Charming Portfolio Security & Risk Analysis

wordpress.org/plugins/charming-portfolio

Text Domain: charming-portfolio A plugin to turn your frontpage into a portfolio landing page.

20 active installs v2.0.1 PHP 8.0+ WP 5.0+ Updated Oct 24, 2025
charming-portfolioportfolio-pluginsimple-portfoliosimplecharm-portfolio
100
A · Safe
CVEs total0
Unpatched0
Last CVENever
Download
Safety Verdict

Is Charming Portfolio Safe to Use in 2026?

Generally Safe

Score 100/100

Charming Portfolio has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs Updated 5mo ago
Risk Assessment

The "charming-portfolio" v2.0.1 plugin exhibits a generally strong security posture based on the provided static analysis. The absence of critical or high severity issues in taint analysis, coupled with the responsible use of prepared statements for SQL queries and a high percentage of properly escaped outputs, are significant strengths. The plugin also appears to implement adequate security checks for its entry points, with 100% of identified AJAX handlers and REST API routes having appropriate authentication and permission callbacks.

However, there are areas for improvement. While the number of unprotected entry points is zero, the presence of 5 AJAX handlers with no explicit indication of authentication checks is a minor concern. The plugin's vulnerability history is currently clean, which is a positive indicator, but it does not guarantee future security. The limited number of capability checks (1) and nonces (4) relative to the attack surface could be a point of future weakness if the plugin's functionality expands or if new attack vectors emerge.

Overall, the plugin demonstrates good development practices with a focus on sanitization and output escaping. The lack of known vulnerabilities is reassuring. The primary area to monitor is the authentication and authorization mechanisms for its AJAX handlers to ensure they are robust against potential brute-force or unauthorized access attempts.

Key Concerns

  • AJAX handlers without explicit auth checks
  • Limited capability checks
  • Limited nonce checks
Vulnerabilities
None known

Charming Portfolio Security Vulnerabilities

No known vulnerabilities — this is a good sign.
Code Analysis
Analyzed Mar 16, 2026

Charming Portfolio Code Analysis

Dangerous Functions
0
Raw SQL Queries
0
2 prepared
Unescaped Output
7
368 escaped
Nonce Checks
4
Capability Checks
1
File Operations
0
External Requests
0
Bundled Libraries
0

SQL Query Safety

100% prepared2 total queries

Output Escaping

98% escaped375 total outputs
Data Flows
All sanitized

Data Flow Analysis

3 flows
save_data (inc\classes\actions.php:35)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface

Charming Portfolio Attack Surface

Entry Points6
Unprotected0

AJAX Handlers 5

authwp_ajax_charming_portfolio_save_datainc\classes\actions.php:27
authwp_ajax_charming_portfolio_save_data_additionalinc\classes\actions.php:28
authwp_ajax_charming_portfolio_add_enquiryinc\classes\actions.php:29
noprivwp_ajax_charming_portfolio_add_enquiryinc\classes\actions.php:30
authwp_ajax_charming_portfolio_erase_datainc\classes\actions.php:33

Shortcodes 1

[charming_portfolio_render_portfolio] inc\classes\portfolio.php:33
WordPress Hooks 14
actionwp_enqueue_scriptsinc\classes\assets.php:25
actionwp_enqueue_scriptsinc\classes\assets.php:27
actionadmin_enqueue_scriptsinc\classes\assets.php:28
actionadmin_enqueue_scriptsinc\classes\assets.php:29
actionadmin_menuinc\classes\portfolio.php:23
actionadmin_bar_menuinc\classes\portfolio.php:24
actionadmin_enqueue_scriptsinc\classes\portfolio.php:25
actioninitinc\classes\portfolio.php:26
actionadd_meta_boxesinc\classes\portfolio.php:27
actionadmin_headinc\classes\portfolio.php:28
filtermanage_charming_portfolio_e_posts_columnsinc\classes\portfolio.php:30
actionmanage_charming_portfolio_e_posts_custom_columninc\classes\portfolio.php:32
actioninitinc\classes\portfolio_plugin.php:25
filtertemplate_includeportfolio.php:49
Maintenance & Trust

Charming Portfolio Maintenance & Trust

Maintenance Signals

WordPress version tested6.8.5
Last updatedOct 24, 2025
PHP min version8.0
Downloads2K

Community Trust

Rating0/100
Number of ratings0
Active installs20
Developer Profile

Charming Portfolio Developer Profile

Kazi Mohammad Foysal

6 plugins · 140 total installs

91
trust score
Avg Security Score
96/100
Avg Patch Time
18 days
View full developer profile
Detection Fingerprints

How We Detect Charming Portfolio

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/charming-portfolio/assets/build/js/main.js/wp-content/plugins/charming-portfolio/assets/build/js/portfolio_react.js/wp-content/plugins/charming-portfolio/assets/build/js/charming_v2.js/wp-content/plugins/charming-portfolio/assets/build/css/main.css/wp-content/plugins/charming-portfolio/assets/build/css/charming_v2.css/wp-content/plugins/charming-portfolio/assets/build/css/admin.css/wp-content/plugins/charming-portfolio/assets/build/js/admin.js
Script Paths
/wp-content/plugins/charming-portfolio/assets/build/js/main.js/wp-content/plugins/charming-portfolio/assets/build/js/portfolio_react.js/wp-content/plugins/charming-portfolio/assets/build/js/charming_v2.js/wp-content/plugins/charming-portfolio/assets/build/js/admin.js
Version Parameters
/wp-content/plugins/charming-portfolio/assets/build/js/main.js?ver=/wp-content/plugins/charming-portfolio/assets/build/js/portfolio_react.js?ver=/wp-content/plugins/charming-portfolio/assets/build/js/charming_v2.js?ver=/wp-content/plugins/charming-portfolio/assets/build/css/main.css?ver=/wp-content/plugins/charming-portfolio/assets/build/css/charming_v2.css?ver=/wp-content/plugins/charming-portfolio/assets/build/css/admin.css?ver=/wp-content/plugins/charming-portfolio/assets/build/js/admin.js?ver=

HTML / DOM Fingerprints

CSS Classes
charming-portfolio-content
HTML Comments
Enqueue All AssetsCustomizing Front Page Functionality
Data Attributes
data-layout
JS Globals
portfolio_datacharming_portfolio_latest_blogscharming_portfolio_v2charming_portfolio_admin
REST Endpoints
/wp-json/charming-portfolio/v1/settings
Shortcode Output
[charming_portfolio_render_portfolio]
FAQ

Frequently Asked Questions about Charming Portfolio