval(') ||",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "9720fd5631ce311f068b3ef9c61d7a9854b704fa"
}

{
    "slug": "xcloner-backup-and-restore",
    "finding_count": 2,
    "findings": [
        {
            "pattern": "Upgrade",
            "kind": "ioc:changelog_phrase",
            "file": "README.txt",
            "line": 56,
            "snippet": "UPGRADE:",
            "confidence": "low"
        },
        {
            "pattern": "Upgrade",
            "kind": "ioc:changelog_phrase",
            "file": "README.txt",
            "line": 131,
            "snippet": "UPGRADE:",
            "confidence": "low"
        }
    ],
    "resolved_sha": "153d48f779cb440226e4ca068ebeaae1a9b16370"
}

{
    "slug": "colissimo-shipping-methods-for-woocommerce",
    "finding_count": 11,
    "findings": [
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "lib/FPDI/src/PdfParser/Filter/Flate.php",
            "line": 61,
            "snippet": "$data = @(gzinflate(substr($oData, $tries)));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/tcpdf/lpc_tcpdf.php",
            "line": 7700,
            "snippet": "$signature = base64_decode(trim($signature));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/tcpdf/lpc_tcpdf.php",
            "line": 10941,
            "snippet": "$signature = base64_decode($signature);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/tcpdf/lpc_tcpdf.php",
            "line": 19015,
            "snippet": "$imgsrc = '@'.base64_decode(substr($imgsrc, 1));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/tcpdf/lpc_tcpdf.php",
            "line": 19018,
            "snippet": "$imgsrc = '@'.base64_decode($reg[2]);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/tcpdf/lpc_tcpdf.php",
            "line": 24427,
            "snippet": "$img = '@'.base64_decode(substr($img, strlen($m[0])));",
            "confidence": "medium"
        },
        {
            "pattern": "hex_string_long",
            "kind": "builtin",
            "file": "lib/tcpdf/lpc_tcpdf.php",
            "line": 3051,
            "snippet": "$msg = \"\\x50\\x6f\\x77\\x65\\x72\\x65\\x64\\x20\\x62\\x79\\x20\\x54\\x43\\x50\\x44\\x46\\x20\\x28\\x77\\x77\\x77\\x2e\\x74\\x63\\x70\\x64\\x66\\x2e\\x6f\\x72\\x67\\x29\";",
            "confidence": "medium"
        },
        {
            "pattern": "hex_string_long",
            "kind": "builtin",
            "file": "lib/tcpdf/lpc_tcpdf.php",
            "line": 3052,
            "snippet": "$lnk = \"\\x68\\x74\\x74\\x70\\x3a\\x2f\\x2f\\x77\\x77\\x77\\x2e\\x74\\x63\\x70\\x64\\x66\\x2e\\x6f\\x72\\x67\";",
            "confidence": "medium"
        },
        {
            "pattern": "hex_string_long",
            "kind": "builtin",
            "file": "lib/tcpdf/include/lpc_tcpdf_static.php",
            "line": 94,
            "snippet": "public static $enc_padding = \"\\x28\\xBF\\x4E\\x5E\\x4E\\x75\\x8A\\x41\\x64\\x00\\x4E\\x56\\xFF\\xFA\\x01\\x08\\x2E\\x2E\\x00\\xB6\\xD0\\x68\\x3E\\x80\\x2F\\x0C\\xA9\\xFE\\x64\\x53\\x69\\x7A\";",
            "confidence": "medium"
        },
        {
            "pattern": "hex_string_long",
            "kind": "builtin",
            "file": "lib/tcpdf/include/lpc_tcpdf_static.php",
            "line": 128,
            "snippet": "return \"\\x54\\x43\\x50\\x44\\x46\\x20\".self::getTCPDFVersion().\"\\x20\\x28\\x68\\x74\\x74\\x70\\x3a\\x2f\\x2f\\x77\\x77\\x77\\x2e\\x74\\x63\\x70\\x64\\x66\\x2e\\x6f\\x72\\x67\\x29\";",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "includes/tracking/lpc_unified_tracking_api.php",
            "line": 366,
            "snippet": "$cypher = base64_decode(urldecode($trackHash));",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "3404186ae2890509bb406b40988faac013777b88"
}

