[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJsquuq4WTnlj7gNv1Y_jbkSDgP2-0bUv9RgN1efAsik":3,"$f7QC2UrdMaCQjqHze-YDXbZQBca_WWe-agkKs3zzcCi0":728,"$fnkUvmAlgc03JPl9UnKxNb-1gdrNHwf9tSS7w-IfLFB0":732},{"slug":4,"name":5,"version":6,"author":7,"author_profile":8,"description":9,"short_description":10,"active_installs":11,"downloaded":12,"rating":11,"num_ratings":11,"last_updated":13,"tested_up_to":14,"requires_at_least":15,"requires_php":16,"tags":17,"homepage":20,"download_link":21,"security_score":22,"vuln_count":11,"unpatched_count":11,"last_vuln_date":23,"fetched_at":24,"discovery_status":25,"vulnerabilities":26,"developer":27,"crawl_stats":23,"alternatives":34,"analysis":76,"fingerprints":697},"lendingq","LendingQ","1.0","Cleveland Heights-University Heights Public Library Webdeveloper","https:\u002F\u002Fprofiles.wordpress.org\u002Fchuhpl\u002F","\u003Cp>LendingQ allows you to specify multiple locations and item types, and then add items to your stock.\u003C\u002Fp>\n\u003Cp>Non-admin users can fill out a Hold on an item from a specific item type and location.\u003C\u002Fp>\n\u003Cp>This creates a Check Out list, ordered by date.\u003C\u002Fp>\n\u003Cp>Users can be marked as contacted, and items have a time to lend. Overdue items are listed.\u003C\u002Fp>\n\u003Cp>The Check In list allows non-admin users to check devices back in, and even mark them as lost, stolen or broken. Admin users can reenable these items once fixed or replaced.\u003C\u002Fp>\n","LendingQ is a simple way to manage and lend out items without worrying about using a large ILS.",0,1329,"2023-01-30T15:14:00.000Z","6.1.10","4.7","5.6",[18,19],"borrow","lending","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Flendingq\u002F","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Flendingq.zip",85,null,"2026-04-06T09:54:40.288Z","no_bundle",[],{"slug":28,"display_name":7,"profile_url":8,"plugin_count":29,"total_installs":30,"avg_security_score":31,"avg_patch_time_days":30,"trust_score":32,"computed_at":33},"chuhpl",3,30,71,74,"2026-07-14T13:15:53.393Z",[35,58],{"slug":36,"name":37,"version":38,"author":39,"author_profile":40,"description":41,"short_description":42,"active_installs":43,"downloaded":44,"rating":45,"num_ratings":46,"last_updated":47,"tested_up_to":14,"requires_at_least":48,"requires_php":49,"tags":50,"homepage":55,"download_link":56,"security_score":22,"vuln_count":11,"unpatched_count":11,"last_vuln_date":23,"fetched_at":57},"sharing-club","Sharing Club","1.3.1","netdelight","https:\u002F\u002Fprofiles.wordpress.org\u002Fnetdelight\u002F","\u003Cp>Sharing Club lets you create a list of the items (like DVD, books, tools…) you want to lend to your users.\u003Cbr \u002F>\nThey can easily book, comment and rate these item. On the admin side, you can track what you’ve lent, who borrowed it and when.\u003C\u002Fp>\n\u003Cp>Useful for any NGO, association or community with a sharing philosophy.\u003Cbr \u002F>\nCurrently available in english, french and dutch – feel free to translate it (using WordPress \u003Ca href=\"https:\u002F\u002Ftranslate.wordpress.org\u002Fprojects\u002Fwp-plugins\u002Fsharing-club\" rel=\"nofollow ugc\">online interface\u003C\u002Fa> or the provided files in the \u003Ccode>languages\u003C\u002Fcode> folder).\u003C\u002Fp>\n\u003Cp>The shared object are based on WordPress custom post type and taxonomy (custom categories) which means that :\u003C\u002Fp>\n\u003Cul>\n\u003Cli>you can use other plugins to extends the Sharing Club possibilities, see the FAQ below\u003C\u002Fli>\n\u003Cli>you can use easily integrate them, straight in your theme or using the provided templates files (see comments inside the PHP files)\u003C\u002Fli>\n\u003Cli>you can search for objects from anywhere in your website, like you would do for any other post\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>If you like this plugin, I would really appreciate if you can leave it a \u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fsharing-club\u002F#reviews\" rel=\"ugc\">positive review\u003C\u002Fa> (you need to create a \u003Ca href=\"https:\u002F\u002Flogin.wordpress.org\u002Fregister\" rel=\"nofollow ugc\">WordPress account\u003C\u002Fa> if you don’t have one yet).