[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fuvmDFGcT-C0J3Ohz_4f6Rm7BJO2xYEDq0q4CUn-SsEY":3},{"slug":4,"name":5,"version":6,"author":7,"author_profile":8,"description":9,"short_description":10,"active_installs":11,"downloaded":12,"rating":13,"num_ratings":14,"last_updated":15,"tested_up_to":16,"requires_at_least":17,"requires_php":18,"tags":19,"homepage":24,"download_link":25,"security_score":26,"vuln_count":27,"unpatched_count":27,"last_vuln_date":28,"fetched_at":29,"vulnerabilities":30,"developer":31,"crawl_stats":28,"alternatives":37,"analysis":136,"fingerprints":363},"custom-metadata","Custom Metadata Manager","0.7.1","Mohammad Jangda","https:\u002F\u002Fprofiles.wordpress.org\u002Fbatmoo\u002F","\u003Cp>An easy way to add custom fields to your object types (post, pages, custom post types, users) & to generate option pages.\u003C\u002Fp>\n\u003Cp>The goal of this plugin is to help you rapidly build familiar, intuitive interfaces for your users in a very WordPress-native way.\u003C\u002Fp>\n\u003Cp>The custom field panel is nice, but not quite the easiest thing for users to work with. Adding your own metaboxes and fields involves a lot of time and repetitive code that could be better used elsewhere.\u003C\u002Fp>\n\u003Cp>This plugin handles all that heavy-lifting for you behind-the-scenes, so that you can focus on more on building out and connecting your data rather than all the minor details. This single piece of code \u003Ccode>x_add_metadata_field( 'my-field-name', 'post' );\u003C\u002Fcode> generates a metabox with a text field inside it, with the necessary hooks to save the entered values.\u003C\u002Fp>\n\u003Cp>The API is similar to that used for registering custom post types and taxonomies so it should be familiar territory.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>NOTE\u003C\u002Fstrong>: The plugin now requires WordPress 3.3+ (chiefly for the wysiwyg & datepicker fields)\u003C\u002Fp>\n\u003Cp>Like what you see? Want more field types and features added? \u003Ca href=\"mailto:tech@stresslimitdesign.com\" rel=\"nofollow ugc\">Get in touch\u003C\u002Fa> or \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fjkudish\u002Fcustom-metadata\" rel=\"nofollow ugc\">contribute on github\u003C\u002Fa>\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>\u003Cem>See “Other Notes” section for usage information\u003C\u002Fem>\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Ch3>Usage\u003C\u002Fh3>\n\u003Ch4>Object Types\u003C\u002Fh4>\n\u003Cp>The main idea behind this plugin is to have a single API to work with regardless of the object type. Currently, Custom Metadata Manager works with \u003Ccode>user\u003C\u002Fcode>, \u003Ccode>comment\u003C\u002Fcode> and any built-in or custom post types, e.g. \u003Ccode>post\u003C\u002Fcode>, \u003Ccode>page\u003C\u002Fcode>, etc.\u003C\u002Fp>\n\u003Ch4>Registering your fields\u003C\u002Fh4>\n\u003Cp>For the sake of performance (and to avoid potential race conditions), always register your custom fields in the \u003Ccode>admin_menu\u003C\u002Fcode> hook. This way your front-end doesn’t get bogged down with unnecessary processing and you can be sure that your fields will be registered safely. Here’s a code sample:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>add_action( 'admin_menu', 'my_theme_init_custom_fields' );\n\nfunction my_theme_init_custom_fields() {\n    if( function_exists( 'x_add_metadata_field' ) && function_exists( 'x_add_metadata_group' ) ) {\n        x_add_metadata_field( 'my_field', array( 'user', 'post' ) );\n    }\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>Getting the data\u003C\u002Fh4>\n\u003Cp>You can get the data as you normally would using the \u003Ccode>get_metadata\u003C\u002Fcode> function. Custom Metadata manager stores all data using the WordPress metadata APIs using the slug name you provide. That way, even if you decide to deactivate this wonderful plugin, your data is safe and accessible. For options, you can use \u003Ccode>get_option\u003C\u002Fcode>.