{
    "slug": "shopmagic-for-woocommerce",
    "finding_count": 3,
    "findings": [
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "vendor_prefixed/twig/twig/src/Environment.php",
            "line": 442,
            "snippet": "eval('?>' . $content);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "vendor_prefixed/wpdesk/wp-wpdesk-license/src/ApiManager/class-wc-plugin-update.php",
            "line": 213,
            "snippet": "$response->sections['description'] = \\apply_filters('the_content', isset($response->sections['description_base64']) ? \\base64_decode($response->sections['description_base64']) : ''",
            "confidence": "medium"
        },
        {
            "pattern": "createfunc",
            "kind": "builtin",
            "file": "vendor_prefixed/wpdesk/wp-plugin-flow/src/plugin-init-php52.php",
            "line": 43,
            "snippet": "$php52_function = \\create_function('', 'echo sprintf( __(\"<p><strong style=\\'color: red;\\'>PHP version is older than 5.3 so no WP Desk plugins will work. Please contact your host and ask them to u",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "5d4b104e312dadd8c15816604b29164e321ab815"
}

{
    "slug": "doubly",
    "finding_count": 4,
    "findings": [
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "inc_php/zip.class.php",
            "line": 582,
            "snippet": "return gzinflate(substr($this->_data, $this->_metadata[$key]['_dataStart'], $this->_metadata[$key]['csize']));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "inc_php/functions.class.php",
            "line": 1129,
            "snippet": "$decoded = @base64_decode($content, true);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "inc_php/functions.class.php",
            "line": 1170,
            "snippet": "$content = rawurldecode(base64_decode($content));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "inc_php/functions.class.php",
            "line": 1200,
            "snippet": "$content = rawurldecode(base64_decode($content));",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "8cf4ac32150a60bd8d469950b90f69bccb51f9bd"
}

{
    "slug": "gf-entries-in-excel",
    "finding_count": 4,
    "findings": [
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "build/vendor_prefixed/phpoffice/phpspreadsheet/src/PhpSpreadsheet/Shared/PasswordHasher.php",
            "line": 104,
            "snippet": "$saltValue = base64_decode($salt);",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "build/vendor_prefixed/ezyang/htmlpurifier/library/HTMLPurifier/ConfigSchema/InterchangeBuilder.php",
            "line": 187,
            "snippet": "return eval('return array(' . $contents . ');');",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "build/vendor_prefixed/ezyang/htmlpurifier/library/HTMLPurifier/URIScheme/data.php",
            "line": 81,
            "snippet": "$raw_data = base64_decode($data);",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "build/vendor_prefixed/ezyang/htmlpurifier/library/HTMLPurifier/VarParser/Native.php",
            "line": 33,
            "snippet": "$result = eval(\"\\$var = $expr;\");",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "d9cbd4254be1a9b26f0d17f0b2dc9ae9f1c06c9e"
}

{
    "slug": "animation-addons-for-elementor",
    "finding_count": 2,
    "findings": [
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "widgets/mailchimp/mailchimp-api.php",
            "line": 103,
            "snippet": "$api_key = str_replace('w1c2f', '', base64_decode( sanitize_text_field( wp_unslash($_POST['key']) )));",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "inc/CodeSnippet/CodeSnippetFrontend.php",
            "line": 552,
            "snippet": "$func    = eval( $wrapped ); // phpcs:ignore WordPress.Security.Eval.Discouraged",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "780932fc5d941d1a53700b67c56f7cdaea750980"
}