\u003C\u002Fp>\n","Share books, dvd, tools, toys or any object with your community. Your users can easily lend, borrow and rate items and you know who borrowed what.",70,3772,96,4,"2022-12-02T11:01:00.000Z","4.0","",[18,51,52,53,54],"community","lend","loan","share","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fsharing-club\u002F","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsharing-club.zip","2026-04-16T10:56:18.058Z",{"slug":59,"name":60,"version":61,"author":60,"author_profile":62,"description":63,"short_description":64,"active_installs":65,"downloaded":66,"rating":11,"num_ratings":11,"last_updated":67,"tested_up_to":68,"requires_at_least":69,"requires_php":16,"tags":70,"homepage":73,"download_link":74,"security_score":22,"vuln_count":11,"unpatched_count":11,"last_vuln_date":23,"fetched_at":75},"lendingworks-retail-finance","Lending Works","1.0.0","https:\u002F\u002Fprofiles.wordpress.org\u002Flendingworksltd\u002F","\u003Cp>Lending Works matches investors directly with borrowers who want to spread the cost of their purchase. By cutting out the old financial institutions, we help your customers buy more for less. There are no hidden fees for you or customers. Just simple, flexible finance on purchases from £50 to £25,000. Lending Works isn’t like old fashioned financial services companies. We seamlessly connect people that want to invest their money with sensible borrowers who want to get a better rate on their personal loan, so both get a better deal. Rather than focusing exclusively on profits, we focus on being fair, transparent and honest. These values not only make us proud of the way we treat our customers, but also help us to set a new standard in financial services. This extension will add a new payment option, Lending Works Retail Finance, to your checkout. This allows customers to apply directly to Lending Works for finance when making a purchase, and if approved, proceed with the order in minutes. It works by connecting to our API, and launching our application checkout remotely, and synchronising order details between your database and ours. Learn more\u003C\u002Fp>\n\u003Cp>Why our solution is great for retailers\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Boost your sales – Offering finance can increase your sales by 17% and order value by 15%, on average. Source: Forrester\u003C\u002Fli>\n\u003Cli>Customers love us – From start to finish, you and your customers enjoy one seamless experience, online, in-store or over the phone. That’s why we’re rated 9.7 out of 10 on trust pilot.- Rocket science made simple – Our integration takes days, not months, and we support you all the way. See all your sales on one easy-to-use online account, or connect by API.\u003C\u002Fli>\n\u003Cli>Flexible finance – Split small purchases into 3 interest-free payments or Finance from 6 to 60 months on purchases from £250.00\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Account & Pricing\u003C\u002Fp>\n\u003Cp>\u003Cstrong>You must be signed up as an approved retailer to use this extension. Additional fees apply. If you would like to set up an account, please contact the sales department here: https:\u002F\u002Fwww.lendingworks.co.uk\u002Fretail-finance\u002Fcontact-sales. For pricing information, please visit our pricing page.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Features\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Adds a new payment method, Lending Works Retail Finance, to your checkout\u003C\u002Fli>\n\u003Cli>Stores Lending Works order data against the order in the WordPress database\u003C\u002Fli>\n\u003Cli>Adds the ability to manually mark the order as fulfilled from the administration area\u003C\u002Fli>\n\u003Cli>Adds minimum and maximum purchase values for using Retail Finance\u003C\u002Fli>\n\u003Cli>Allows for use of a development\u002Ftesting environment\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Security Features\u003C\u002Fp>\n\u003Cp>During the finance application, data entered into the checkout is collected and sent as an API request to the secure Lending Works servers, authenticated by an order token generated based on the API key entered by the retailer. You can read more about Lending Works\\’ security practices here: \u003Ca