[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhzA-4Wz8FeUD4zP_KSYIACj8FGfWqZ2CUt5h19CQVZY":3,"$fjAtvY5qcwXIP-r55k80j368DKkqaxU9Gt1UkZvnjpGA":177,"$ffZQsi8XK-xWjfJFYlvuPQsNU7E_EGMGhZfsmS3rCBvs":182},{"slug":4,"name":5,"version":6,"author":7,"author_profile":8,"description":9,"short_description":10,"active_installs":11,"downloaded":12,"rating":11,"num_ratings":13,"last_updated":14,"tested_up_to":15,"requires_at_least":16,"requires_php":17,"tags":18,"homepage":17,"download_link":21,"security_score":22,"vuln_count":23,"unpatched_count":24,"last_vuln_date":25,"fetched_at":26,"discovery_status":27,"vulnerabilities":28,"developer":46,"crawl_stats":34,"alternatives":51,"analysis":52,"fingerprints":162},"codup-read-only-admin","Codup Read Only Admin","1.1.1.8","codup","https:\u002F\u002Fprofiles.wordpress.org\u002Fcodup\u002F","\u003Cp>This plugins allows to create an admin with read only access.\u003C\u002Fp>\n\u003Ch3>Installation\u002FConfiguration\u003C\u002Fh3>\n\u003Col>\n\u003Cli>Install the plugin through the WordPress plugins screen directly.\u003C\u002Fli>\n\u003Cli>Activate the plugin through the ‘Plugins’ screen in WordPress.   \u003C\u002Fli>\n\u003Cli>Use the Dashboard->Users.\u003C\u002Fli>\n\u003Cli>Enable “Read Only” Access for admistrator role.\u003C\u002Fli>\n\u003C\u002Fol>\n","This plugins allows to create an admin with read only access.",100,3373,2,"2022-04-27T04:28:00.000Z","5.9.13","4.4","",[19,20],"admin-role","read-only-access","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcodup-read-only-admin.zip",85,1,0,"2022-05-25 00:00:00","2026-07-22T17:31:50.256Z","no_bundle",[29],{"id":30,"url_slug":31,"title":32,"description":33,"plugin_slug":4,"theme_slug":34,"affected_versions":35,"patched_in_version":6,"severity":36,"cvss_score":37,"cvss_vector":38,"vuln_type":39,"published_date":25,"updated_date":40,"references":41,"days_to_patch":43,"patch_diff_files":44,"patch_trac_url":34,"research_status":34,"research_verified":45,"research_rounds_completed":24,"research_plan":34,"research_summary":34,"research_vulnerable_code":34,"research_fix_diff":34,"research_exploit_outline":34,"research_model_used":34,"research_started_at":34,"research_completed_at":34,"research_error":34,"poc_status":34,"poc_video_id":34,"poc_summary":34,"poc_steps":34,"poc_tested_at":34,"poc_wp_version":34,"poc_php_version":34,"poc_playwright_script":34,"poc_exploit_code":34,"poc_has_trace":45,"poc_model_used":34,"poc_verification_depth":34},"WF-c2760f65-a981-42f6-b18c-fcf493bd34b6-codup-read-only-admin","codup-read-only-admin-cross-site-scripting","Codup Read Only Admin \u003C= 1.1.1.7 - Cross Site Scripting","The plugin Codup Read Only Admin for WordPress is vulnerable to Cross-Site Scripting via the read_only_admin parameter in the save_user_meta function in versions up to and including 1.1.1.7 due to insufficient sanitization. This makes it possible to attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",null,"\u003C=1.1.1.7","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2024-01-22 19:56:02",[42],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fc2760f65-a981-42f6-b18c-fcf493bd34b6?source=api-prod",608,[],false,{"slug":7,"display_name":7,"profile_url":8,"plugin_count":13,"total_installs":47,"avg_security_score":22,"avg_patch_time_days":48,"trust_score":49,"computed_at":50},120,622,69,"2026-08-29T02:49:51.212Z",[],{"attackSurface":53,"codeSignals":148,"taintFlows":155,"riskAssessment":156,"analyzedAt":161},{"hooks":54,"ajaxHandlers":144,"restRoutes":145,"shortcodes":146,"cronEvents":147,"entryPointCount":24,"unprotectedCount":24},[55,61,65,68,72,75,78,82,85,88,92,98,103,107,110,114,117,120,123,126,129,132,135,138,141],{"type":56,"name":57,"callback":58,"file":59,"line":60},"action","pre_get_posts","deny_trash_access","includes\\class-core.php",14,{"type":56,"name":62,"callback":63,"file":59,"line":64},"admin_init","access_denied",15,{"type":56,"name":66,"callback":66,"file":59,"line":67},"admin_menu",16,{"type":56,"name":69,"callback":70,"file":59,"line":71},"user_new_form","admin_user_meta_fields",17,{"type":56,"name":73,"callback":70,"file":59,"line":74},"show_user_profile",18,{"type":56,"name":76,"callback":70,"file":59,"line":77},"edit_user_profile",19,{"type":56,"name":79,"callback":80,"file":59,"line":81},"user_register","save_user_meta",20,{"type":56,"name":83,"callback":80,"file":59,"line":84},"personal_options_update",21,{"type":56,"name":86,"callback":80,"file":59,"line":87},"edit_user_profile_update",22,{"type":56,"name":89,"callback":90,"file":59