[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftEjNPingl80epnaZWlqS5tpe2o64h5ZZU66q5ZO33T8":3,"$fcX-tC0Xu0E3Sl-gzuf0tbu83W-ZR5WyfpCX3KUAQrCk":157,"$fQxowNVDJxEYeKEjf-kznr7I76glPrqic83q0wKMYiLA":161},{"slug":4,"name":5,"version":6,"author":7,"author_profile":8,"description":9,"short_description":10,"active_installs":11,"downloaded":12,"rating":13,"num_ratings":14,"last_updated":15,"tested_up_to":16,"requires_at_least":17,"requires_php":18,"tags":19,"homepage":20,"download_link":21,"security_score":13,"vuln_count":22,"unpatched_count":22,"last_vuln_date":23,"fetched_at":24,"discovery_status":25,"vulnerabilities":26,"developer":27,"crawl_stats":23,"alternatives":34,"analysis":35,"fingerprints":137},"download-media-file","Download Media File","1.0.2","Mainul Hassan","https:\u002F\u002Fprofiles.wordpress.org\u002Fshamimmoeen\u002F","\u003Cp>\u003Cstrong>Download Media File\u003C\u002Fstrong> is a lightweight plugin that adds a \u003Cstrong>Download\u003C\u002Fstrong> button to the media modal. It lets you download files from the dashboard without opening them in a new tab.\u003C\u002Fp>\n\u003Cp>No settings needed. Activate the plugin, and the button will appear automatically in the media modal.\u003C\u002Fp>\n","Adds a \"Download\" button to the WordPress media modal for quick downloads.",300,5858,100,2,"2026-05-20T10:51:00.000Z","6.9.5","5.3","7.4",[4],"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fdownload-media-file","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fdownload-media-file.1.0.2.zip",0,null,"2026-07-22T17:31:50.256Z","no_bundle",[],{"slug":28,"display_name":7,"profile_url":8,"plugin_count":29,"total_installs":30,"avg_security_score":31,"avg_patch_time_days":32,"trust_score":31,"computed_at":33},"shamimmoeen",4,8310,99,1,"2026-08-29T04:06:25.032Z",[],{"attackSurface":36,"codeSignals":54,"taintFlows":65,"riskAssessment":125,"analyzedAt":136},{"hooks":37,"ajaxHandlers":50,"restRoutes":51,"shortcodes":52,"cronEvents":53,"entryPointCount":22,"unprotectedCount":22},[38,45],{"type":39,"name":40,"callback":41,"priority":42,"file":43,"line":44},"filter","media_meta","add_download_button",10,"includes\\class-download-media-file.php",59,{"type":46,"name":47,"callback":48,"file":43,"line":49},"action","admin_init","process_downloading_media_file",60,[],[],[],[],{"dangerousFunctions":55,"sqlUsage":56,"outputEscaping":58,"fileOperations":14,"externalRequests":22,"nonceChecks":32,"capabilityChecks":32,"bundledLibraries":64},[],{"prepared":22,"raw":22,"locations":57},[],{"escaped":59,"rawEcho":32,"locations":60},3,[61],{"file":43,"line":62,"context":63},210,"raw output",[],[66,109],{"entryPoint":67,"graph":68,"unsanitizedCount":32,"severity":108},"process_downloading_media_file (includes\\class-download-media-file.php:94)",{"nodes":69,"edges":101},[70,75,81,84,89,92,96],{"id":71,"type":72,"label":73,"file":43,"line":74},"n0","source","$_POST",103,{"id":76,"type":77,"label":78,"file":43,"line":79,"wp_function":80},"n1","sink","wp_redirect() [Open Redirect]",125,"wp_redirect",{"id":82,"type":72,"label":83,"file":43,"line":74},"n2","$_POST (x2)",{"id":85,"type":77,"label":86,"file":43,"line":87,"wp_function":88},"n3","header() [Header Injection]",162,"header",{"id":90,"type":72,"label":73,"file":43,"line":91},"n4",176,{"id":93,"type":94,"label":95,"file":43,"line":91},"n5","transform","→ readfile_chunked()",{"id":97,"type":77,"label":98,"file":43,"line":99,"wp_function":100},"n6","fopen() [File