\u003C\u002Fp>\n\u003Cp>Example:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>$value = get_metadata( 'post', get_the_ID(), 'featured', true ); \u002F\u002F Returns post metadata value for the field 'featured'\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>Adding Metadata Groups\u003C\u002Fh4>\n\u003Cp>A group is essentially a metabox that groups together multiple fields. Register the group before any fields\u003C\u002Fp>\n\u003Cpre>\u003Ccode>x_add_metadata_group( $slug, $object_types, $args );\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>\u003Cstrong>Parameters\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ccode>$slug\u003C\u002Fcode> (string) The key under which the metadata will be stored.\u003C\u002Fli>\n\u003Cli>\u003Ccode>$object_types\u003C\u002Fcode> (string|array) The object types to which this field should be added. Supported: post, page, any custom post type, user, comment.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Options and Overrides\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cpre>\u003Ccode>$args = array(\n    'label' => $group_slug, \u002F\u002F Label for the group\n    'context' => 'normal', \u002F\u002F (post only)\n    'priority' => 'default', \u002F\u002F (post only)\n    'autosave' => false, \u002F\u002F (post only) Should the group be saved in autosave? NOT IMPLEMENTED YET!\n    'exclude' => '', \u002F\u002F see below for details\n    'include' => '', \u002F\u002F see below for details\n);\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>Adding Metadata Fields\u003C\u002Fh4>\n\u003Cpre>\u003Ccode>x_add_metadata_field( $slug, $object_types, $args );\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>\u003Cstrong>Parameters\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ccode>$slug\u003C\u002Fcode> (string) The key under which the metadata will be stored. For post_types, prefix the slug with an underscore (e.g. \u003Ccode>_hidden\u003C\u002Fcode>) to hide it from the the Custom Fields box.\u003C\u002Fli>\n\u003Cli>\u003Ccode>$object_types\u003C\u002Fcode> (string|array) The object types to which this field should be added. Supported: post, page, any custom post type, user, comment.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Options and Overrides\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cpre>\u003Ccode>$args = array(\n    'group' => '', \u002F\u002F The slug of group the field should be added to. This needs to be registered with x_add_metadata_group first.\n    'field_type' => 'text', \u002F\u002F The type of field; 'text', 'textarea', 'password', 'checkbox', 'radio', 'select', 'upload', 'wysiwyg', 'datepicker', 'taxonomy_select', 'taxonomy_radio'\n    'label' => '', \u002F\u002F Label for the field\n    'description' => '', \u002F\u002F Description of the field, displayed below the input\n    'values' => array(), \u002F\u002F Values for select and radio buttons. Associative array\n    'display_callback' => '', \u002F\u002F Callback to custom render the field\n    'sanitize_callback' => '', \u002F\u002F Callback to sanitize data before it's saved\n    'display_column' => false, \u002F\u002F Add the field to the columns when viewing all posts\n    'display_column_callback' => '', \u002F\u002F Callback to render output for the custom column\n    'required_cap' => '', \u002F\u002F The cap required to view and edit the field\n    'exclude' => '', \u002F\u002F see below for details\n    'include' => '', \u002F\u002F see below for details\n    'multiple' => false, \u002F\u002F true or false, can the field be duplicated with a click of a button?