JS Widgets Security & Risk Analysis

wordpress.org/plugins/js-widgets

A prototype of next generation of widgets in core, embracing JS for UI and powering the Widgets REST API.

10 active installs v0.4.3 PHP 5.3+ WP 4.7.0+ Updated Unknown
customizerrest-apiwidgets
100
A · Safe
CVEs total0
Unpatched0
Last CVENever
Safety Verdict

Is JS Widgets Safe to Use in 2026?

Generally Safe

Score 100/100

JS Widgets has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs
Risk Assessment

The "js-widgets" v0.4.3 plugin exhibits a generally strong security posture based on the provided static analysis and vulnerability history. The absence of any reported CVEs and the clean taint analysis are significant strengths, indicating a history of secure development and a lack of exploitable vulnerabilities in past versions. The code also demonstrates good practices with all SQL queries using prepared statements and a high percentage of properly escaped output. Capability checks are also in place, which is positive for access control.

Key Concerns

  • No nonce checks detected on entry points
  • Potential for insecure file operations
Vulnerabilities
None known

JS Widgets Security Vulnerabilities

No known vulnerabilities — this is a good sign.
Code Analysis
Analyzed Mar 16, 2026

JS Widgets Code Analysis

Dangerous Functions
0
Raw SQL Queries
0
3 prepared
Unescaped Output
6
47 escaped
Nonce Checks
0
Capability Checks
5
File Operations
3
External Requests
0
Bundled Libraries
0

SQL Query Safety

100% prepared3 total queries

Output Escaping

89% escaped53 total outputs
Attack Surface

JS Widgets Attack Surface

Entry Points0
Unprotected0
WordPress Hooks 28
actionplugins_loadedjs-widgets.php:36
actionadmin_noticesphp\class-js-widgets-plugin.php:98
filterwidget_customizer_setting_argsphp\class-js-widgets-plugin.php:104
actionwp_default_scriptsphp\class-js-widgets-plugin.php:105
actionwp_default_stylesphp\class-js-widgets-plugin.php:106
actionwp_enqueue_scriptsphp\class-js-widgets-plugin.php:107
actionrest_api_initphp\class-js-widgets-plugin.php:108
actioncustomize_controls_enqueue_scriptsphp\class-js-widgets-plugin.php:109
actioncustomize_controls_print_scriptsphp\class-js-widgets-plugin.php:110
actionadmin_enqueue_scriptsphp\class-js-widgets-plugin.php:111
actioncustomize_controls_print_footer_scriptsphp\class-js-widgets-plugin.php:112
actionadmin_footer-widgets.phpphp\class-js-widgets-plugin.php:113
actioncustomize_controls_initphp\class-js-widgets-plugin.php:114
actionwidgets_initphp\class-js-widgets-plugin.php:115
actionwidgets_initphp\class-js-widgets-plugin.php:116
actionin_widget_formphp\class-js-widgets-plugin.php:118
actionin_widget_formphp\class-js-widgets-plugin.php:119
actionwp_enqueue_scriptsphp\class-js-widgets-shortcode-ui.php:35
actionwidgets_initphp\class-js-widgets-shortcode-ui.php:36
filtershortcode_ui_fieldsphp\class-js-widgets-shortcode-ui.php:37
actionprint_shortcode_ui_templatesphp\class-js-widgets-shortcode-ui.php:38
actionenqueue_shortcode_uiphp\class-js-widgets-shortcode-ui.php:39
actionshortcode_ui_before_do_shortcodephp\class-js-widgets-shortcode-ui.php:41
actionshortcode_ui_after_do_shortcodephp\class-js-widgets-shortcode-ui.php:42
actionregister_shortcode_uiphp\class-js-widgets-shortcode-ui.php:105
actionadmin_noticespost-collection-widget\class-plugin.php:46
actionwidgets_initpost-collection-widget\class-plugin.php:50
actionplugins_loadedpost-collection-widget.php:37
Maintenance & Trust

JS Widgets Maintenance & Trust

Maintenance Signals

WordPress version tested4.9.0
Last updatedUnknown
PHP min version5.3
Downloads3K

Community Trust

Rating0/100
Number of ratings0
Active installs10
Developer Profile

JS Widgets Developer Profile

Weston Ruter

22 plugins · 437K total installs

73
trust score
Avg Security Score
91/100
Avg Patch Time
4499 days
View full developer profile
Detection Fingerprints

How We Detect JS Widgets

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/js-widgets/js/widget-form.js/wp-content/plugins/js-widgets/js/customize-js-widgets.js/wp-content/plugins/js-widgets/js/admin-js-widgets.js/wp-content/plugins/js-widgets/js/shortcode-ui-view-widget-form-field.js/wp-content/plugins/js-widgets/js/widget-preview.js/wp-content/plugins/js-widgets/js/widget-renderer.js/wp-content/plugins/js-widgets/css/widget-preview.css/wp-content/plugins/js-widgets/css/widget-renderer.css
Script Paths
/wp-content/plugins/js-widgets/js/widget-form.js/wp-content/plugins/js-widgets/js/customize-js-widgets.js/wp-content/plugins/js-widgets/js/admin-js-widgets.js/wp-content/plugins/js-widgets/js/shortcode-ui-view-widget-form-field.js/wp-content/plugins/js-widgets/js/widget-preview.js/wp-content/plugins/js-widgets/js/widget-renderer.js
Version Parameters
/wp-content/plugins/js-widgets/js/widget-form.js?ver=/wp-content/plugins/js-widgets/js/customize-js-widgets.js?ver=/wp-content/plugins/js-widgets/js/admin-js-widgets.js?ver=/wp-content/plugins/js-widgets/js/shortcode-ui-view-widget-form-field.js?ver=/wp-content/plugins/js-widgets/js/widget-preview.js?ver=/wp-content/plugins/js-widgets/js/widget-renderer.js?ver=/wp-content/plugins/js-widgets/css/widget-preview.css?ver=/wp-content/plugins/js-widgets/css/widget-renderer.css?ver=

HTML / DOM Fingerprints

CSS Classes
components-widget-field__descriptioncomponents-widget-field__helpcomponents-widget-field__labelcomponents-widget-field__input
HTML Comments
Shortcake integration.
Data Attributes
data-shortcake-ui-widget-namedata-shortcake-ui-widget-field-namedata-shortcake-ui-widget-field-type
JS Globals
window.JS_Widgets_Formwindow.JS_Widgets_Customize_Widget_Datawindow.JS_Widgets_Customize_Widget_Rendererwindow.JS_Widgets_Adminwindow.JS_Widgets_Previewwindow.JS_Widgets_Renderer
REST Endpoints
/wp-json/js-widgets/v1/widgets
FAQ

Frequently Asked Questions about JS Widgets