href=\"https:\u002F\u002Fpartner-support.lendingworks.co.uk\u002Fhc\u002Fen-us\u002Farticles\u002F360007116612-Data-security-at-Lending-Works\" rel=\"nofollow ugc\">https:\u002F\u002Fpartner-support.lendingworks.co.uk\u002Fhc\u002Fen-us\u002Farticles\u002F360007116612-Data-security-at-Lending-Works\u003C\u002Fa>\u003C\u002Fp>\n","Integrates Lending Works\\' Retail Finance checkout into your WooCommerce shop - for approved retailers, let your customers apply for finance quic …",10,1650,"2019-08-16T16:20:00.000Z","5.2.24","4.4",[71,72],"lending-works","lendingworks","https:\u002F\u002Fgithub.com\u002Flendingworks\u002Fwoocommerce-retail-finance","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Flendingworks-retail-finance.1.0.1.zip","2026-03-15T15:16:48.613Z",{"attackSurface":77,"codeSignals":212,"taintFlows":633,"riskAssessment":688,"analyzedAt":696},{"hooks":78,"ajaxHandlers":208,"restRoutes":209,"shortcodes":210,"cronEvents":211,"entryPointCount":11,"unprotectedCount":11},[79,85,89,94,98,102,105,109,112,116,120,123,127,131,134,138,142,146,150,152,156,160,164,168,172,176,180,182,186,190,192,196,198,200,202,204,206],{"type":80,"name":81,"callback":82,"file":83,"line":84},"action","manage_lendingq_hold_posts_columns","setup_hold_post_columns","lendingq.php",64,{"type":80,"name":86,"callback":87,"priority":65,"file":83,"line":88},"manage_lendingq_hold_posts_custom_column","setup_hold_post_column_values",65,{"type":90,"name":91,"callback":92,"file":83,"line":93},"filter","manage_edit-lendingq_hold_sortable_columns","register_hold_sortable_columns",66,{"type":80,"name":95,"callback":96,"file":83,"line":97},"manage_lendingq_stock_posts_columns","setup_stock_post_columns",68,{"type":80,"name":99,"callback":100,"priority":65,"file":83,"line":101},"manage_lendingq_stock_posts_custom_column","setup_stock_post_column_values",69,{"type":90,"name":103,"callback":104,"file":83,"line":43},"manage_edit-lendingq_stock_sortable_columns","register_hold_sortable_columns_stock",{"type":90,"name":106,"callback":107,"priority":65,"file":83,"line":108},"post_row_actions","disable_quick_edit",72,{"type":80,"name":110,"callback":111,"file":83,"line":32},"admin_init","custom_settings",{"type":80,"name":113,"callback":114,"file":83,"line":115},"init","post_setup_custom",76,{"type":80,"name":117,"callback":118,"file":83,"line":119},"pre_get_posts","waiting_list_orderby",77,{"type":80,"name":113,"callback":121,"file":83,"line":122},"check_item_statuses",81,{"type":80,"name":124,"callback":125,"file":83,"line":126},"admin_menu","admin_menu_add_pages",83,{"type":80,"name":128,"callback":129,"file":83,"line":130},"wp_enqueue_scripts","lendingq_script_enqueuer",86,{"type":80,"name":132,"callback":129,"file":83,"line":133},"admin_enqueue_scripts",87,{"type":80,"name":135,"callback":136,"file":83,"line":137},"add_meta_boxes","meta_box_add",89,{"type":90,"name":139,"callback":140,"file":83,"line":141},"post_updated_messages","setup_post_updated_messages",91,{"type":80,"name":143,"callback":144,"file":83,"line":145},"restrict_manage_posts","add_taxonomy_filters",93,{"type":90,"name":147,"callback":148,"file":83,"line":149},"bulk_actions-edit-lendingq_stock","return_bulk_array",95,{"type":90,"name":151,"callback":148,"file":83,"line":45},"bulk_actions-edit-lendingq_hold",{"type":80,"name":153,"callback":154,"priority":65,"file":83,"line":155},"pre_post_update","handle_post_date",97,{"type":90,"name":157,"callback":158,"priority":65,"file":83,"line":159},"save_post_lendingq_hold","handle_post_check_hold",99,{"type":90,"name":161,"callback":162,"priority":65,"file":83,"line":163},"save_post_lendingq_stock","handle_post_check_stock",100,{"type":80,"name":165,"callback":166,"file":83,"line":167},"admin_post_lendingq_checkout","handle_checkout",102,{"type":80,"name":169,"callback":170,"file":83,"line":171},"admin_post_lendingq_checkin","handle_check_in",103,{"type":80,"name":173,"callback":174,"file":83,"line":175},"admin_post_lendingq_contacted","handle_contacted",104,{"type":80,"name":177,"callback":178,"file":83,"line":179},"admin_post_lendingq_cancel_hold","handle_cancel_hold",105,{"type":80,"name":157,"callback":121,"file":83,"line":181},106,{"type":90,"name":183,"callback":184,"file":83,"line":185},"custom_menu_order","change_hold_submenu_order",107,{"type":80,"name":187,"callback":188,"file":83,"line":189},"plugins_loaded","lendingq_load_plugin_textdomain",108,{"type":80,"name":165,"callback":166,"priority":65,"file":83,"line":191},1262,{"type":80,"name":193,"callback":194,"file":83,"line":195},"redirect_post_location","closure",1557,{"type":80,"name":157,"callback":158,"priority":65,"file":83,"line":197},1564,{"type":80,"name":193,"callback":194,"file":83,"line":199},1569,{"type":80,"name":157,"callback":158,"priority":65,"file":83,"line":201},1577,{"type":80,"name":193,"callback":194,"file":83,"line":203},1675,{"type":80,"name":193,"callback":194,"file":83,"line":205},1681,{"type":80,"name":161,"callback":162,"priority":65,"file":83,"line":207},1689,[],[],[],[],{"dangerousFunctions":213,"sqlUsage":214,"outputEscaping":216,"fileOperations":11,"externalRequests":11,"nonceChecks":630,"capabilityChecks":631,"bundledLibraries":632},[],{"prepared":11,"raw":11,"locations":215},[],{"escaped":217,"rawEcho":218,"locations":219},44,240,[220,223,225,227,229,231,233,235,237,239,241,243,245,247,249,251,253,255,257,259,261,263,265,267,269,271,273,275,277,279,281,283,285,287,289,291,293,295,297,299,301,303,305,307,309,311,313,315,317,319,321,323,325,327,329,331,333,335,337,339,341,343,345,347,349,351,353,355,357,359,361,363,365,367,369,371,373,375,377,378,380,381,382,383,385,386,387,389,391,393,395,397,399,402,404,406,408,410,412,414,416,418,420,423,425,427,428,429,430,431,433,434,435,436,438,440,442,444,446,448,450,452,454,456,458,460,462,464,466,468,471,472,473,474,476,477,478,480,481,482,483,484,485,486,487,488,490,492,493,494,495,496,498,499,500,502,504,506,508,510,512,514,515,516,517,519,521,522,523,525,526,528,529,530,531,532,534,536,538,540,542,544,547,549,551,553,554,555,556,557,558,559,561,562,564,566,567,569,570,572,574,576,577,578,579,581,583,585,586,588,589,591,593,595,597,599,601,603,605,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,623,625,626,627,628,629],{"file":83,"line":221,"context":222},283,"raw output",{"file":83,"line":224,"context":222},284,{"file":83,"line":226,"context":222},288,{"file":83,"line":228,"context":222},361,{"file":83,"line":230,"context":222},365,{"file":83,"line":232,"context":222},369,{"file":83,"line":234,"context":222},373,{"file":83,"line":236,"context":222},377,{"file":83,"line":238,"context":222},381,{"file":83,"line":240,"context":222},385,{"file":83,"line":242,"context":222},389,{"file":83,"line":244,"context":222},407,{"file":83,"line":246,"context":222},411,{"file":83,"line":248,"context":222},415,{"file":83,"line":250,"context":222},419,{"file":83,"line":252,"context":222},423,{"file":83,"line":254,"context":222},427,{"file":83,"line":256,"context":222},431,{"file":83,"line":258,"context":222},435,{"file":83,"line":260,"context":222},439,{"file":83,"line":262,"context":222},443,{"file":83,"line":264,"context":222},447,{"file":83,"line":266,"context":222},451,{"file":83,"line":268,"context":222},455,{"file":83,"line":270,"context":222},459,{"file":83,"line":272,"context":222},463,{"file":83,"line":274,"context":222},467,{"file":83,"line":276,"context":222},471,{"file":83,"line":278,"context":222},475,{"file":83,"line":280,"context":222},479,{"file":83,"line":282,"context":222},483,{"file":83,"line":284,"context":222},487,{"file":83,"line":286,"context":222},491,{"file":83,"line":288,"context":222},495,{"file":83,"line":290,"context":222},499,{"file":83,"line":292,"context":222},503,{"file":83,"line":294,"context":222},1712,{"file":83,"line":296,"context":222},1717,{"file":83,"line":298,"context":222},1736,{"file":83,"line":300,"context":222},1741,{"file":83,"line":302,"context":222},1769,{"file":83,"line":304,"context":222},1774,{"file":83,"line":306,"context":222},1780,{"file":83,"line":308,"context":222},1797,{"file":83,"line":310,"context":222},1803,{"file":83,"line":312,"context":222},1835,{"file":83,"line":314,"context":222},1840,{"file":83,"line":316,"context":222},1877,{"file":83,"line":318,"context":222},1882,{"file":83,"line":320,"context":222},2351,{"file":83,"line":322,"context":222},2355,{"file":83,"line":324,"context":222},2374,{"file":83,"line":326,"context":222},2385,{"file":83,"line":328,"context":222},2389,{"file":83,"line":330,"context":222},2394,{"file":