{
    "slug": "pricing-table-by-supsystic",
    "finding_count": 11,
    "findings": [
        {
            "pattern": "base64_string_long",
            "kind": "builtin",
            "file": "classes/installer.php",
            "line": 208,
            "snippet": "'YToxOTp7czo4OiJiZ19jb2xvciI7YToxOntzOjM6InZhbCI7czo3OiIjZjVmNWY1Ijt9czoxNDoiY2VsbF9jb2xvcl9jc3MiO2E6MTp7czozOiJ2YWwiO3M6MzQwOiIje3t0YWJsZS52aWV3X2lkfX0gLnB0c0NvbC17e2VsLm51bX19IC5wdHNDb2xIZ",
            "confidence": "medium"
        },
        {
            "pattern": "base64_string_long",
            "kind": "builtin",
            "file": "classes/installer.php",
            "line": 224,
            "snippet": "'YToxOTp7czo4OiJiZ19jb2xvciI7YToxOntzOjM6InZhbCI7czo3OiIjNDljNmUxIjt9czoxNDoiY2VsbF9jb2xvcl9jc3MiO2E6MTp7czozOiJ2YWwiO3M6NTIwOiIje3t0YWJsZS52aWV3X2lkfX0gLnB0c0NvbC17e2VsLm51bX19IC5wdHNUYWJsZ",
            "confidence": "medium"
        },
        {
            "pattern": "base64_string_long",
            "kind": "builtin",
            "file": "classes/installer.php",
            "line": 240,
            "snippet": "'YToxOTp7czo4OiJiZ19jb2xvciI7YToxOntzOjM6InZhbCI7czo3OiIjNDI0MjQyIjt9czoxMzoidHh0X2l0ZW1faHRtbCI7YToxOntzOjM6InZhbCI7czoxNjQ6IjxkaXYgY2xhc3M9XCJwdHNFbFwiIGRhdGEtZWw9XCJ0YWJsZV9jZWxsX3R4dFwiI",
            "confidence": "medium"
        },
        {
            "pattern": "base64_string_long",
            "kind": "builtin",
            "file": "classes/installer.php",
            "line": 256,
            "snippet": "'YToxOTp7czo4OiJiZ19jb2xvciI7YToxOntzOjM6InZhbCI7czo0OiIjMzMzIjt9czoxNDoiY2VsbF9jb2xvcl9jc3MiO2E6MTp7czozOiJ2YWwiO3M6OTE0OiIje3t0YWJsZS52aWV3X2lkfX0gLnB0c0NvbC17e2VsLm51bX19IC5wdHNDb2xIZWFkZ",
            "confidence": "medium"
        },
        {
            "pattern": "base64_string_long",
            "kind": "builtin",
            "file": "classes/installer.php",
            "line": 272,
            "snippet": "'YToxOTp7czoxOToidGFibGVfd2lkdGhfbWVhc3VyZSI7YToxOntzOjM6InZhbCI7czoxOiIlIjt9czoxMDoiY2FsY193aWR0aCI7YToxOntzOjM6InZhbCI7czo1OiJ0YWJsZSI7fXM6MTE6InRhYmxlX3dpZHRoIjthOjE6e3M6MzoidmFsIjtzOjM6I",
            "confidence": "medium"
        },
        {
            "pattern": "base64_string_long",
            "kind": "builtin",
            "file": "classes/installer.php",
            "line": 288,
            "snippet": "'YToxOTp7czo4OiJiZ19jb2xvciI7YToxOntzOjM6InZhbCI7czo0OiIjZmZmIjt9czo4OiJjb2xzX251bSI7YToxOntzOjM6InZhbCI7czoxOiIzIjt9czoxOToidGFibGVfd2lkdGhfbWVhc3VyZSI7YToxOntzOjM6InZhbCI7czoxOiIlIjt9czoxN",
            "confidence": "medium"
        },
        {
            "pattern": "base64_string_long",
            "kind": "builtin",
            "file": "classes/installer.php",
            "line": 304,
            "snippet": "'YToxOTp7czoxOToidGFibGVfd2lkdGhfbWVhc3VyZSI7YToxOntzOjM6InZhbCI7czoxOiIlIjt9czoxMDoiY2FsY193aWR0aCI7YToxOntzOjM6InZhbCI7czo1OiJ0YWJsZSI7fXM6MTE6InRhYmxlX3dpZHRoIjthOjE6e3M6MzoidmFsIjtzOjM6I",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "classes/Twig/Environment.php",
            "line": 406,
            "snippet": "eval('?>' . $content);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "modules/tables/models/tables.php",
            "line": 207,
            "snippet": "$row['params'] = isset($row['params']) && !empty($row['params']) ? utilsPts::unserialize(base64_decode($row['params']), true) : [];",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "modules/tables/views/tpl/tablesEditAdmin.php",
            "line": 481,
            "snippet": "$optionsArray = utilsPts::jsonDecode(base64_decode($optionNameInput));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "modules/tables/views/tables.php",
            "line": 174,
            "snippet": "$toggleOptions = base64_decode($toggleOptionsEncoded);",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "d7b8891c798abd9f69a09e12f8f6d5df11743bd9"
}