Access]",192,"fopen",[102,104,105,107],{"from":71,"to":76,"sanitized":103},true,{"from":82,"to":85,"sanitized":103},{"from":90,"to":93,"sanitized":106},false,{"from":93,"to":97,"sanitized":106},"medium",{"entryPoint":110,"graph":111,"unsanitizedCount":32,"severity":108},"\u003Cclass-download-media-file> (includes\\class-download-media-file.php:0)",{"nodes":112,"edges":120},[113,114,115,116,117,118,119],{"id":71,"type":72,"label":73,"file":43,"line":74},{"id":76,"type":77,"label":78,"file":43,"line":79,"wp_function":80},{"id":82,"type":72,"label":83,"file":43,"line":74},{"id":85,"type":77,"label":86,"file":43,"line":87,"wp_function":88},{"id":90,"type":72,"label":73,"file":43,"line":91},{"id":93,"type":94,"label":95,"file":43,"line":91},{"id":97,"type":77,"label":98,"file":43,"line":99,"wp_function":100},[121,122,123,124],{"from":71,"to":76,"sanitized":103},{"from":82,"to":85,"sanitized":103},{"from":90,"to":93,"sanitized":106},{"from":93,"to":97,"sanitized":106},{"summary":126,"deductions":127},"The download-media-file v1.0.2 plugin exhibits a generally strong security posture based on the provided static analysis. The absence of AJAX handlers, REST API routes, shortcodes, and cron events significantly limits its attack surface. Furthermore, the adherence to prepared statements for all SQL queries and the presence of nonce and capability checks are excellent security practices. The plugin also demonstrates good output escaping habits with 75% of outputs being properly handled. However, the taint analysis reveals two flows with unsanitized paths. While no critical or high severity issues were found in these flows, and the plugin has no known vulnerability history, these unsanitized paths represent potential avenues for exploitation if they interact with user-controlled input that is not sufficiently validated. The file operations also warrant attention, as they could be a vector if combined with path traversal vulnerabilities, though none were explicitly identified here.",[128,131,134],{"reason":129,"points":130},"Flows with unsanitized paths detected",15,{"reason":132,"points":133},"File operations present",5,{"reason":135,"points":59},"Output escaping not 100% proper","2026-03-16T20:01:05.019Z",{"wat":138,"direct":147},{"assetPaths":139,"generatorPatterns":142,"scriptPaths":143,"versionParams":144},[140,141],"\u002Fwp-content\u002Fplugins\u002Fdownload-media-file\u002Fassets\u002Fcss\u002Fdownload-media-file.css","\u002Fwp-content\u002Fplugins\u002Fdownload-media-file\u002Fassets\u002Fjs\u002Fdownload-media-file.js",[],[],[145,146],"download-media-file\u002Fassets\u002Fcss\u002Fdownload-media-file.css?ver=","download-media-file\u002Fassets\u002Fjs\u002Fdownload-media-file.js?ver=",{"cssClasses":148,"htmlComments":150,"htmlAttributes":151,"restEndpoints":154,"jsGlobals":155,"shortcodeOutput":156},[149],"download-media-file-form",[],[152,153],"name=\"download_media_file\"","name=\"download_media_file_nonce_field\"",[],[],[],{"error":103,"url":158,"statusCode":159,"statusMessage":160,"message":160},"http:\u002F\u002Flocalhost\u002Fapi\u002Fplugins\u002Fdownload-media-file\u002Fbundle",404,"no bundle for this plugin yet",{"slug":4,"current_version":6,"total_versions":14,"versions":162},[163,168],{"version":6,"download_url":21,"svn_tag_url":164,"released_at":23,"has_diff":106,"diff_files_changed":165,"diff_lines":23,"trac_diff_url":166,"vulnerabilities":167,"is_current":103},"https:\u002F\u002Fplugins.svn.wordpress.org\u002Fdownload-media-file\u002Ftags\u002F1.0.2\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Fdownload-media-file%2Ftags%2F1.0.0&new_path=%2Fdownload-media-file%2Ftags%2F1.0.2",[],{"version":169,"download_url":170,"svn_tag_url":171,"released_at":23,"has_diff":106,"diff_files_changed":172,"diff_lines":23,"trac_diff_url":23,"vulnerabilities":173,"is_current":106},"1.0.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fdownload-media-file.1.0.0.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fdownload-media-file\u002Ftags\u002F1.0.0\u002F",[],[]]