83,"line":332,"context":222},2400,{"file":83,"line":334,"context":222},2437,{"file":83,"line":336,"context":222},2440,{"file":83,"line":338,"context":222},2443,{"file":83,"line":340,"context":222},2446,{"file":83,"line":342,"context":222},2449,{"file":83,"line":344,"context":222},2452,{"file":83,"line":346,"context":222},2455,{"file":83,"line":348,"context":222},2458,{"file":350,"line":46,"context":222},"template_cancel_hold_form.php",{"file":350,"line":352,"context":222},9,{"file":350,"line":354,"context":222},13,{"file":350,"line":356,"context":222},17,{"file":350,"line":358,"context":222},23,{"file":350,"line":360,"context":222},25,{"file":350,"line":362,"context":222},29,{"file":350,"line":364,"context":222},31,{"file":350,"line":366,"context":222},42,{"file":350,"line":368,"context":222},46,{"file":350,"line":370,"context":222},50,{"file":350,"line":372,"context":222},54,{"file":350,"line":374,"context":222},58,{"file":350,"line":376,"context":222},61,{"file":350,"line":88,"context":222},{"file":379,"line":46,"context":222},"template_cancel_stock_form.php",{"file":379,"line":352,"context":222},{"file":379,"line":354,"context":222},{"file":379,"line":356,"context":222},{"file":379,"line":384,"context":222},21,{"file":379,"line":360,"context":222},{"file":379,"line":362,"context":222},{"file":379,"line":388,"context":222},33,{"file":379,"line":390,"context":222},37,{"file":379,"line":392,"context":222},41,{"file":379,"line":394,"context":222},45,{"file":379,"line":396,"context":222},48,{"file":379,"line":398,"context":222},52,{"file":400,"line":401,"context":222},"template_cancel_stock_form_checked_out.php",8,{"file":400,"line":403,"context":222},12,{"file":400,"line":405,"context":222},16,{"file":400,"line":407,"context":222},20,{"file":400,"line":409,"context":222},24,{"file":400,"line":411,"context":222},28,{"file":400,"line":413,"context":222},32,{"file":400,"line":415,"context":222},36,{"file":400,"line":417,"context":222},40,{"file":400,"line":419,"context":222},47,{"file":421,"line":422,"context":222},"template_check_in_form.php",27,{"file":421,"line":424,"context":222},51,{"file":421,"line":426,"context":222},57,{"file":421,"line":376,"context":222},{"file":421,"line":88,"context":222},{"file":421,"line":93,"context":222},{"file":421,"line":119,"context":222},{"file":421,"line":432,"context":222},80,{"file":421,"line":45,"context":222},{"file":421,"line":159,"context":222},{"file":421,"line":189,"context":222},{"file":421,"line":437,"context":222},113,{"file":421,"line":439,"context":222},116,{"file":421,"line":441,"context":222},125,{"file":421,"line":443,"context":222},129,{"file":421,"line":445,"context":222},133,{"file":421,"line":447,"context":222},137,{"file":421,"line":449,"context":222},141,{"file":421,"line":451,"context":222},145,{"file":421,"line":453,"context":222},149,{"file":421,"line":455,"context":222},159,{"file":421,"line":457,"context":222},163,{"file":421,"line":459,"context":222},167,{"file":421,"line":461,"context":222},171,{"file":421,"line":463,"context":222},175,{"file":421,"line":465,"context":222},179,{"file":421,"line":467,"context":222},183,{"file":469,"line":470,"context":222},"template_check_in_list.php",19,{"file":469,"line":366,"context":222},{"file":469,"line":432,"context":222},{"file":469,"line":122,"context":222},{"file":469,"line":475,"context":222},82,{"file":469,"line":126,"context":222},{"file":469,"line":22,"context":222},{"file":479,"line":46,"context":222},"template_check_out_form.php",{"file":479,"line":352,"context":222},{"file":479,"line":354,"context":222},{"file":479,"line":356,"context":222},{"file":479,"line":384,"context":222},{"file":479,"line":360,"context":222},{"file":479,"line":362,"context":222},{"file":479,"line":388,"context":222},{"file":479,"line":394,"context":222},{"file":479,"line":489,"context":222},49,{"file":479,"line":491,"context":222},53,{"file":479,"line":133,"context":222},{"file":479,"line":141,"context":222},{"file":479,"line":159,"context":222},{"file":479,"line":167,"context":222},{"file":497,"line":366,"context":222},"template_check_out_list.php",{"file":497,"line":372,"context":222},{"file":497,"line":475,"context":222},{"file":497,"line":501,"context":222},94,{"file":497,"line":503,"context":222},164