{
    "slug": "appointment-hour-booking",
    "finding_count": 7,
    "findings": [
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "cp-main-class.inc.php",
            "line": 1466,
            "snippet": "$custom_styles = base64_decode(get_option('CP_AHB_CSS', ''));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "cp-main-class.inc.php",
            "line": 1472,
            "snippet": "$custom_scripts = base64_decode(get_option('CP_AHB_JS', ''));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "cp-settings.inc.php",
            "line": 475,
            "snippet": "<textarea name=\"editionarea\" id=\"ahb_styles_container\" style=\"width:100%;min-height:500px;\"><?php if (get_option($cpid.'_CSS', '')) echo esc_textarea(base64_decode(get_option($cpid.'_CSS', ''",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "cp-settings.inc.php",
            "line": 575,
            "snippet": "<textarea name=\"editionarea\" id=\"ahb_javascript_container\" style=\"width:100%;min-height:500px;\"><?php  if (get_option($cpid.'_JS', '')) echo esc_textarea(base64_decode(get_option($cpid.'_JS', '",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "js/fbuilder-loader-public.php",
            "line": 77,
            "snippet": "while (20>fcount || eval(\"typeof cp_appbooking_fbuilder_config\"+fnum+\" != 'undefined'\"))",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "js/fbuilder-loader-public.php",
            "line": 80,
            "snippet": "var cp_appbooking_fbuilder_config = eval(\"cp_appbooking_fbuilder_config\"+fnum);",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "js/fbuilder-loader-public.php",
            "line": 126,
            "snippet": "var cp_appbooking_fbuilder_config = eval(\"cp_appbooking_fbuilder_config\"+fnum);",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "cfc8ffed07021a52f50e50dd2bb9acea516d83b2"
}

