[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7xLR4Q262jdJ8ncX4bx9zduyvPeU9j2ejrd_9tlDh9Y":3,"$fyyF7fc_OVR-QzydaGMaeI4pcXsITtLfxwkvQKKEJ8aw":286},{"slug":4,"name":5,"version":6,"author":7,"author_profile":8,"description":9,"short_description":10,"active_installs":11,"downloaded":12,"rating":13,"num_ratings":13,"last_updated":14,"tested_up_to":15,"requires_at_least":16,"requires_php":17,"tags":18,"homepage":19,"download_link":20,"security_score":21,"vuln_count":13,"unpatched_count":13,"last_vuln_date":22,"fetched_at":23,"vulnerabilities":24,"developer":25,"crawl_stats":22,"alternatives":33,"analysis":34,"fingerprints":241},"comparisons","Comparisons","1.5","Graham","https:\u002F\u002Fprofiles.wordpress.org\u002Faerin\u002F","\u003Cp>Comparing things is fun! And with this simple plugin you can do just that. One shortcode but hundreds of options to compare loans, savings, utilities, mobile phone and internet plans. All you need to do is add the data or upload the from a CSV and it will work out the box. You can then adjust the sliders, add features, filters, sorting and other enhancements to help your site visitors make a decision.\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fcomparisonplugin.com\u002Fsettings\u002F\" rel=\"nofollow ugc\">Get help setting up the plugin\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>If the plugin doesn’t quite do what you want you can get your own custom version:\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fcomparisonplugin.com\u002Fcustom-versions\u002F\" rel=\"nofollow ugc\">Examples of custom versions\u003C\u002Fa>\u003C\u002Fp>\n\u003Ch3>Features\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>Use for loans, saving, utilities, phone plans or credit cards\u003C\u002Fli>\n\u003Cli>Set the max, min, initial and step values on the sliders\u003C\u002Fli>\n\u003Cli>Optional credit score slider\u003C\u002Fli>\n\u003Cli>Display monthly and total repayments\u003C\u002Fli>\n\u003Cli>Set interest rates and other bank data\u003C\u002Fli>\n\u003Cli>Multiple output options\u003C\u002Fli>\n\u003Cli>Show ratings\u003C\u002Fli>\n\u003Cli>Add an optional admin fee to the total to pay\u003C\u002Fli>\n\u003Cli>Include a ‘more info’ section for each bank\u003C\u002Fli>\n\u003Cli>Affiliate links\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Support\u003C\u002Fh3>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fcomparisonplugin.com\u002F\" rel=\"nofollow ugc\">comparisonplugin.com\u003C\u002Fa>\u003C\u002Fp>\n","A simple way to compare things. Just one shortcode but hundreds of options.",50,66704,0,"2026-01-05T14:57:00.000Z","6.9.4","6.0","7.0",[],"https:\u002F\u002Fcomparisonplugin.com\u002F","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcomparisons.1.5.zip",100,null,"2026-04-06T09:54:40.288Z",[],{"slug":26,"display_name":7,"profile_url":8,"plugin_count":27,"total_installs":28,"avg_security_score":29,"avg_patch_time_days":30,"trust_score":31,"computed_at":32},"aerin",5,1550,88,154,71,"2026-04-10T14:18:03.679Z",[],{"attackSurface":35,"codeSignals":70,"taintFlows":165,"riskAssessment":235,"analyzedAt":240},{"hooks":36,"ajaxHandlers":62,"restRoutes":63,"shortcodes":64,"cronEvents":68,"entryPointCount":69,"unprotectedCount":13},[37,43,47,53,58],{"type":38,"name":39,"callback":40,"file":41,"line":42},"action","wp_enqueue_scripts","comparisons_scripts","comparisons.php",24,{"type":38,"name":44,"callback":45,"file":41,"line":46},"init","comparisons_lang_init",25,{"type":48,"name":49,"callback":50,"priority":51,"file":41,"line":52},"filter","plugin_action_links","comparisons_plugin_action_links",10,26,{"type":38,"name":54,"callback":55,"file":56,"line":57},"admin_menu","comparisons_page_init","settings.php",1246,{"type":38,"name":59,"callback":60,"file":56,"line":61},"admin_enqueue_scripts","comparisons_scripts_init",1247,[],[],[65],{"tag":4,"callback":66,"file":41,"line":67},"comparisons_display",27,[],1,{"dangerousFunctions":71,"sqlUsage":72,"outputEscaping":74,"fileOperations":13,"externalRequests":13,"nonceChecks":163,"capabilityChecks":13,"bundledLibraries":164},[],{"prepared":13,"raw":13,"locations":73},[],{"escaped":75,"rawEcho":76,"locations":77},284,42,[78,81,83,85,87,89,91,93,95,97,99,101,103,105,107,109,111,113,115,117,119,121,123,125,127,129,131,133,135,137,139,141,143,145,147,149,151,153,155,157,159,161],{"file":56,"line":79,"context":80},279,"raw