,{"file":497,"line":505,"context":222},165,{"file":497,"line":507,"context":222},166,{"file":497,"line":509,"context":222},168,{"file":511,"line":352,"context":222},"template_contact_hold_form.php",{"file":511,"line":513,"context":222},14,{"file":511,"line":362,"context":222},{"file":511,"line":417,"context":222},{"file":511,"line":370,"context":222},{"file":511,"line":518,"context":222},56,{"file":511,"line":520,"context":222},59,{"file":511,"line":88,"context":222},{"file":511,"line":31,"context":222},{"file":511,"line":524,"context":222},73,{"file":511,"line":119,"context":222},{"file":511,"line":527,"context":222},79,{"file":511,"line":141,"context":222},{"file":511,"line":501,"context":222},{"file":511,"line":163,"context":222},{"file":511,"line":171,"context":222},{"file":511,"line":533,"context":222},109,{"file":511,"line":535,"context":222},115,{"file":511,"line":537,"context":222},121,{"file":511,"line":539,"context":222},127,{"file":511,"line":541,"context":222},136,{"file":511,"line":543,"context":222},139,{"file":545,"line":546,"context":222},"template_no_item_types.php",7,{"file":548,"line":546,"context":222},"template_no_locations.php",{"file":550,"line":546,"context":222},"template_no_stock.php",{"file":552,"line":424,"context":222},"template_post_hold.php",{"file":552,"line":518,"context":222},{"file":552,"line":524,"context":222},{"file":552,"line":122,"context":222},{"file":552,"line":137,"context":222},{"file":552,"line":155,"context":222},{"file":552,"line":189,"context":222},{"file":552,"line":560,"context":222},117,{"file":552,"line":539,"context":222},{"file":552,"line":563,"context":222},130,{"file":552,"line":565,"context":222},131,{"file":552,"line":447,"context":222},{"file":552,"line":568,"context":222},140,{"file":552,"line":449,"context":222},{"file":552,"line":571,"context":222},147,{"file":552,"line":573,"context":222},156,{"file":552,"line":575,"context":222},157,{"file":552,"line":457,"context":222},{"file":552,"line":507,"context":222},{"file":552,"line":459,"context":222},{"file":552,"line":580,"context":222},173,{"file":552,"line":582,"context":222},176,{"file":552,"line":584,"context":222},177,{"file":552,"line":467,"context":222},{"file":552,"line":587,"context":222},196,{"file":552,"line":587,"context":222},{"file":552,"line":590,"context":222},197,{"file":552,"line":592,"context":222},203,{"file":552,"line":594,"context":222},206,{"file":552,"line":596,"context":222},207,{"file":552,"line":598,"context":222},213,{"file":552,"line":600,"context":222},216,{"file":552,"line":602,"context":222},217,{"file":552,"line":604,"context":222},229,{"file":606,"line":470,"context":222},"template_post_item.php",{"file":606,"line":390,"context":222},{"file":606,"line":394,"context":222},{"file":606,"line":491,"context":222},{"file":606,"line":32,"context":222},{"file":606,"line":126,"context":222},{"file":606,"line":130,"context":222},{"file":606,"line":133,"context":222},{"file":606,"line":45,"context":222},{"file":606,"line":171,"context":222},{"file":606,"line":181,"context":222},{"file":606,"line":185,"context":222},{"file":606,"line":437,"context":222},{"file":606,"line":439,"context":222},{"file":606,"line":560,"context":222},{"file":606,"line":622,"context":222},123,{"file":606,"line":624,"context":222},126,{"file":606,"line":539,"context":222},{"file":606,"line":445,"context":222},{"file":606,"line":541,"context":222},{"file":606,"line":447,"context":222},{"file":606,"line":453,"context":222},5,1,[],[634,652,669,678],{"entryPoint":635,"graph":636,"unsanitizedCount":631,"severity":651},"add_taxonomy_filters (lendingq.php:272)",{"nodes":637,"edges":648},[638,643],{"id":639,"type":640,"label":641,"file":83,"line":642},"n0","source","$_GET",286,{"id":644,"type":645,"label":646,"file":83,"line":226,"wp_function":647},"n1","sink","echo() [XSS]","echo",[649],{"from":639,"to":644,"sanitized":650},false,"medium",{"entryPoint":653,"graph":654,"unsanitizedCount":11,"severity":668},"\u003Clendingq> (lendingq.php:0)",{"nodes":655,"edges":664},[656,657,658,662],{"id":639,"type":640,"label":641,"file":83,"line":642},{"id":644,"type":645,"label":646,"file":83,"line":226,"wp_function":647},{"id":659,"type":640,"label":660,"file":83,"line":661},"n2","$_REQUEST (x5)",1876,{"id":663,"type":645,"label":646,"file":83,"line":322,"wp_function":647},"n3",[665,667],{"from":639,"to":644,"sanitized":666},true,{"from":659,"to":663,"sanitized":666},"low",{"entryPoint":670,"graph":671,"unsanitizedCount":631,"severity":668},"\u003Ctemplate_check_in_form> (template_check_in_form.php:0)",{"nodes":672,"edges":676},[673,675],{"id":639,"type":640,"label":674,"file":421,"line":352},"$_REQUEST",{"id":644,"type":645,"label":646,"file":421,"line":426,"wp_function":647},[677],{"from":639,"to":644,"sanitized":650},{"entryPoint":679,"graph":680,"unsanitizedCount":687,"severity":668},"\u003Ctemplate_contact_hold_form> (template_contact_hold_form.php:0)",{"nodes":681,"edges":685},[682,684],{"id":639,"type":640,"label":683,"file":511,"line":437},"$_REQUEST (x2)",{"id":644,"type":645,"label":646,"file":511,"line":535,"wp_function":647},[686],{"from":639,"to":644,"sanitized":650},2,{"summary":689,"deductions":690},"The \"lendingq\" v1.0 plugin exhibits a mixed security posture. On one hand, the static analysis reveals a small attack surface with no reported AJAX handlers, REST API routes, shortcodes, or cron events that are directly exposed and unprotected. The plugin also demonstrates good practices by using prepared statements for all SQL queries and performing file operations. Furthermore, there are no known vulnerabilities (CVEs) associated with this plugin, suggesting a generally stable history.\n\nHowever, significant concerns arise from the taint analysis and output escaping. The presence of 3 flows with unsanitized paths, even without critical or high severity, indicates potential vulnerabilities that could be exploited if an attacker can control the input leading to these paths. The low percentage of properly escaped output (15%) is a major red flag, suggesting a high risk of Cross-Site Scripting (XSS) vulnerabilities across the plugin's outputs. While nonce checks and capability checks are present, the limited number and the unescaped outputs overshadow these positive aspects.\n\nIn conclusion, \"lendingq\" v1.0 has strengths in its minimal attack surface and SQL handling, and a clean vulnerability history. Nevertheless, the identified unsanitized paths in taint analysis and the alarmingly low rate of proper output escaping represent substantial security weaknesses that require immediate attention to prevent potential XSS and other data manipulation attacks.",[691,693],{"reason":692,"points":65},"Unsanitized paths in taint analysis",{"reason":694,"points":695},"Low percentage of properly escaped output",15,"2026-04-16T13:26:08.347Z",{"wat":698,"direct":711},{"assetPaths":699,"generatorPatterns":704,"scriptPaths":705,"versionParams":706},[700,701,702,703],"\u002Fwp-content\u002Fplugins\u002Flendingq\u002Flendingq-admin.css","\u002Fwp-content\u002Fplugins\u002Flendingq\u002Flendingq-admin.js","\u002Fwp-content\u002Fplugins\u002Flendingq\u002Flendingq-frontend.css","\u002Fwp-content\u002Fplugins\u002Flendingq\u002Flendingq-frontend.js",[],[701,703],[707,708,709,710],"lendingq\u002Flendingq-admin.css?ver=","lendingq\u002Flendingq-admin.js?ver=","lendingq\u002Flendingq-frontend.css?ver=","lendingq\u002Flendingq-frontend.js?ver=",{"cssClasses":712,"htmlComments":715,"htmlAttributes":719,"restEndpoints":721,"jsGlobals":722,"shortcodeOutput":727},[713,714],"lendingq-hold-form","lendingq-stock-form",[716,717,718],"\u003C!-- lendingq_post_message -->","\u003C!-- lendingq_old_date -->","\u003C!-- NOTE: These are constants defined as required by the LendingQ plugin. Do not modify these values. -->",[720],"data-lendingq-item-id",[],[723,724,725,726],"lendingq_checkout_nonce","lendingq_checkin_nonce","lendingq_contacted_nonce","lendingq_cancel_hold_nonce",[],{"error":666,"url":729,"statusCode":730,"statusMessage":731,"message":731},"http:\u002F\u002Flocalhost\u002Fapi\u002Fplugins\u002Flendingq\u002Fbundle",404,"no bundle for this plugin yet",{"slug":4,"current_version":6,"total_versions":65,"versions":733},[734,740,747,754,761,768,775,782,789,796],{"version":6,"download_url":735,"svn_tag_url":736,"released_at":23,"has_diff":650,"diff_files_changed":737,"diff_lines":23,"trac_diff_url":738,"vulnerabilities":739,"is_current":666},"https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Flendingq.1.0.