{
    "slug": "wpvivid-imgoptim",
    "finding_count": 9,
    "findings": [
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "includes/class-wpvivid-imgoptim-connect-server.php",
            "line": 94,
            "snippet": "$public_key=base64_decode($body['public_key']);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "includes/class-wpvivid-imgoptim-connect-server.php",
            "line": 412,
            "snippet": "$content=base64_decode($body['content']);",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "includes/Crypt/Base.php",
            "line": 2554,
            "snippet": "eval('$func = function ($_action, &$self, $_text) { ' . $init_crypt . 'if ($_action == \"encrypt\") { ' . $encrypt . ' } else { ' . $decrypt . ' } };');",
            "confidence": "medium"
        },
        {
            "pattern": "createfunc",
            "kind": "builtin",
            "file": "includes/Crypt/Base.php",
            "line": 2558,
            "snippet": "return create_function('$_action, &$self, $_text', $init_crypt . 'if ($_action == \"encrypt\") { ' . $encrypt . ' } else { ' . $decrypt . ' }');",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "includes/Crypt/RSA.php",
            "line": 1372,
            "snippet": "$key = isset($parts[1]) ? base64_decode($parts[1]) : false;",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "includes/Crypt/RSA.php",
            "line": 1438,
            "snippet": "$public = base64_decode(implode('', array_map('trim', array_slice($key, 4, $publicLength))));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "includes/Crypt/RSA.php",
            "line": 1446,
            "snippet": "$private = base64_decode(implode('', array_map('trim', array_slice($key, $publicLength + 5, $privateLength))));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "includes/Crypt/RSA.php",
            "line": 1569,
            "snippet": "$this->current = new Math_BigInteger(base64_decode($this->current), 256);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "includes/Crypt/RSA.php",
            "line": 3143,
            "snippet": "$temp = preg_match('#^[a-zA-Z\\d/+]*={0,2}$#', $temp) ? base64_decode($temp) : false;",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "438992371e649115d38ef09452803ea5ebe97b6b"
}

{
    "slug": "softaculous",
    "finding_count": 5,
    "findings": [
        {
            "pattern": "$allowed_IPs",
            "kind": "ioc:code_pattern",
            "file": "settings.php",
            "line": 118,
            "snippet": "$allowed_ips = softaculous_optPOST('softaculous_allowed_ips');",
            "confidence": "medium"
        },
        {
            "pattern": "$allowed_IPs",
            "kind": "ioc:code_pattern",
            "file": "settings.php",
            "line": 119,
            "snippet": "$_a_ips = explode(',', $allowed_ips);",
            "confidence": "medium"
        },
        {
            "pattern": "$allowed_IPs",
            "kind": "ioc:code_pattern",
            "file": "functions.php",
            "line": 2278,
            "snippet": "$allowed_ips = softaculous_get_allowed_ips();",
            "confidence": "medium"
        },
        {
            "pattern": "$allowed_IPs",
            "kind": "ioc:code_pattern",
            "file": "functions.php",
            "line": 2282,
            "snippet": "if(!in_array($remote_ip, $allowed_ips)){",
            "confidence": "medium"
        },
        {
            "pattern": "$allowed_IPs",
            "kind": "ioc:code_pattern",
            "file": "functions.php",
            "line": 2283,
            "snippet": "$return['error'] = 'Unauthorized Access from an unknown IP '.esc_html($remote_ip).'. Allowed IPs - '.esc_html(implode(',', $allowed_ips)).'!!';",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "753f0f44570e3a59ed7ac4d1385a72b5b2d33169"
}

