Featured Posts and Custom Posts Security & Risk Analysis
wordpress.org/plugins/featured-posts-and-custom-postsAllows the user to feature posts and custom posts. When a post is featured it gets the post metta _jsFeaturedPost.
Is Featured Posts and Custom Posts Safe to Use in 2026?
Generally Safe
Score 85/100Featured Posts and Custom Posts has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.
The "featured-posts-and-custom-posts" plugin v2.0 presents a mixed security posture. On one hand, the absence of known vulnerabilities and the use of prepared statements for SQL queries are positive indicators. The plugin also demonstrates some basic security practices with a capability check in place. However, significant concerns arise from the static analysis. The presence of an unserialize function is a critical risk, especially when combined with an unprotected AJAX handler. This combination could allow for remote code execution if an attacker can control the serialized data processed by this function. Furthermore, a substantial portion of output is not properly escaped, increasing the risk of cross-site scripting (XSS) vulnerabilities. The limited attack surface is a positive, but the critical risk presented by the unprotected AJAX handler and the unserialize function overshadows this.
Key Concerns
- Unprotected AJAX handler
- Dangerous function: unserialize
- Insufficient output escaping (44% proper)
- Missing nonce checks on AJAX
Featured Posts and Custom Posts Security Vulnerabilities
Featured Posts and Custom Posts Code Analysis
Dangerous Functions Found
Output Escaping
Featured Posts and Custom Posts Attack Surface
AJAX Handlers 1
Shortcodes 1
WordPress Hooks 8
Maintenance & Trust
Featured Posts and Custom Posts Maintenance & Trust
Maintenance Signals
Community Trust
Featured Posts and Custom Posts Alternatives
Ultimate Posts Widget
ultimate-posts-widget
The ultimate widget for displaying posts, custom post types or sticky posts with an array of options.
Featured Post
featured-post
Featured Post Plugin for Wordpress.
WP Change Custom Posts Slugs
wp-change-custom-post-slug
The plugin allows to can easily change slug of custom post types from WordPress admin panel.
Super recent posts
super-recent-posts
Widget that can display recent posts from multiple categories, taxonomies, terms custom post types.
Post Type Spotlight
post-type-spotlight
x-release-please-start-version Stable tag: 3.0.3 x-release-please-end License: GPLv2 or later License URI: http://www.gnu.org/licenses/gpl-2.0.
Featured Posts and Custom Posts Developer Profile
3 plugins · 120 total installs
How We Detect Featured Posts and Custom Posts
Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.
Asset Fingerprints
/wp-content/plugins/featured-posts-and-custom-posts/img/star.pngHTML / DOM Fingerprints
featured_js_postscolumn-featured_js_postsfeatured_posts_star/**
Plugin Name: Featured Posts and Custom Posts
Plugin URI: http://www.reactivedevelopment.net/snippets/featured-posts-custom-posts
Description: Allows the user to feature posts and custom posts. When a post is featured it gets the post metta _jsFeaturedPost
Version: 2.0
* Note: go here http://www.reactivedevelopment.net/snippets/featured-posts-custom-posts for documentation
or for paid support go here http://www.reactivedevelopment.net/contact/
*
Activation Instructions
1. Download the feature-posts-and-custom-posts.zip file to your computer.
2. Unzip the file.
3. Upload the feature-posts-and-custom-posts folder to your /wp-content/plugins/ directory.
4. Activate the plugin through the Plugins menu in WordPress.
*
Change log
01. updated code and tested new version on wordpress 4.1.1 ver 2.0 | 02/25/2015
02. added extra sanitation to js_featured_posts_link_add_ajax_call_to_wp() ver 2.0 | 02/25/2015
03. added js_featured_is_post_featured( userID[int] ) function ver 2.0 | 02/25/2015
04. added short cut is_post_featured( userID[int] ) function ver 2.0 | 02/25/2015
05. added js_featured_return_all_featured() function that returns an array of featured posts ver 2.0 | 02/25/2015
06. added widget by extending widget class with featuredPostWidget ver 2.0 | 02/25/2015
07. added js_featured_register_widgets() function to init out featuredPostWidget ver 2.0 | 02/25/2015
08. added js_featured_add_post_class() class function that addes the jsFeatured class if the post is featured ver 2.0 | 02/25/2015
09. added [jsFeaturedPosts posts_per_page="1" wrap_before="<ul>" wrap_after="</ul>" link_before="<li>" ver 2.0 | 02/25/2015
link_after="</li>" link_atts="rel='bookmark'" link_title="Link to"] shortcode
*+9 moreid="postFeatured_([0-9]+)"[jsFeaturedPosts