Investment Calculator Security & Risk Analysis

wordpress.org/plugins/investment-calculator

This plugin displays functional compounding investment calculator

80 active installs v2.1 PHP + WP 2.0.2+ Updated Sep 10, 2021
calculatorcompoundinginterestinvestment
85
A · Safe
CVEs total0
Unpatched0
Last CVENever
Safety Verdict

Is Investment Calculator Safe to Use in 2026?

Generally Safe

Score 85/100

Investment Calculator has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs Updated 4yr ago
Risk Assessment

The "investment-calculator" plugin v2.1 exhibits a generally good security posture based on the static analysis, with no dangerous functions, all SQL queries using prepared statements, and a high percentage of properly escaped outputs. The plugin also has a clean vulnerability history with no recorded CVEs, suggesting consistent security efforts or a lack of significant past issues. However, the presence of 2 flows with unsanitized paths in the taint analysis, despite no reported critical or high severity issues, is a notable concern. While these flows did not trigger critical alerts, they represent potential avenues for unintended data handling or path traversal if an attacker can manipulate the input. The absence of nonce checks and capability checks on the single shortcode entry point is also a weakness, as it means the shortcode's functionality is accessible to any logged-in user without specific authorization or protection against CSRF attacks.

Key Concerns

  • Taint flow with unsanitized path
  • No nonce checks on shortcode
  • No capability checks on shortcode
Vulnerabilities
None known

Investment Calculator Security Vulnerabilities

No known vulnerabilities — this is a good sign.
Code Analysis
Analyzed Mar 16, 2026

Investment Calculator Code Analysis

Dangerous Functions
0
Raw SQL Queries
0
0 prepared
Unescaped Output
1
16 escaped
Nonce Checks
0
Capability Checks
0
File Operations
0
External Requests
0
Bundled Libraries
0

Output Escaping

94% escaped17 total outputs
Data Flows
2 unsanitized

Data Flow Analysis

2 flows2 with unsanitized paths
investmentcalculator_options (investment-calculator.php:35)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface

Investment Calculator Attack Surface

Entry Points1
Unprotected0

Shortcodes 1

[compounding-calculator] investment-calculator.php:208
WordPress Hooks 1
actionadmin_menuinvestment-calculator.php:207
Maintenance & Trust

Investment Calculator Maintenance & Trust

Maintenance Signals

WordPress version tested5.8.13
Last updatedSep 10, 2021
PHP min version
Downloads6K

Community Trust

Rating0/100
Number of ratings0
Active installs80
Developer Profile

Investment Calculator Developer Profile

Bob

9 plugins · 5K total installs

66
trust score
Avg Security Score
81/100
Avg Patch Time
725 days
View full developer profile
Detection Fingerprints

How We Detect Investment Calculator

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

HTML / DOM Fingerprints

CSS Classes
ccalc_tableccalc_titlecellccalc_result
Data Attributes
name="invested_amount"id="invested_amount"name="contribution"id="contribution"name="ROI"id="ROI"+4 more
Shortcode Output
<h3 align="center">Investment Compounding Calculator</h3><input name="invested_amount" type="text"<input name="contribution" type="text"<input name="ROI" type="text"
FAQ

Frequently Asked Questions about Investment Calculator