{
    "slug": "restricted-site-access",
    "finding_count": 36,
    "findings": [
        {
            "pattern": "$allowed_IPs",
            "kind": "ioc:code_pattern",
            "file": "restricted_site_access.php",
            "line": 617,
            "snippet": "$allowed_ips = array_merge( $options_ips, $config_ips );",
            "confidence": "medium"
        },
        {
            "pattern": "$allowed_IPs",
            "kind": "ioc:code_pattern",
            "file": "restricted_site_access.php",
            "line": 619,
            "snippet": "if ( ! empty( $allowed_ips ) ) {",
            "confidence": "medium"
        },
        {
            "pattern": "$allowed_IPs",
            "kind": "ioc:code_pattern",
            "file": "restricted_site_access.php",
            "line": 650,
            "snippet": "$allowed_ips = self::get_config_ips();",
            "confidence": "medium"
        },
        {
            "pattern": "$allowed_IPs",
            "kind": "ioc:code_pattern",
            "file": "restricted_site_access.php",
            "line": 655,
            "snippet": "$allowed_ips = array_merge( $allowed_ips, self::$rsa_options['allowed'] );",
            "confidence": "medium"
        },
        {
            "pattern": "$allowed_IPs",
            "kind": "ioc:code_pattern",
            "file": "restricted_site_access.php",
            "line": 659,
            "snippet": "if ( count( $allowed_ips ) > 0 ) {",
            "confidence": "medium"
        },
        {
            "pattern": "$allowed_IPs",
            "kind": "ioc:code_pattern",
            "file": "restricted_site_access.php",
            "line": 663,
            "snippet": "foreach ( $allowed_ips as $allowed_ip ) {",
            "confidence": "medium"
        },
        {
            "pattern": "$allowed_IPs",
            "kind": "ioc:code_pattern",
            "file": "restricted_site_access.php",
            "line": 2183,
            "snippet": "$allowed_ips = isset( self::$rsa_options['allowed'] ) ? (array) self::$rsa_options['allowed'] : array();",
            "confidence": "medium"
        },
        {
            "pattern": "$allowed_IPs",
            "kind": "ioc:code_pattern",
            "file": "restricted_site_access.php",
            "line": 2187,
            "snippet": "if ( ! in_array( $ip, $allowed_ips, true ) && self::is_ip( $ip ) ) {",
            "confidence": "medium"
        },
        {
            "pattern": "$allowed_IPs",
            "kind": "ioc:code_pattern",
            "file": "restricted_site_access.php",
            "line": 2188,
            "snippet": "$allowed_ips[] = $ip;",
            "confidence": "medium"
        },
        {
            "pattern": "$allowed_IPs",
            "kind": "ioc:code_pattern",
            "file": "restricted_site_access.php",
            "line": 2194,
            "snippet": "if ( self::$rsa_options['allowed'] !== $allowed_ips ) {",
            "confidence": "medium"
        },
        {
            "pattern": "$allowed_IPs",
            "kind": "ioc:code_pattern",
            "file": "restricted_site_access.php",
            "line": 2195,
            "snippet": "self::$rsa_options['allowed'] = $allowed_ips;",
            "confidence": "medium"
        },
        {
            "pattern": "$allowed_IPs",
            "kind": "ioc:code_pattern",
            "file": "restricted_site_access.php",
            "line": 2228,
            "snippet": "$allowed_ips = isset( self::$rsa_options['allowed'] ) ? (array) self::$rsa_options['allowed'] : array();",
            "confidence": "medium"
        },
        {
            "pattern": "$allowed_IPs",
            "kind": "ioc:code_pattern",
            "file": "restricted_site_access.php",
            "line": 2232,
            "snippet": "if ( is_int( $ip_address ) && self::is_ip( $label ) && ! in_array( $label, $allowed_ips, true ) ) {",
            "confidence": "medium"
        },
        {
            "pattern": "$allowed_IPs",
            "kind": "ioc:code_pattern",
            "file": "restricted_site_access.php",
            "line": 2233,
            "snippet": "$allowed_ips[] = $label;",
            "confidence": "medium"
        },
        {
            "pattern": "$allowed_IPs",
            "kind": "ioc:code_pattern",
            "file": "restricted_site_access.php",
            "line": 2237,
            "snippet": "$found_index = array_search( $ip_address, $allowed_ips, true );",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "d30cfb808cc589e2a4a62efc80cc8344730e0e4e"
}

{
    "slug": "trustpulse-api",
    "finding_count": 2,
    "findings": [
        {
            "pattern": "add_footer_script",
            "kind": "ioc:code_pattern",
            "file": "trustpulse.php",
            "line": 212,
            "snippet": "add_action( 'wp_enqueue_scripts', array( $this, 'add_footer_script_if_enabled' ) );",
            "confidence": "medium"
        },
        {
            "pattern": "add_footer_script",
            "kind": "ioc:code_pattern",
            "file": "trustpulse.php",
            "line": 283,
            "snippet": "public function add_footer_script_if_enabled() {",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "2db26bfc443cdb8b358f3e77e559d4f22778f1f2"
}