\n    'readonly' => false, \u002F\u002F makes the field be readonly (works with text, textarea, password, upload and datepicker fields)\n);\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>Include \u002F Exclude\u003C\u002Fh4>\n\u003Cp>You can exclude fields and groups from specific object. For example, with the following, field-1 will show up for all posts except post #123:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>$args = array(\n    'exclude' => 123\n);\nx_add_metadata_field( 'field-1', 'post', $args );\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Alternatively, you can limit (“include”) fields and groups to specific objects. The following will ”only” show group-1 to post #456:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>$args = array(\n    'include' => 123\n);\nx_add_metadata_group( 'group-1', 'post', $args );\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>You can pass in an array of IDs:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>$args = array(\n    'include' => array( 123, 456, 789 );\n);\n\nWith multiple object types, you can pass in an associative array:\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>$args = array(\u003Cbr \u002F>\n    ‘exclude’ => array(\u003Cbr \u002F>\n        ‘post’ => 123,\u003Cbr \u002F>\n        ‘user’ => array( 123, 456, 789 )\u003Cbr \u002F>\n    )\u003Cbr \u002F>\n);\u003C\u002Fp>\n\u003Ch4>Examples\u003C\u002Fh4>\n\u003Cp>For examples, please see the \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fjkudish\u002Fcustom-metadata\u002Fblob\u002Fmaster\u002Fcustom_metadata_examples.php\" rel=\"nofollow ugc\">custom_metadata_examples.php\u003C\u002Fa> file included with the plugin. Add a constant to your wp-config.php called \u003Ccode>CUSTOM_METADATA_MANAGER_DEBUG\u003C\u002Fcode> with a value of \u003Ccode>true\u003C\u002Fcode> to see it in action:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>define( 'CUSTOM_METADATA_MANAGER_DEBUG', true );\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>TODOs\u003C\u002Fh4>\n\u003Cp>Stuff we have planned for the future:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Ability to clone (multiple) groups of fields\u003C\u002Fli>\n\u003Cli>Ability Pass in attributes for built-in fields (e.g. class, data-*, etc.)\u003C\u002Fli>\n\u003Cli>Additional field types (multi-select, multi-checkbox)\u003C\u002Fli>\n\u003Cli>Limit or exclude groups and fields using a custom callback\u003C\u002Fli>\n\u003Cli>Autosave support for fields on post types\u003C\u002Fli>\n\u003Cli>Client- and server-side validation support\u003C\u002Fli>\n\u003Cli>Add groups and fields to Quick Edit\u003C\u002Fli>\n\u003C\u002Ful>\n","An easy way to add custom fields to your object types (post, pages, custom post types, users)",800,16509,88,5,"2012-07-11T19:02:00.000Z","3.4.2","3.3","",[4,20,21,22,23],"custom-metadata-manager-metadata","post-meta","postmeta","user-meta","http:\u002F\u002Fwordpress.org\u002Fextend\u002Fplugins\u002Fcustom-metadata\u002F","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcustom-metadata.0.7.1.zip",85,0,null,"2026-03-15T15:16:48.613Z",[],{"slug":32,"display_name":7,"profile_url":8,"plugin_count":14,"total_installs":33,"avg_security_score":26,"avg_patch_time_days":34,"trust_score":35,"computed_at":36},"batmoo",1340,30,84,"2026-04-04T11:21:27.867Z",[38,60,82,102,120],{"slug":39,"name":40,"version":41,"author":42,"author_profile":43,"description":44,"short_description":45,"active_installs":46,"downloaded":47,"rating":48,"num_ratings":49,"last_updated":50,"tested_up_to":51,"requires_at_least":52,"requires_php":53,"tags":54,"homepage":58,"download_link":59,"security_score":48,"vuln_count":27,"unpatched_count":27,"last_vuln_date":28,"fetched_at":29},"metadata-viewer","Metadata Viewer","2.1.1","PluginizeLab","https:\u002F\u002Fprofiles.wordpress.org\u002Fpluginizelab\u002F","\u003Cp>The Metadata Viewer plugin displays post, user (ie. posts, pages, and custom post types, user, WooCommerce products & orders) meta keys and their values at the bottom of the post & user editing page. There is also integrated realtime search feature.\u003Cbr \u002F>\nJust install a single plugin to solve multiple purpose like to show posts, pages, custom post types & user meta.