output",{"file":56,"line":82,"context":80},341,{"file":56,"line":84,"context":80},363,{"file":56,"line":86,"context":80},373,{"file":56,"line":88,"context":80},381,{"file":56,"line":90,"context":80},422,{"file":56,"line":92,"context":80},446,{"file":56,"line":94,"context":80},455,{"file":56,"line":96,"context":80},456,{"file":56,"line":98,"context":80},468,{"file":56,"line":100,"context":80},476,{"file":56,"line":102,"context":80},513,{"file":56,"line":104,"context":80},531,{"file":56,"line":106,"context":80},532,{"file":56,"line":108,"context":80},541,{"file":56,"line":110,"context":80},551,{"file":56,"line":112,"context":80},554,{"file":56,"line":114,"context":80},566,{"file":56,"line":116,"context":80},569,{"file":56,"line":118,"context":80},699,{"file":56,"line":120,"context":80},773,{"file":56,"line":122,"context":80},839,{"file":56,"line":124,"context":80},842,{"file":56,"line":126,"context":80},849,{"file":56,"line":128,"context":80},855,{"file":56,"line":130,"context":80},863,{"file":56,"line":132,"context":80},880,{"file":56,"line":134,"context":80},907,{"file":56,"line":136,"context":80},918,{"file":56,"line":138,"context":80},948,{"file":56,"line":140,"context":80},953,{"file":56,"line":142,"context":80},968,{"file":56,"line":144,"context":80},1002,{"file":56,"line":146,"context":80},1004,{"file":56,"line":148,"context":80},1006,{"file":56,"line":150,"context":80},1008,{"file":56,"line":152,"context":80},1013,{"file":56,"line":154,"context":80},1041,{"file":56,"line":156,"context":80},1053,{"file":56,"line":158,"context":80},1063,{"file":56,"line":160,"context":80},1125,{"file":56,"line":162,"context":80},1157,20,[],[166,200,218],{"entryPoint":167,"graph":168,"unsanitizedCount":13,"severity":199},"comparisons_data (settings.php:57)",{"nodes":169,"edges":194},[170,175,181,184,187,190],{"id":171,"type":172,"label":173,"file":56,"line":174},"n0","source","$_POST (x2)",271,{"id":176,"type":177,"label":178,"file":56,"line":179,"wp_function":180},"n1","sink","update_option() [Settings Manipulation]",272,"update_option",{"id":182,"type":172,"label":183,"file":56,"line":174},"n2","$_POST['calculator']",{"id":185,"type":177,"label":178,"file":56,"line":186,"wp_function":180},"n3",278,{"id":188,"type":172,"label":189,"file":56,"line":174},"n4","$_POST['calculator'] (x11)",{"id":191,"type":177,"label":192,"file":56,"line":79,"wp_function":193},"n5","echo() [XSS]","echo",[195,197,198],{"from":171,"to":176,"sanitized":196},true,{"from":182,"to":185,"sanitized":196},{"from":188,"to":191,"sanitized":196},"low",{"entryPoint":201,"graph":202,"unsanitizedCount":13,"severity":199},"comparisons_settings (settings.php:581)",{"nodes":203,"edges":214},[204,206,208,209,211,213],{"id":171,"type":172,"label":173,"file":56,"line":205},691,{"id":176,"type":177,"label":178,"file":56,"line":207,"wp_function":180},692,{"id":182,"type":172,"label":183,"file":56,"line":205},{"id":185,"type":177,"label":178,"file":56,"line":210,"wp_function":180},698,{"id":188,"type":172,"label":212,"file":56,"line":205},"$_POST['calculator'] (x17)",{"id":191,"type":177,"label":192,"file":56,"line":118,"wp_function":193},[215,216,217],{"from":171,"to":176,"sanitized":196},{"from":182,"to":185,"sanitized":196},{"from":188,"to":191,"sanitized":196},{"entryPoint":219,"graph":220,"unsanitizedCount":13,"severity":199},"\u003Csettings> (settings.php:0)",{"nodes":221,"edges":231},[222,224,225,227,228,230],{"id":171,"type":172,"label":223,"file":56,"line":174},"$_POST (x4)",{"id":176,"type":177,"label":178,"file":56,"line":179,"wp_function":180},{"id":182,"type":172,"label":226,"file":56,"line":174},"$_POST['calculator'] (x4)",{"id":185,"type":177,"label":178,"file":56,"line":186,"wp_function":180},{"id":188,"type":172,"label":229,"file":56,"line":174},"$_POST['calculator'] (x30)",{"id":191,"type":177,"label":192,"file":56,"line":79,"wp_function":193},[232,233,234],{"from":171,"to":176,"sanitized":196},{"from":182,"to":185,"sanitized":196},{"from":188,"to":191,"sanitized":196},{"summary":236,"deductions":237},"The \"comparisons\" plugin v1.5 exhibits a generally strong security posture based on the provided static analysis. The complete absence of dangerous functions, raw SQL queries, file operations, and external HTTP requests is a significant strength.  The high percentage of properly escaped output and the presence of nonce checks further contribute to a robust defense against common web vulnerabilities. The zero known CVEs and the lack of any recorded vulnerabilities in its history suggest a well-maintained and secure plugin.