{
    "slug": "fluentforms-pdf",
    "finding_count": 7,
    "findings": [
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "Modules/FluentForms/FluentFormsIntegration.php",
            "line": 1021,
            "snippet": "$feedId = isset($_REQUEST['id']) ? intval(Protector::decrypt(base64_decode($_REQUEST['id']))) : 0;",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "Modules/FluentForms/FluentFormsIntegration.php",
            "line": 1023,
            "snippet": "$submissionId = isset($_REQUEST['submission_id']) ? intval(Protector::decrypt(base64_decode($_REQUEST['submission_id']))) : 0;",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "vendor-prefixed/mpdf/mpdf/src/Image/ImageProcessor.php",
            "line": 152,
            "snippet": "$data = base64_decode($v[2]);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "vendor-prefixed/mpdf/mpdf/src/CssManager.php",
            "line": 253,
            "snippet": "$file = $this->cache->write('_tempCSSidata' . random_int(1, 10000) . '_' . $i . '.' . $idata[2][$i], base64_decode($idata[3][$i]));",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "vendor-prefixed/setasign/fpdi/src/PdfParser/Filter/Flate.php",
            "line": 61,
            "snippet": "$data = @(gzinflate(substr($oData, 2)));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "Classes/Controller/GlobalPdfManager.php",
            "line": 1012,
            "snippet": "$feedId = isset($_REQUEST['id']) ? intval(Protector::decrypt(base64_decode($_REQUEST['id']))) : 0;",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "Classes/Controller/GlobalPdfManager.php",
            "line": 1014,
            "snippet": "$submissionId = isset($_REQUEST['submission_id']) ? intval(Protector::decrypt(base64_decode($_REQUEST['submission_id']))) : 0;",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "7690dd9e853c73e4d3536b3266c149ab13b7aa69"
}

{
    "slug": "woo-multi-currency",
    "finding_count": 5,
    "findings": [
        {
            "pattern": "add_footer_script",
            "kind": "ioc:code_pattern",
            "file": "plugins/advanced_product_fields_for_woocommerce_pro.php",
            "line": 20,
            "snippet": "//\t\t\tadd_action( 'wp_footer', array( $this, 'add_footer_script' ), 100 );",
            "confidence": "medium"
        },
        {
            "pattern": "add_footer_script",
            "kind": "ioc:code_pattern",
            "file": "plugins/advanced_product_fields_for_woocommerce_pro.php",
            "line": 54,
            "snippet": "public function add_footer_script() {",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "frontend/location.php",
            "line": 103,
            "snippet": "$geoplugin_arg = json_decode( base64_decode( $this->settings->getcookie( 'wmc_ip_info' ) ), true );",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "frontend/design.php",
            "line": 93,
            "snippet": "if ( ! eval( $logic_value ) ) {",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "frontend/price.php",
            "line": 191,
            "snippet": "$geoplugin_arg = json_decode( base64_decode( self::$settings->getcookie( 'wmc_ip_info' ) ), true );",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "6016e85452dc5166ddbac4296603970dfcc1fd79"
}

{
    "slug": "comet-cache",
    "finding_count": 4,
    "findings": [
        {
            "pattern": "backtick_exec",
            "kind": "builtin",
            "file": "src/includes/traits/Ac/NcDebugUtils.php",
            "line": 130,
            "snippet": "$reason = sprintf(__('because `$_GET[\\'%1$sAC\\']` is set to a boolean-ish FALSE value.', 'comet-cache'), mb_strtolower(SHORT_NAME));",
            "confidence": "medium"
        },
        {
            "pattern": "backtick_exec",
            "kind": "builtin",
            "file": "src/includes/traits/Ac/NcDebugUtils.php",
            "line": 175,
            "snippet": "$reason = __('because `$_GET` contains query string data. The current configuration says NOT to cache GET requests with a query string.', 'comet-cache');",
            "confidence": "medium"
        },
        {
            "pattern": "backtick_exec",
            "kind": "builtin",
            "file": "src/includes/traits/Ac/NcDebugUtils.php",
            "line": 179,
            "snippet": "$reason = __('because `$_REQUEST` indicates this is simply a preview of something to come.', 'comet-cache');",
            "confidence": "medium"
        },
        {
            "pattern": "backtick_exec",
            "kind": "builtin",
            "file": "src/includes/traits/Ac/NcDebugUtils.php",
            "line": 195,
            "snippet": "$reason = __('because `$_SERVER[\\'HTTP_REFERER\\']` and/or `$_GET[\\'_wp_http_referer\\']` matches a configured HTTP Referrer Exclusion Pattern on this installation.', 'comet-cache');",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "e2c51d3d63ae57515c1995692564e8de1285593a"
}

