bbPress – Featured Replies Security & Risk Analysis

wordpress.org/plugins/bbpress-featured-replies

Lets the admin add "featured" or "buried" css class to selected bbPress replies.

10 active installs v0.1.1 PHP + WP 3.5+ Updated Sep 6, 2014
bbpressfeaturedfeatured-repliesreplies
85
A · Safe
CVEs total0
Unpatched0
Last CVENever
Safety Verdict

Is bbPress – Featured Replies Safe to Use in 2026?

Generally Safe

Score 85/100

bbPress – Featured Replies has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs Updated 11yr ago
Risk Assessment

The bbpress-featured-replies v0.1.1 plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices by utilizing prepared statements for all SQL queries, implementing nonce checks, and performing capability checks on a significant number of operations. It also has a clean vulnerability history with no known CVEs. However, the presence of the `create_function` dangerous function is a notable concern, as it can be a vector for code injection if not handled with extreme care. Furthermore, the relatively low percentage of properly escaped output (46%) indicates a risk of Cross-Site Scripting (XSS) vulnerabilities, especially in the parts of the code that are not covered by the taint analysis.

Key Concerns

  • Use of dangerous function create_function
  • Low percentage of properly escaped output (46%)
Vulnerabilities
None known

bbPress – Featured Replies Security Vulnerabilities

No known vulnerabilities — this is a good sign.
Code Analysis
Analyzed Mar 17, 2026

bbPress – Featured Replies Code Analysis

Dangerous Functions
1
Raw SQL Queries
0
1 prepared
Unescaped Output
14
12 escaped
Nonce Checks
1
Capability Checks
9
File Operations
0
External Requests
0
Bundled Libraries
0

Dangerous Functions Found

create_functionadd_action( 'widgets_init', create_function( '', 'register_widget("Featured_Replies_Widget");' ) );includes\widget.php:158

SQL Query Safety

100% prepared1 total queries

Output Escaping

46% escaped26 total outputs
Attack Surface

bbPress – Featured Replies Attack Surface

Entry Points1
Unprotected0

AJAX Handlers 1

authwp_ajax_featured_repliesbbpress-featured-replies.php:97
WordPress Hooks 14
actionadmin_initbbpress-featured-replies.php:62
actionsave_postbbpress-featured-replies.php:95
actionadd_meta_boxesbbpress-featured-replies.php:96
filterbbp_get_reply_contentbbpress-featured-replies.php:98
filterpost_row_actionsbbpress-featured-replies.php:99
actionwp_enqueue_scriptsbbpress-featured-replies.php:101
actionadmin_print_scriptsbbpress-featured-replies.php:102
actionwp_print_stylesbbpress-featured-replies.php:103
actionadmin_print_stylesbbpress-featured-replies.php:104
filteruser_has_capbbpress-featured-replies.php:106
filterbbp_get_reply_classbbpress-featured-replies.php:109
actionadmin_noticesbbpress-featured-replies.php:157
actionplugins_loadedbbpress-featured-replies.php:465
actionwidgets_initincludes\widget.php:158
Maintenance & Trust

bbPress – Featured Replies Maintenance & Trust

Maintenance Signals

WordPress version tested3.7.41
Last updatedSep 6, 2014
PHP min version
Downloads2K

Community Trust

Rating0/100
Number of ratings0
Active installs10
Developer Profile

bbPress – Featured Replies Developer Profile

Josh Eaton

4 plugins · 320 total installs

86
trust score
Avg Security Score
89/100
Avg Patch Time
30 days
View full developer profile
Detection Fingerprints

How We Detect bbPress – Featured Replies

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/bbpress-featured-replies/js/featured-replies.js
Script Paths
/wp-content/plugins/bbpress-featured-replies/js/featured-replies.js

HTML / DOM Fingerprints

CSS Classes
featured-repliesfeaturedburied
JS Globals
Featured_Replies
FAQ

Frequently Asked Questions about bbPress – Featured Replies