\u003C\u002Fp>\n\u003Ch4>Features\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>Posts Metadata Viewer\u003C\u002Fli>\n\u003Cli>Custom Post Types Metadata Viewer\u003C\u002Fli>\n\u003Cli>Pages Metadata Viewer\u003C\u002Fli>\n\u003Cli>Users Metadata Viewer\u003C\u002Fli>\n\u003Cli>WooCommerce Products Metadata Viewer\u003C\u002Fli>\n\u003Cli>WooCommerce Orders Metadata Viewer\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch4>Up-Comming Features\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>Comment Metadata Viewer\u003C\u002Fli>\n\u003Cli>Term Metadata Viewer\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Support\u003C\u002Fh3>\n\u003Cp>If you find this plugin useful, consider supporting its development through a \u003Ca href=\"https:\u002F\u002Fwww.buymeacoffee.com\u002Faiarnob\" rel=\"nofollow ugc\">donation\u003C\u002Fa>.\u003C\u002Fp>\n","A plugin or theme developer can view metadata by this plugin easily.",300,2682,100,2,"2025-12-24T10:56:00.000Z","6.9.4","6.0.0","7.4",[55,56,57,21,23],"custom-post-type-meta","meta-viewer","metadata","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fmetadata-viewer","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fmetadata-viewer.2.1.1.zip",{"slug":61,"name":62,"version":63,"author":64,"author_profile":65,"description":66,"short_description":67,"active_installs":46,"downloaded":68,"rating":69,"num_ratings":70,"last_updated":71,"tested_up_to":72,"requires_at_least":73,"requires_php":74,"tags":75,"homepage":79,"download_link":80,"security_score":81,"vuln_count":27,"unpatched_count":27,"last_vuln_date":28,"fetched_at":29},"wp-admin-search-meta","WP-Admin Search Post Meta","0.3","meloniq","https:\u002F\u002Fprofiles.wordpress.org\u002Fmeloniq\u002F","\u003Cp>Enables searching post meta fields on admin pages.\u003C\u002Fp>\n","Enables searching post meta fields on admin pages.",6412,86,10,"2024-11-21T22:59:00.000Z","6.7.5","4.9","5.6",[76,21,22,77,78],"custom-fields","search","wp-admin","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fwp-admin-search-meta\u002F","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwp-admin-search-meta.0.3.zip",92,{"slug":83,"name":84,"version":85,"author":86,"author_profile":87,"description":88,"short_description":89,"active_installs":90,"downloaded":91,"rating":48,"num_ratings":92,"last_updated":93,"tested_up_to":94,"requires_at_least":95,"requires_php":18,"tags":96,"homepage":100,"download_link":101,"security_score":26,"vuln_count":27,"unpatched_count":27,"last_vuln_date":28,"fetched_at":29},"cleanup-duplicate-meta","Cleanup Duplicate Meta","1.0.2","Tonya Mork","https:\u002F\u002Fprofiles.wordpress.org\u002Fhellofromtonya\u002F","\u003Cp>There are times when your database gets filled up with duplicate entries that you may not want.  Cleanup Duplicate Meta allows you to check for any duplicates in either the Post Meta or User Meta tables.  Then if you want to get rid of them, simply click on the Cleanup button and Cleanup Duplicate Meta deletes the duplicates leaving either the first or last meta (you select which).\u003C\u002Fp>\n\u003Cp>The interface is simple and easy to use:\u003C\u002Fp>\n\u003Col>\n\u003Cli>‘Check for Duplicates’ queries the database and then displays all the duplicates found.\u003C\u002Fli>\n\u003Cli>‘Count Duplicates’ counts all the duplicates found in the database (i.e. a total count).\u003C\u002Fli>\n\u003Cli>The ‘Cleanup’ buttons trigger a SQL query to run, which deletes each of the duplicate entries, leaving either the first or last one (per your selection) in the database.  All non-duplicates remain untouched by the plugin.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Cp>See the \u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fextend\u002Fplugins\u002Fcleanup-duplicate-meta\u002Fscreenshots\u002F\" rel=\"ugc\">screenshots tab\u003C\u002Fa> for more details.\u003C\u002Fp>\n","Cleanup Duplicate Meta gives you a tool to check for and delete duplicate Post and\u002For User Meta entries in the database tables.",200,9629,11,"2015-05-09T11:17:00.000Z","4.2.39","3.5",[97,98,99,21,23],"database-cleanup","duplicate-meta","meta","http:\u002F\u002Fwpdevelopersclub.com\u002Fwordpress-plugins\u002Fcleanup-duplicate-meta\u002F","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcleanup-duplicate-meta.1.0.2.zip",{"slug":103,"name":104,"version":105,"author":106,"author_profile":107,"description":108,"short_description":109,"active_installs":90,"downloaded":110,"rating":111,"num_ratings":49,"last_updated":112,"tested_up_to":113,"requires_at_least":114,"requires_php":18,"tags":115,"homepage":118,"download_link":119,"security_score":48,"vuln_count":27,"unpatched_count":27,"last_vuln_date":28,"fetched_at":29},"metabase-post-user-meta-editor","Metabase – Post & User Meta Editor","0.8.1","David Towoju","https:\u002F\u002Fprofiles.wordpress.org\u002Fdavexpression\u002F","\u003Cp>This plugin shows the post meta and user meta of your website. Post meta of custom post types can also be viewed. Only admins can view this meta data.