[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fuhgWpG_DckGOMVrcVDvdr2pvL3ineWRBQbVOulrEdX8":3,"$fjSxggECpAjgntMqNcsDP3GwnGB2htt7Q5kwMqRC53-E":186,"$fAUa0fHbHzuG7Z45WuKpL9MQTuLoYSKnRxTJNTAEUW5s":190},{"slug":4,"name":5,"version":6,"author":7,"author_profile":8,"description":9,"short_description":10,"active_installs":11,"downloaded":12,"rating":13,"num_ratings":14,"last_updated":15,"tested_up_to":16,"requires_at_least":17,"requires_php":18,"tags":19,"homepage":21,"download_link":22,"security_score":23,"vuln_count":24,"unpatched_count":24,"last_vuln_date":25,"fetched_at":26,"discovery_status":27,"vulnerabilities":28,"developer":29,"crawl_stats":25,"alternatives":34,"analysis":35,"fingerprints":165},"calcfusion-for-wp","CalcFusion for WP","1.1.3","CalcFusion","https:\u002F\u002Fprofiles.wordpress.org\u002Fcalcfusion\u002F","\u003Ch3>What is CalcFusion?\u003C\u002Fh3>\n\u003Cp>A Computation Engine that…\u003C\u002Fp>\n\u003Cul>\n\u003Cli>lets users create business rules and formulas with Excel.\u003C\u002Fli>\n\u003Cli>mixes live data from your WordPress site with local data stored on Excel.\u003C\u002Fli>\n\u003Cli>receives data and sends computed results from\u002Fto your WordPress site via web services.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch4>Learn more about CalcFusion at http:\u002F\u002Fcalcfusion.com\u002F\u003C\u002Fh4>\n\u003Ch3>Why CalcFusion?\u003C\u002Fh3>\n\u003Cp>CalcFusion leverages on Excel’s power and flexibility. Writing complex functions on Excel is straightforward due to its spreadsheet interface that allows for easy modifications and testing, while writing codes for the same functions can be unpredictable and tedious as programmers have to make sure that their codes are well tested and maintainable. Cut the development time in half by designing your web app interface on WordPress and using CalcFusion and Excel as you back-end. Use real-time data for your computations, and display Excel computed results instantly on WordPress.\u003C\u002Fp>\n\u003Ch3>How does it Work?\u003C\u002Fh3>\n\u003Cspan class=\"embed-youtube\" style=\"text-align:center; display: block;\">\u003Ciframe loading=\"lazy\" class=\"youtube-player\" width=\"750\" height=\"422\" src=\"https:\u002F\u002Fwww.youtube.com\u002Fembed\u002F2_OqsgaUIwc?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent\" allowfullscreen=\"true\" style=\"border:0;\" sandbox=\"allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox\">\u003C\u002Fiframe>\u003C\u002Fspan>\n\u003Ch4>Try our live implementation of CalcFusion for WP at http:\u002F\u002Fcalcfusion.com\u002Flive-demo\u002F\u003C\u002Fh4>\n","CalcFusion brings flexibility by utilizing Excel computations and functions as a backend system to your existing WordPress site.",10,1676,100,1,"2015-10-15T09:20:00.000Z","4.1.42","3.5","",[20],"computation-engine","http:\u002F\u002Fwordpress.org\u002Fplugins\u002Fcalcfusion-for-wp\u002F","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcalcfusion-for-wp.1.1.3.zip",85,0,null,"2026-04-16T10:56:18.058Z","no_bundle",[],{"slug":30,"display_name":7,"profile_url":8,"plugin_count":14,"total_installs":11,"avg_security_score":23,"avg_patch_time_days":31,"trust_score":32,"computed_at":33},"calcfusion",30,84,"2026-08-29T06:39:15.979Z",[],{"attackSurface":36,"codeSignals":77,"taintFlows":111,"riskAssessment":149,"analyzedAt":164},{"hooks":37,"ajaxHandlers":56,"restRoutes":73,"shortcodes":74,"cronEvents":75,"entryPointCount":76,"unprotectedCount":76},[38,44,48,52],{"type":39,"name":40,"callback":41,"file":42,"line":43},"action","plugins_loaded","calcfusion_initialize_plugin","calcfusion-for-wp.php",80,{"type":39,"name":45,"callback":46,"priority":24,"file":42,"line":47},"admin_notices","getAdminNotices",81,{"type":39,"name":49,"callback":50,"file":42,"line":51},"admin_menu","add_plugin_page",239,{"type":39,"name":53,"callback":54,"file":42,"line":55},"admin_init","page_init",240,[57,61,64,67,70],{"action":58,"nopriv":59,"callback":58,"hasNonce":59,"hasCapCheck":59,"file":42,"line":60},"calcfusion_request_service",false,198,{"action":58,"nopriv":62,"callback":58,"hasNonce":59,"hasCapCheck":59,"file":42,"line":63},true,199,{"action":65,"nopriv":59,"callback":65,"hasNonce":59,"hasCapCheck":59,"file":42,"line":66},"calcfusion_action_login",243,{"action":68,"nopriv":59,"callback":68,"hasNonce":59,"hasCapCheck":59,"file":42,"line":69},"calcfusion_action_computation_list",244,{"action":71,"nopriv":59,"callback":71,"hasNonce":59,"hasCapCheck":59,"file":42,"line":72},"calcfusion_action_download",245,[],[],[],5,{"dangerousFunctions":78,"sqlUsage":79,"outputEscaping":81,"fileOperations":24,"externalRequests":24,"nonceChecks":24,"capabilityChecks":24,"bundledLibraries":107},[],{"prepared":24,"raw":24,"locations":80},[],{"escaped":82,"rawEcho":83,"locations":84},26,11,[85,88,90,92,94,96,98,100,102,105,106],{"file":42,"line":86,"context":87},86,"raw output",{"file":42,"line":89,"context":87},219,{"file":42,"line":91,"context":87},274,{"file":42,"line":93,"context":87},309,{"file":42,"line":95,"context":87},326,{"file":42,"line":97,"context":87},652,{"file":42,"line":99,"context":87},668,{"file":42,"line":101,"context":87},716,{"file":103,"line":104,"context":87},"uploadcomplete.php",12,{"file":103,"line":104,"context":87},{"file":103,"line":104,"context":87},[108],{"name":109,"version":25,"knownCves":110},"Guzzle",[],[112,129,138],{"entryPoint":113,"graph":114,"unsanitizedCount":14,"severity":128},"calcfusion_request_service (calcfusion-for-wp.php:200)",{"nodes":115,"edges":126},[116,121],{"id":117,"type":118,"label":119,"file":42,"line":120},"n0","source","$_POST",201,{"id":122,"type":123,"label":124,"file":42,"line":89,"wp_function":125},"n1","sink","echo() [XSS]","echo",[127],{"from":117,"to":122,"sanitized":59},"medium",{"entryPoint":130,"graph":131,"unsanitizedCount":14,"severity":137},"\u003Ccalcfusion-for-wp> (calcfusion-for-wp.php:0)",{"nodes":132,"edges":135},[133,134],{"id":117,"type":118,"label":119,"file":42,"line":120},{"id":122,"type":123,"label":124,"file":42,"line":89,"wp_function":125},[136],{"from":117,"to":122,"sanitized":59},"low",{"entryPoint":139,"graph":140,"unsanitizedCount":148,"severity":137},"\u003Cuploadcomplete> (uploadcomplete.php:0)",{"nodes":141,"edges":146},[142,145],{"id":117,"type":118,"label":143,"file":103,"line":144},"$_REQUEST (x3)",7,{"id":122,"type":123,"label":124,"file":103,"line":104,"wp_function":125},[147],{"from":117,"to":122,"sanitized":59},3,{"summary":150,"deductions":151},"The Calcfusion for WP plugin v1.1.3 exhibits a concerning security posture due to its unprotected AJAX handlers. While the plugin demonstrates good practices in handling SQL queries with prepared statements and avoids dangerous functions and file operations, the lack of authentication checks on all identified AJAX entry points creates a significant attack surface. This means any unauthenticated user could potentially interact with these handlers, leading to unintended behavior or further exploitation if vulnerabilities are present within them.\n\nThe taint analysis, while limited in scope, did identify flows with unsanitized paths. Although no critical or high severity issues were flagged in the taint analysis, these unsanitized paths are a red flag for potential injection vulnerabilities. The plugin's vulnerability history is clean, with no recorded CVEs, which is positive. However, this does not negate the risks posed by the static analysis findings, particularly the unprotected AJAX endpoints and the potential for issues stemming from unsanitized paths.