\n\nHowever, a notable concern arises from the complete lack of capability checks. While nonce checks are present, this omission means that any user, regardless of their WordPress role or permissions, could potentially interact with the plugin's functionality. This broad accessibility, particularly through its single shortcode entry point, could be exploited if the shortcode itself handles sensitive data or actions that should be permission-gated. This is the primary area for improvement, as it represents a potential for privilege escalation or unauthorized data access.\n\nIn conclusion, the \"comparisons\" plugin v1.5 is commendably secure in many aspects, demonstrating good development practices. The primary weakness lies in the absence of capability checks, which, while not directly indicated as exploited vulnerabilities, presents a theoretical attack vector that should be addressed to achieve a more comprehensive security model.",[238],{"reason":239,"points":51},"Missing capability checks","2026-03-16T21:58:06.374Z",{"wat":242,"direct":251},{"assetPaths":243,"generatorPatterns":246,"scriptPaths":247,"versionParams":248},[244,245],"\u002Fwp-content\u002Fplugins\u002Fcomparisons\u002Fcss\u002Fcomparisons.css","\u002Fwp-content\u002Fplugins\u002Fcomparisons\u002Fjs\u002Fcomparisons.js",[],[245],[249,250],"comparisons\u002Fcss\u002Fcomparisons.css?ver=","comparisons\u002Fjs\u002Fcomparisons.js?ver=",{"cssClasses":252,"htmlComments":260,"htmlAttributes":261,"restEndpoints":263,"jsGlobals":264,"shortcodeOutput":265},[253,254,255,256,257,258,259],"comparisons_slider","company_box","comparisons__handle","comparisons__fill","output-label","company_apply","comparisons_form",[],[262],"sc_rates",[],[262],[266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285],"[comparisons]","[company]","[product_name]","[min_loan]","[max_loan]","[min_term]","[max_term]","[rate]","[fees]","[link1]","[rating]","[total]","[payment]","[cost]","[tariff]","[fixed]","[credit]","[amount]","[term]","[period]",{"slug":4,"current_version":6,"total_versions":287,"versions":288},6,[289,295,302,309,316,323],{"version":6,"download_url":20,"svn_tag_url":290,"released_at":22,"has_diff":291,"diff_files_changed":292,"diff_lines":22,"trac_diff_url":293,"vulnerabilities":294,"is_current":196},"https:\u002F\u002Fplugins.svn.wordpress.org\u002Fcomparisons\u002Ftags\u002F1.5\u002F",false,[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Fcomparisons%2Ftags%2F1.4&new_path=%2Fcomparisons%2Ftags%2F1.5",[],{"version":296,"download_url":297,"svn_tag_url":298,"released_at":22,"has_diff":291,"diff_files_changed":299,"diff_lines":22,"trac_diff_url":300,"vulnerabilities":301,"is_current":291},"1.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcomparisons.1.4.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fcomparisons\u002Ftags\u002F1.4\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Fcomparisons%2Ftags%2F1.3&new_path=%2Fcomparisons%2Ftags%2F1.4",[],{"version":303,"download_url":304,"svn_tag_url":305,"released_at":22,"has_diff":291,"diff_files_changed":306,"diff_lines":22,"trac_diff_url":307,"vulnerabilities":308,"is_current":291},"1.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcomparisons.1.3.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fcomparisons\u002Ftags\u002F1.3\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Fcomparisons%2Ftags%2F1.2&new_path=%2Fcomparisons%2Ftags%2F1.3",[],{"version":310,"download_url":311,"svn_tag_url":312,"released_at":22,"has_diff":291,"diff_files_changed":313,"diff_lines":22,"trac_diff_url":314,"vulnerabilities":315,"is_current":291},"1.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcomparisons.1.2.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fcomparisons\u002Ftags\u002F1.2\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Fcomparisons%2Ftags%2F1.1&new_path=%2Fcomparisons%2Ftags%2F1.2",[],{"version":317,"download_url":318,"svn_tag_url":319,"released_at":22,"has_diff":291,"diff_files_changed":320,"diff_lines":22,"trac_diff_url":321,"vulnerabilities":322,"is_current":291},"1.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcomparisons.1.1.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fcomparisons\u002Ftags\u002F1.1\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Fcomparisons%2Ftags%2F1.0&new_path=%2Fcomparisons%2Ftags%2F1.1",[],{"version":324,"download_url":325,"svn_tag_url":326,"released_at":22,"has_diff":291,"diff_files_changed":327,"diff_lines":22,"trac_diff_url":22,"vulnerabilities":328,"is_current":291},"1.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcomparisons.1.0.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fcomparisons\u002Ftags\u002F1.0\u002F",[],[]]