JPlayer Podcast Widget Security & Risk Analysis

wordpress.org/plugins/podcast-player-widget

Widget that use jPlayer to play Podcast RSS playlists, no BS, just drag, set, and works

10 active installs v1.0.3 PHP + WP 3.3.1+ Updated May 25, 2016
audiojplayermusic-playerpodcast
85
A · Safe
CVEs total0
Unpatched0
Last CVENever
Safety Verdict

Is JPlayer Podcast Widget Safe to Use in 2026?

Generally Safe

Score 85/100

JPlayer Podcast Widget has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs Updated 9yr ago
Risk Assessment

The plugin "podcast-player-widget" v1.0.3 exhibits a mixed security posture. While it impressively boasts zero known CVEs, a completely clean vulnerability history, and appears to have no direct entry points like AJAX handlers, REST API routes, or shortcodes, significant concerns arise from its code signals. The presence of the `create_function` dangerous function is a notable red flag, as it can lead to arbitrary code execution if used with user-supplied input. Furthermore, 100% of the plugin's output is not properly escaped, indicating a high risk of Cross-Site Scripting (XSS) vulnerabilities. These unescaped outputs are a critical weakness, as any dynamic content rendered by the plugin could be exploited to inject malicious scripts.

Key Concerns

  • Dangerous function used (create_function)
  • No output escaping
Vulnerabilities
None known

JPlayer Podcast Widget Security Vulnerabilities

No known vulnerabilities — this is a good sign.
Code Analysis
Analyzed Mar 16, 2026

JPlayer Podcast Widget Code Analysis

Dangerous Functions
1
Raw SQL Queries
0
0 prepared
Unescaped Output
27
0 escaped
Nonce Checks
0
Capability Checks
0
File Operations
0
External Requests
0
Bundled Libraries
0

Dangerous Functions Found

create_functionadd_action('widgets_init', create_function('', 'register_widget("JPlayer_Podcast");'));plugin.php:292

Output Escaping

0% escaped27 total outputs
Attack Surface

JPlayer Podcast Widget Attack Surface

Entry Points0
Unprotected0
WordPress Hooks 9
actioninitplugin.php:62
actionadmin_print_stylesplugin.php:78
actionadmin_enqueue_scriptsplugin.php:79
actionwp_enqueue_scriptsplugin.php:82
actionwp_enqueue_scriptsplugin.php:83
actionsave_postplugin.php:86
actiondeleted_postplugin.php:87
actionswitch_themeplugin.php:88
actionwidgets_initplugin.php:292
Maintenance & Trust

JPlayer Podcast Widget Maintenance & Trust

Maintenance Signals

WordPress version tested4.5.33
Last updatedMay 25, 2016
PHP min version
Downloads3K

Community Trust

Rating0/100
Number of ratings0
Active installs10
Developer Profile

JPlayer Podcast Widget Developer Profile

Freeman Man

3 plugins · 40 total installs

84
trust score
Avg Security Score
85/100
Avg Patch Time
30 days
View full developer profile
Detection Fingerprints

How We Detect JPlayer Podcast Widget

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/podcast-player-widget/css/admin.css/wp-content/plugins/podcast-player-widget/js/admin.js/wp-content/plugins/podcast-player-widget/js/jplayer/jquery.jplayer.min.js/wp-content/plugins/podcast-player-widget/js/jplayer/jplayer.playlist.min.js/wp-content/plugins/podcast-player-widget/js/widget.js
Script Paths
/wp-content/plugins/podcast-player-widget/js/admin.js/wp-content/plugins/podcast-player-widget/js/jplayer/jquery.jplayer.min.js/wp-content/plugins/podcast-player-widget/js/jplayer/jplayer.playlist.min.js/wp-content/plugins/podcast-player-widget/js/widget.js
Version Parameters
podcast-player-widget/css/admin.css?ver=podcast-player-widget/js/admin.js?ver=podcast-player-widget/js/jplayer/jquery.jplayer.min.js?ver=podcast-player-widget/js/jplayer/jplayer.playlist.min.js?ver=podcast-player-widget/js/widget.js?ver=

HTML / DOM Fingerprints

CSS Classes
jplayer-podcast-class
JS Globals
jplayerPodcastWidget
FAQ

Frequently Asked Questions about JPlayer Podcast Widget