\n\nIn conclusion, the plugin has strengths in its SQL handling and absence of certain dangerous code patterns. Nevertheless, the identified unprotected AJAX handlers and unsanitized paths represent critical weaknesses that require immediate attention. A robust security strategy would involve implementing proper authentication and authorization checks for all AJAX endpoints and thoroughly sanitizing all user-supplied input to mitigate potential injection risks.",[152,154,157,159,162],{"reason":153,"points":11},"Unprotected AJAX handlers",{"reason":155,"points":156},"Unsanitized paths in taint flows",8,{"reason":158,"points":144},"Lack of nonce checks on AJAX",{"reason":160,"points":161},"Insufficient output escaping",6,{"reason":163,"points":148},"Bundled Guzzle library","2026-03-17T00:26:52.719Z",{"wat":166,"direct":175},{"assetPaths":167,"generatorPatterns":170,"scriptPaths":171,"versionParams":172},[168,169],"\u002Fwp-content\u002Fplugins\u002Fcalcfusion-for-wp\u002Fcss\u002Fcalcfusion-for-wp.css","\u002Fwp-content\u002Fplugins\u002Fcalcfusion-for-wp\u002Fjs\u002Fcalcfusion-for-wp.js",[],[169],[173,174],"calcfusion-for-wp\u002Fstyle.css?ver=","calcfusion-for-wp\u002Fscript.js?ver=",{"cssClasses":176,"htmlComments":177,"htmlAttributes":178,"restEndpoints":179,"jsGlobals":181,"shortcodeOutput":184},[],[],[],[180],"\u002Fwp-json\u002Fcalcfusion\u002Fv1\u002Fsettings",[182,183],"calcfusion_wp_ajax_url","CalcFusionClient",[185],"[calcfusion_calculator]",{"error":62,"url":187,"statusCode":188,"statusMessage":189,"message":189},"http:\u002F\u002Flocalhost\u002Fapi\u002Fplugins\u002Fcalcfusion-for-wp\u002Fbundle",404,"no bundle for this plugin yet",{"slug":4,"current_version":6,"total_versions":76,"versions":191},[192,197,204,211,218],{"version":6,"download_url":22,"svn_tag_url":193,"released_at":25,"has_diff":59,"diff_files_changed":194,"diff_lines":25,"trac_diff_url":195,"vulnerabilities":196,"is_current":62},"https:\u002F\u002Fplugins.svn.wordpress.org\u002Fcalcfusion-for-wp\u002Ftags\u002F1.1.3\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Fcalcfusion-for-wp%2Ftags%2F1.1.2&new_path=%2Fcalcfusion-for-wp%2Ftags%2F1.1.3",[],{"version":198,"download_url":199,"svn_tag_url":200,"released_at":25,"has_diff":59,"diff_files_changed":201,"diff_lines":25,"trac_diff_url":202,"vulnerabilities":203,"is_current":59},"1.1.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcalcfusion-for-wp.1.1.2.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fcalcfusion-for-wp\u002Ftags\u002F1.1.2\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Fcalcfusion-for-wp%2Ftags%2F1.1.1&new_path=%2Fcalcfusion-for-wp%2Ftags%2F1.1.2",[],{"version":205,"download_url":206,"svn_tag_url":207,"released_at":25,"has_diff":59,"diff_files_changed":208,"diff_lines":25,"trac_diff_url":209,"vulnerabilities":210,"is_current":59},"1.1.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcalcfusion-for-wp.1.1.1.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fcalcfusion-for-wp\u002Ftags\u002F1.1.1\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Fcalcfusion-for-wp%2Ftags%2F1.1.0&new_path=%2Fcalcfusion-for-wp%2Ftags%2F1.1.1",[],{"version":212,"download_url":213,"svn_tag_url":214,"released_at":25,"has_diff":59,"diff_files_changed":215,"diff_lines":25,"trac_diff_url":216,"vulnerabilities":217,"is_current":59},"1.1.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcalcfusion-for-wp.1.1.0.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fcalcfusion-for-wp\u002Ftags\u002F1.1.0\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Fcalcfusion-for-wp%2Ftags%2F1.0.0&new_path=%2Fcalcfusion-for-wp%2Ftags%2F1.1.0",[],{"version":219,"download_url":220,"svn_tag_url":221,"released_at":25,"has_diff":59,"diff_files_changed":222,"diff_lines":25,"trac_diff_url":25,"vulnerabilities":223,"is_current":59},"1.0.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcalcfusion-for-wp.1.0.0.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fcalcfusion-for-wp\u002Ftags\u002F1.0.0\u002F",[],[]]