\u003C\u002Fp>\n\u003Cspan class=\"embed-youtube\" style=\"text-align:center; display: block;\">\u003Ciframe loading=\"lazy\" class=\"youtube-player\" width=\"750\" height=\"422\" src=\"https:\u002F\u002Fwww.youtube.com\u002Fembed\u002FT0EXphFEcqo?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent\" allowfullscreen=\"true\" style=\"border:0;\" sandbox=\"allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox\">\u003C\u002Fiframe>\u003C\u002Fspan>\n\u003Ch3>Post Meta\u003C\u002Fh3>\n\u003Cp>All user meta data can be viewed with this plugin (Metabase) – including custom post types. Both public and private meta keys can be viewed. Private meta keys start with the underscore prefix and are not meant to be seen in the admin.\u003C\u002Fp>\n\u003Cp>In short, any data that can be viewed with \u003Ccode>get_post_meta()\u003C\u002Fcode> can be viewed with this plugin.\u003C\u002Fp>\n\u003Cp>To view your post meta, please go to the open the post in the WP Admin and scroll down to end of the page, you will see a table titled “Meta”.\u003C\u002Fp>\n\u003Ch3>User Meta\u003C\u002Fh3>\n\u003Cp>All user meta data can be viewed\u002Fmanaged with this plugin (Metabase). Also, private and public meta keys can be viewed. Any data that can be viewed with \u003Ccode>get_user_meta()\u003C\u002Fcode> can be viewed with this plugin.\u003C\u002Fp>\n\u003Cp>To view your plugin, please got to the Users page and click to view a user. Scroll down and you will see the\u003C\u002Fp>\n\u003Ch3>Features\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>Free\u003C\u002Fli>\n\u003Cli>Stand-alone, no need to install any other plugin for this to work\u003C\u002Fli>\n\u003Cli>Delete meta data\u003C\u002Fli>\n\u003Cli>View private meta data\u003C\u002Fli>\n\u003Cli>Edit and change the values of your meta data\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Getting Started\u003C\u002Fh3>\n\u003Cp>After installing this plugin, a metabox will be added to your posts and users.\u003C\u002Fp>\n\u003Cp>You can filter the post types you want the metabox to appear in.\u003C\u002Fp>\n","Manage post meta, custom post type meta and user meta of your WordPress site.",4026,80,"2025-04-04T06:12:00.000Z","6.5.8","5.0",[99,21,116,117,23],"show-post-meta","show-user-meta","https:\u002F\u002Fpluginette.com\u002Fproduct\u002Fmetabase\u002F","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fmetabase-post-user-meta-editor.0.8.1.zip",{"slug":121,"name":122,"version":123,"author":124,"author_profile":125,"description":126,"short_description":127,"active_installs":48,"downloaded":128,"rating":48,"num_ratings":49,"last_updated":129,"tested_up_to":130,"requires_at_least":131,"requires_php":18,"tags":132,"homepage":134,"download_link":135,"security_score":26,"vuln_count":27,"unpatched_count":27,"last_vuln_date":28,"fetched_at":29},"post-meta-manager","Post Meta Manager","1.0.4","Andrew Norcross","https:\u002F\u002Fprofiles.wordpress.org\u002Fnorcross\u002F","\u003Cp>Creates a panel to change or delete meta keys in bulk. Useful for when you are switching plugins or themes that use specific meta keys for functionality, or for general cleanup for older sites that may have older meta data that is no longer in use.