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Flendingq\u002Ftags\u002F1.0\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Flendingq%2Ftags%2F0.98&new_path=%2Flendingq%2Ftags%2F1.0",[],{"version":741,"download_url":742,"svn_tag_url":743,"released_at":23,"has_diff":650,"diff_files_changed":744,"diff_lines":23,"trac_diff_url":745,"vulnerabilities":746,"is_current":650},"0.98","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Flendingq.0.98.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Flendingq\u002Ftags\u002F0.98\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Flendingq%2Ftags%2F0.97&new_path=%2Flendingq%2Ftags%2F0.98",[],{"version":748,"download_url":749,"svn_tag_url":750,"released_at":23,"has_diff":650,"diff_files_changed":751,"diff_lines":23,"trac_diff_url":752,"vulnerabilities":753,"is_current":650},"0.97","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Flendingq.0.97.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Flendingq\u002Ftags\u002F0.97\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Flendingq%2Ftags%2F0.96.3&new_path=%2Flendingq%2Ftags%2F0.97",[],{"version":755,"download_url":756,"svn_tag_url":757,"released_at":23,"has_diff":650,"diff_files_changed":758,"diff_lines":23,"trac_diff_url":759,"vulnerabilities":760,"is_current":650},"0.96.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Flendingq.0.96.3.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Flendingq\u002Ftags\u002F0.96.3\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Flendingq%2Ftags%2F0.96.2&new_path=%2Flendingq%2Ftags%2F0.96.3",[],{"version":762,"download_url":763,"svn_tag_url":764,"released_at":23,"has_diff":650,"diff_files_changed":765,"diff_lines":23,"trac_diff_url":766,"vulnerabilities":767,"is_current":650},"0.96.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Flendingq.0.96.2.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Flendingq\u002Ftags\u002F0.96.2\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Flendingq%2Ftags%2F0.96.1&new_path=%2Flendingq%2Ftags%2F0.96.2",[],{"version":769,"download_url":770,"svn_tag_url":771,"released_at":23,"has_diff":650,"diff_files_changed":772,"diff_lines":23,"trac_diff_url":773,"vulnerabilities":774,"is_current":650},"0.96.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Flendingq.0.96.1.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Flendingq\u002Ftags\u002F0.96.1\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Flendingq%2Ftags%2F0.96&new_path=%2Flendingq%2Ftags%2F0.96.1",[],{"version":776,"download_url":777,"svn_tag_url":778,"released_at":23,"has_diff":650,"diff_files_changed":779,"diff_lines":23,"trac_diff_url":780,"vulnerabilities":781,"is_current":650},"0.96","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Flendingq.0.96.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Flendingq\u002Ftags\u002F0.96\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Flendingq%2Ftags%2F0.95.1&new_path=%2Flendingq%2Ftags%2F0.96",[],{"version":783,"download_url":784,"svn_tag_url":785,"released_at":23,"has_diff":650,"diff_files_changed":786,"diff_lines":23,"trac_diff_url":787,"vulnerabilities":788,"is_current":650},"0.95.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Flendingq.0.95.1.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Flendingq\u002Ftags\u002F0.95.1\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Flendingq%2Ftags%2F0.95&new_path=%2Flendingq%2Ftags%2F0.95.1",[],{"version":790,"download_url":791,"svn_tag_url":792,"released_at":23,"has_diff":650,"diff_files_changed":793,"diff_lines":23,"trac_diff_url":794,"vulnerabilities":795,"is_current":650},"0.95","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Flendingq.0.95.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Flendingq\u002Ftags\u002F0.95\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Flendingq%2Ftags%2F0.94&new_path=%2Flendingq%2Ftags%2F0.95",[],{"version":797,"download_url":798,"svn_tag_url":799,"released_at":23,"has_diff":650,"diff_files_changed":800,"diff_lines":23,"trac_diff_url":23,"vulnerabilities":801,"is_current":650},"0.94","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Flendingq.0.94.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Flendingq\u002Ftags\u002F0.94\u002F",[],[]]