{
    "slug": "pexlechris-adminer",
    "finding_count": 1,
    "findings": [
        {
            "pattern": "backtick_exec",
            "kind": "builtin",
            "file": "inc/adminer.php",
            "line": 213,
            "snippet": "lzw_decompress(\"v0??F????==??FS\t??_6\u001aM\u01b3???r:?E?CI??o:?\u0007C\u0011??Xc??\\r?\u0604J(:=?E?\u0013??a28\u001a\u000e\u0003?x??\u0014\u000f?'?i?SA\u001dNN\u0002???xs?\u001aN\u0007B??Vl0???S\t??U\u0015\u000fl\u0014?\u0015(D|\u0013\u0484??P??>\u0017?E?\u3a76yH\u0018\u001e\u000bc\u0001h??-3\u0017Eb?? ?b??pE?p?\u00129.????~\\n??\u001d\u0019Kb?iw\u001d|?`??\u0011d.",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "6b0dc2c5ab3550feac3faafaf2d1f6f4baace2cd"
}

{
    "slug": "printfriendly",
    "finding_count": 3,
    "findings": [
        {
            "pattern": "add_footer_script",
            "kind": "ioc:code_pattern",
            "file": "pf.php",
            "line": 553,
            "snippet": "* @param bool   $add_footer_script Whether to add the script in the footer.",
            "confidence": "medium"
        },
        {
            "pattern": "add_footer_script",
            "kind": "ioc:code_pattern",
            "file": "pf.php",
            "line": 559,
            "snippet": "public function getButton($add_footer_script = false, $add_class = '', $print_whole_page = false)",
            "confidence": "medium"
        },
        {
            "pattern": "add_footer_script",
            "kind": "ioc:code_pattern",
            "file": "pf.php",
            "line": 561,
            "snippet": "if ($add_footer_script) {",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "c505f7c85339aed5c82442c6c2e24a28d65d8b25"
}

{
    "slug": "theme-check",
    "finding_count": 2,
    "findings": [
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "checks/class-bad-things-check.php",
            "line": 34,
            "snippet": "'/(?<![_|a-z0-9|\\.])eval\\s?\\(/i' => __( 'eval() is not allowed.', 'theme-check' ),",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "checks/class-bad-things-check.php",
            "line": 37,
            "snippet": "'/base64_decode/'                => __( 'base64_decode() is not allowed', 'theme-check' ),",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "9e34e8835b18df99112a85e4eaec4a8fa043d640"
}

{
    "slug": "wp-ultimate-csv-importer",
    "finding_count": 4,
    "findings": [
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "lib/PhpParser/PrettyPrinter/Standard.php",
            "line": 551,
            "snippet": "return 'eval(' . $this->p($node->expr) . ')';",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "importExtensions/ElementorImport.php",
            "line": 43,
            "snippet": "$custom_value = wp_slash(base64_decode($custom_value));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "importExtensions/OpenAIHelper.php",
            "line": 176,
            "snippet": "$binary = base64_decode( $m[2], true );",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "importExtensions/ImportHelpers.php",
            "line": 404,
            "snippet": "return eval('return '.$expression.';');",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "134841071205a745a2ec5078735af901b07c4591"
}