Disqus Popular Threads Widget Security & Risk Analysis

wordpress.org/plugins/disqus-popular-threads-widget

Shows your most commented posts from Disqus via widget, shortcode, or template tag.

10 active installs v1.2 PHP + WP 3.2+ Updated May 24, 2013
commentsdisqusmost-popularmost-commentedpopular-posts
85
A · Safe
CVEs total0
Unpatched0
Last CVENever
Safety Verdict

Is Disqus Popular Threads Widget Safe to Use in 2026?

Generally Safe

Score 85/100

Disqus Popular Threads Widget has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs Updated 12yr ago
Risk Assessment

The disqus-popular-threads-widget plugin version 1.2 exhibits a mixed security posture. On the positive side, it demonstrates good practices by utilizing prepared statements for all SQL queries and has no recorded CVEs, suggesting a generally secure history. However, significant concerns arise from the static analysis. The presence of a 'create_function' call is a known risk, as it can be exploited for code injection under certain circumstances. Furthermore, a substantial portion of output (82%) is not properly escaped, creating a risk of Cross-Site Scripting (XSS) vulnerabilities if user-supplied data is not sanitized before display. The taint analysis, while limited in scope, did identify two flows with unsanitized paths, indicating potential issues where data might be processed insecurely.

Key Concerns

  • Dangerous function used (create_function)
  • Low output escaping rate
  • Unsanitized paths in taint analysis
  • No nonce checks on entry points
  • No capability checks on entry points
Vulnerabilities
None known

Disqus Popular Threads Widget Security Vulnerabilities

No known vulnerabilities — this is a good sign.
Code Analysis
Analyzed Mar 16, 2026

Disqus Popular Threads Widget Code Analysis

Dangerous Functions
1
Raw SQL Queries
0
0 prepared
Unescaped Output
18
4 escaped
Nonce Checks
0
Capability Checks
0
File Operations
0
External Requests
0
Bundled Libraries
0

Dangerous Functions Found

create_functionadd_action( 'widgets_init', create_function( '', 'register_widget( "Disqus_popular_threads_widget" )wp-disqus-pt.php:181

Output Escaping

18% escaped22 total outputs
Data Flows
2 unsanitized

Data Flow Analysis

2 flows2 with unsanitized paths
diqus_threads_settings_page (wp-disqus-pt.php:46)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface

Disqus Popular Threads Widget Attack Surface

Entry Points1
Unprotected0

Shortcodes 1

[disqus_threads] wp-disqus-pt.php:240
WordPress Hooks 3
actionadmin_menuwp-disqus-pt.php:41
actionwidgets_initwp-disqus-pt.php:181
actionwp_enqueue_scriptswp-disqus-pt.php:193
Maintenance & Trust

Disqus Popular Threads Widget Maintenance & Trust

Maintenance Signals

WordPress version tested3.5.2
Last updatedMay 24, 2013
PHP min version
Downloads5K

Community Trust

Rating60/100
Number of ratings2
Active installs10
Developer Profile

Disqus Popular Threads Widget Developer Profile

Ron Zvagelsky

2 plugins · 110 total installs

84
trust score
Avg Security Score
85/100
Avg Patch Time
30 days
View full developer profile
Detection Fingerprints

How We Detect Disqus Popular Threads Widget

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/disqus-popular-threads-widget/disqus-popular-threads.js
Script Paths
/wp-content/plugins/disqus-popular-threads-widget/disqus-popular-threads.js

HTML / DOM Fingerprints

HTML Comments
Copyright 2013This program is free software; you can redistribute it and/or modifyit under the terms of the GNU General Public License, version 2, aspublished by the Free Software Foundation.+7 more
Data Attributes
id="api_key"id="forum_ID"id="forum_domain"id="diqus-threads-settings-page"id="Disqus_popular_threads_widget"id="disqus-popular-threads-widget"+6 more
JS Globals
DiscusMostPopularThreads
FAQ

Frequently Asked Questions about Disqus Popular Threads Widget