\u003C\u002Fp>\n","A simple utility plugin for changing or deleting post or user meta (custom fields) keys in bulk.",9026,"2016-03-18T18:38:00.000Z","4.4.34","3.0",[133,76,57,21,22],"custom-field","http:\u002F\u002Fandrewnorcross.com\u002Fplugins\u002Fpost-meta-manager\u002F","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fpost-meta-manager.1.0.4.zip",{"attackSurface":137,"codeSignals":196,"taintFlows":295,"riskAssessment":354,"analyzedAt":362},{"hooks":138,"ajaxHandlers":192,"restRoutes":193,"shortcodes":194,"cronEvents":195,"entryPointCount":27,"unprotectedCount":27},[139,145,148,152,156,159,163,167,170,173,177,181,185,189],{"type":140,"name":141,"callback":141,"priority":142,"file":143,"line":144},"action","init",1000,"custom_metadata.php",95,{"type":140,"name":146,"callback":146,"priority":142,"file":143,"line":147},"admin_init",96,{"type":140,"name":149,"callback":150,"file":143,"line":151},"admin_notices","_display_registration_errors",116,{"type":140,"name":153,"callback":154,"file":143,"line":155},"admin_enqueue_scripts","enqueue_scripts",128,{"type":140,"name":153,"callback":157,"file":143,"line":158},"enqueue_styles",129,{"type":140,"name":160,"callback":161,"file":143,"line":162},"edit_user_profile","add_user_metadata_groups",136,{"type":140,"name":164,"callback":165,"file":143,"line":166},"edit_user_profile_update","save_user_metadata",137,{"type":140,"name":168,"callback":161,"file":143,"line":169},"show_user_profile",139,{"type":140,"name":171,"callback":165,"file":143,"line":172},"personal_options_update",140,{"type":140,"name":174,"callback":175,"file":143,"line":176},"add_meta_boxes","add_post_metadata_groups",145,{"type":140,"name":178,"callback":179,"file":143,"line":180},"save_post","save_post_metadata",148,{"type":140,"name":182,"callback":183,"file":143,"line":184},"edit_comment","save_comment_metadata",149,{"type":140,"name":141,"callback":186,"file":187,"line":188},"x_init_custom_post_types","custom_metadata_examples.php",27,{"type":140,"name":146,"callback":190,"file":187,"line":191},"x_init_custom_fields",70,[],[],[],[],{"dangerousFunctions":197,"sqlUsage":198,"outputEscaping":200,"fileOperations":27,"externalRequests":27,"nonceChecks":293,"capabilityChecks":49,"bundledLibraries":294},[],{"prepared":27,"raw":27,"locations":199},[],{"escaped":92,"rawEcho":201,"locations":202},57,[203,206,208,210,212,214,216,217,219,220,221,223,224,225,227,228,229,231,232,233,235,236,237,239,241,242,243,244,245,247,249,250,252,253,255,257,258,260,261,262,264,266,267,269,270,272,274,275,276,278,280,282,284,286,288,290,292],{"file":143,"line":204,"context":205},230,"raw output",{"file":143,"line":207,"context":205},432,{"file":143,"line":209,"context":205},766,{"file":143,"line":211,"context":205},862,{"file":143,"line":213,"context":205},876,{"file":143,"line":215,"context":205},878,{"file":143,"line":215,"context":205},{"file":143,"line":218,"context":205},886,{"file":143,"line":218,"context":205},{"file":143,"line":218,"context":205},{"file":143,"line":222,"context":205},890,{"file":143,"line":222,"context":205},{"file":143,"line":222,"context":205},{"file":143,"line":226,"context":205},894,{"file":143,"line":226,"context":205},{"file":143,"line":226,"context":205},{"file":143,"line":230,"context":205},898,{"file":143,"line":230,"context":205},{"file":143,"line":230,"context":205},{"file":143,"line":234,"context":205},903,{"file":143,"line":234,"context":205},{"file":143,"line":234,"context":205},{"file":143,"line":238,"context":205},912,{"file":143,"line":240,"context":205},913,{"file":143,"line":240,"context":205},{"file":143,"line":240,"context":205},{"file":143,"line":240,"context":205},{"file":143,"line":240,"context":205},{"file":143,"line":246,"context":205},914,{"file":143,"line":248,"context":205},920,{"file":143,"line":248,"context":205},{"file":143,"line":251,"context":205},926,{"file":143,"line":251,"context":205},{"file":143,"line":254,"context":205},927,{"file":143,"line":256,"context":205},934,{"file":143,"line":256,"context":205},{"file":143,"line":259,"context":205},945,{"file":143,"line":259,"context":205},{"file":143,"line":259,"context":205},{"file":143,"line":263,"context":205},946,{"file":143,"line":265,"context":205},950,{"file":143,"line":265,"context":205},{"file":143,"line":268,"context":205},954,{"file":143,"line":268,"context":205},{"file":143,"line":271,"context":205},963,{"file":143,"line":273,"context":205},964,{"file":143,"line":273,"context":205},{"file":143,"line":273,"context":205},{"file":143,"line":277,"context":205},965,{"file":143,"line":279,"context":205},980,{"file":143,"line":281,"context":205},994,{"file":143,"line":283,"context":205},1004,{"file":143,"line":285,"context":205},1014,{"file":187,"line":287,"context":205},237,{"file":187,"line":289,"context":205},253,{"file":187,"line":291,"context":205},254,{"file":187,"line":291,"context":205},1,[],[296,332],{"entryPoint":297,"graph":298,"unsanitizedCount":49,"severity":331},"save_metadata_field (custom_metadata.php:537)",{"nodes":299,"edges":325},[300,305,309,315,319,322],{"id":301,"type":302,"label":303,"file":143,"line":304},"n0","source","$_POST[$field_slug]",539,{"id":306,"type":307,"label":308,"file":143,"line":304},"n1","transform","→ _sanitize_field_value()",{"id":310,"type":311,"label":312,"file":143,"line":313,"wp_function":314},"n2","sink","call_user_func() [RCE]",829,"call_user_func",{"id":316,"type":302,"label":317,"file":143,"line":318},"n3","$_POST",540,{"id":320,"type":307,"label":321,"file":143,"line":318},"n4","→ _save_field_value()",{"id":323,"type":311,"label":312,"file":143,"line":324,"wp_function":314},"n5",783,[326,328,329,330],{"from":301,"to":306,"sanitized":327},false,{"from":306,"to":310,"sanitized":327},{"from":316,"to":320,"sanitized":327},{"from":320,"to":323,"sanitized":327},"high",{"entryPoint":333,"graph":334,"unsanitizedCount":49,"severity":331},"\u003Ccustom_metadata> (custom_metadata.php:0)",{"nodes":335,"edges":347},[336,338,339,340,341,342,343,345],{"id":301,"type":302,"label":337,"file":143,"line":304},"$_POST (x4)",{"id":306,"type":311,"label":312,"file":143,"line":324,"wp_function":314},{"id":310,"type":302,"label":303,"file":143,"line":304},{"id":316,"type":307,"label":308,"file":143,"line":304},{"id":320,"type":311,"label":312,"file":143,"line":313,"wp_function":314},{"id":323,"type":302,"label":317,"file":143,"line":318},{"id":344,"type":307,"label":321,"file":143,"line":318},"n6",{"id":346,"type":311,"label":312,"file":143,"line":324,"wp_function":314},"n7",[348,350,351,352,353],{"from":301,"to":306,"sanitized":349},true,{"from":310,"to":316,"sanitized":327},{"from":316,"to":320,"sanitized":327},{"from":323,"to":344,"sanitized":327},{"from":344,"to":346,"sanitized":327},{"summary":355,"deductions":356},"The 'custom-metadata' plugin v0.7.1 exhibits a mixed security posture. On the positive side, it demonstrates good practices by having no known CVEs, no bundled libraries, no file operations, and no external HTTP requests. The use of prepared statements for all SQL queries is also a significant strength. However, the static analysis reveals concerning areas, particularly with output escaping, where only 16% of outputs are properly escaped. This indicates a high risk of Cross-Site Scripting (XSS) vulnerabilities, especially given the taint analysis showing two high-severity flows with unsanitized paths. The presence of capability checks and a nonce check are positive, but they do not mitigate the inherent risk from insufficient output sanitization. The lack of recorded vulnerabilities in its history might suggest a limited attack surface exploited or a lack of public disclosure, but it should not be a reason to overlook the current code signals. Overall, while the plugin has some robust security features, the significant portion of unescaped output and the identified taint flows represent a substantial risk that needs immediate attention.",[357,360],{"reason":358,"points":359},"Significant unescaped output detected",12,{"reason":361,"points":70},"High severity taint flows with unsanitized paths","2026-03-17T05:36:50.900Z",{"wat":364,"direct":371},{"assetPaths":365,"generatorPatterns":367,"scriptPaths":368,"versionParams":369},[366],"\u002Fwp-content\u002Fplugins\u002Fcustom-metadata\u002Fjs\u002Fcustom-metadata-manager.js",[],[366],[370],"custom-metadata-manager-js?ver=",{"cssClasses":372,"htmlComments":373,"htmlAttributes":374,"restEndpoints":375,"jsGlobals":376,"shortcodeOutput":380},[],[],[],[],[377,378,379],"CUSTOM_METADATA_MANAGER_DEBUG","CUSTOM_METADATA_MANAGER_VERSION","CUSTOM_METADATA_MANAGER_URL",[]]