,"line":91},"admin_head","remove_all_updates",23,{"type":93,"name":94,"callback":95,"priority":96,"file":59,"line":97},"filter","allowed_block_types","my_plugin_allowed_block_types",10,24,{"type":56,"name":99,"callback":100,"priority":101,"file":59,"line":102},"add_meta_boxes","remove_product_gallery_meta_boxes",40,25,{"type":93,"name":104,"callback":105,"file":59,"line":106},"pre_site_transient_update_plugins","check_version",150,{"type":93,"name":108,"callback":105,"file":59,"line":109},"pre_site_transient_update_themes",151,{"type":93,"name":111,"callback":112,"file":59,"line":113},"bulk_actions-edit-post","__return_empty_array",223,{"type":93,"name":115,"callback":112,"file":59,"line":116},"bulk_actions-edit-comments",224,{"type":93,"name":118,"callback":112,"file":59,"line":119},"bulk_actions-users",225,{"type":93,"name":121,"callback":112,"file":59,"line":122},"bulk_actions-plugins",226,{"type":93,"name":124,"callback":112,"file":59,"line":125},"bulk_actions-upload",227,{"type":93,"name":127,"callback":112,"file":59,"line":128},"post_row_actions",238,{"type":93,"name":130,"callback":112,"file":59,"line":131},"page_row_actions",239,{"type":93,"name":133,"callback":112,"file":59,"line":134},"media_row_actions",240,{"type":93,"name":136,"callback":112,"file":59,"line":137},"comment_row_actions",241,{"type":93,"name":139,"callback":112,"file":59,"line":140},"user_row_actions",242,{"type":93,"name":142,"callback":112,"file":59,"line":143},"plugin_action_links",243,[],[],[],[],{"dangerousFunctions":149,"sqlUsage":150,"outputEscaping":152,"fileOperations":24,"externalRequests":24,"nonceChecks":24,"capabilityChecks":13,"bundledLibraries":154},[],{"prepared":24,"raw":24,"locations":151},[],{"escaped":23,"rawEcho":24,"locations":153},[],[],[],{"summary":157,"deductions":158},"The \"codup-read-only-admin\" plugin v1.1.1.8 exhibits a generally strong security posture based on the static analysis.  The complete absence of dangerous functions, file operations, external HTTP requests, and SQL queries executed without prepared statements are significant strengths.  Furthermore, all identified output is properly escaped, and a reasonable number of capability checks are in place, indicating good awareness of secure coding practices.\n\nDespite the positive static analysis, a known medium severity Cross-Site Scripting (XSS) vulnerability from May 2022 remains a notable concern, even though it is marked as patched. While the static analysis didn't reveal any new taint flows or critical vulnerabilities, the presence of a past XSS flaw suggests that input validation might be an area that requires ongoing vigilance. The plugin's limited attack surface, with no AJAX handlers, REST API routes, shortcodes, or cron events exposed without checks, significantly mitigates immediate risks.\n\nIn conclusion, the plugin is well-coded with sound security practices for new development. However, the historical XSS vulnerability, even if patched, serves as a reminder of the importance of thorough input sanitization and the need for continuous security auditing, especially for plugins that handle sensitive administrative functions. The lack of critical findings in the current static analysis is reassuring, but the past vulnerability warrants a slightly cautious approach.",[159],{"reason":160,"points":96},"Past medium severity XSS vulnerability","2026-03-16T20:45:15.176Z",{"wat":163,"direct":169},{"assetPaths":164,"generatorPatterns":166,"scriptPaths":167,"versionParams":168},[165],"\u002Fwp-content\u002Fplugins\u002Fcodup-read-only-admin\u002Fassets\u002Fcss\u002Fstyle.css",[],[],[],{"cssClasses":170,"htmlComments":171,"htmlAttributes":172,"restEndpoints":173,"jsGlobals":174,"shortcodeOutput":176},[],[],[],[],[175],"CROA_PLUGIN_DIR_URL",[],{"error":178,"url":179,"statusCode":180,"statusMessage":181,"message":181},true,"http:\u002F\u002Flocalhost\u002Fapi\u002Fplugins\u002Fcodup-read-only-admin\u002Fbundle",404,"no bundle for this plugin yet",{"slug":4,"current_version":6,"total_versions":23,"versions":183},[184],{"version":185,"download_url":186,"svn_tag_url":187,"released_at":34,"has_diff":45,"diff_files_changed":188,"diff_lines":34,"trac_diff_url":34,"vulnerabilities":189,"is_current":45},"1.1.1.7","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcodup-read-only-admin.1.1.1.7.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fcodup-read-only-admin\u002Ftags\u002F1.1.1.7\u002F",[],[190],{"id":30,"url_slug":31,"title":32,"severity":36,"cvss_score":37,"vuln_type":39,"patched_in_version":6}]