[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEkCxiEtdRiULrkY25JyVrQ9JdBK1Zlwk4d47wG8PMIM":3,"$fLZX-Kuy8vD8TAcqKUJIRa3g1plkVaWb9PdVoTLpbxoo":180,"$fsI7Za3URDCT4fkaLqCH9RmGWL2GgS0Ie7RbvRAUiTV0":185},{"slug":4,"name":5,"version":6,"author":7,"author_profile":8,"description":9,"short_description":10,"active_installs":11,"downloaded":12,"rating":13,"num_ratings":14,"last_updated":15,"tested_up_to":16,"requires_at_least":17,"requires_php":18,"tags":19,"homepage":25,"download_link":26,"security_score":27,"vuln_count":28,"unpatched_count":28,"last_vuln_date":29,"fetched_at":30,"discovery_status":31,"vulnerabilities":32,"developer":33,"crawl_stats":29,"alternatives":37,"analysis":136,"fingerprints":166},"rest-gutenberg","REST Gutenberg","1.0","scottfoster","https:\u002F\u002Fprofiles.wordpress.org\u002Fscottfoster\u002F","\u003Cp>This plugin adds a key within the \u003Ca href=\"https:\u002F\u002Fdeveloper.wordpress.org\u002Frest-api\u002F\" rel=\"nofollow ugc\">WordPress REST API\u003C\u002Fa> to add valid Gutenberg JSON schema.\u003C\u002Fp>\n","Adds a key and gutenberg block schema within the WordPress REST API",20,9684,100,1,"2019-05-05T06:57:00.000Z","5.2.24","5.0","7.0",[20,21,22,23,24],"api","gutenberg","json","rest","wp-api","","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Frest-gutenberg.zip",85,0,null,"2026-07-22T17:31:50.256Z","no_bundle",[],{"slug":7,"display_name":7,"profile_url":8,"plugin_count":14,"total_installs":11,"avg_security_score":27,"avg_patch_time_days":34,"trust_score":35,"computed_at":36},30,84,"2026-08-29T06:24:22.233Z",[38,61,80,99,118],{"slug":39,"name":40,"version":41,"author":42,"author_profile":43,"description":44,"short_description":45,"active_installs":46,"downloaded":47,"rating":48,"num_ratings":49,"last_updated":50,"tested_up_to":51,"requires_at_least":52,"requires_php":53,"tags":54,"homepage":59,"download_link":60,"security_score":13,"vuln_count":28,"unpatched_count":28,"last_vuln_date":29,"fetched_at":30},"jwt-authentication-for-wp-rest-api","JWT Authentication for WP REST API","1.5.0","tmeister","https:\u002F\u002Fprofiles.wordpress.org\u002Ftmeister\u002F","\u003Cp>This plugin seamlessly extends the WP REST API, enabling robust and secure authentication using JSON Web Tokens (JWT). It provides a straightforward way to authenticate users via the REST API, returning a standard JWT upon successful login.\u003C\u002Fp>\n\u003Ch3>Key features of this free version include:\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Standard JWT Authentication:\u003C\u002Fstrong> Implements the industry-standard \u003Ca href=\"https:\u002F\u002Ftools.ietf.org\u002Fhtml\u002Frfc7519\" rel=\"nofollow ugc\">RFC 7519\u003C\u002Fa> for secure claims representation.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Simple Endpoints:\u003C\u002Fstrong> Offers clear \u003Ccode>\u002Ftoken\u003C\u002Fcode> and \u003Ccode>\u002Ftoken\u002Fvalidate\u003C\u002Fcode> endpoints for generating and validating tokens.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Configurable Secret Key:\u003C\u002Fstrong> Define your unique secret key via \u003Ccode>wp-config.php\u003C\u002Fcode> for secure token signing.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Optional CORS Support:\u003C\u002Fstrong> Easily enable Cross-Origin Resource Sharing support via a \u003Ccode>wp-config.php\u003C\u002Fcode> constant.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Developer Hooks:\u003C\u002Fstrong> Provides filters (\u003Ccode>jwt_auth_expire\u003C\u002Fcode>, \u003Ccode>jwt_auth_token_before_sign\u003C\u002Fcode>, etc.) for customizing token behavior.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>JSON Web Tokens are an open, industry standard method for representing claims securely between two parties.\u003C\u002Fp>\n\u003Cp>For users requiring more advanced capabilities such as multiple signing algorithms (RS256, ES256), token refresh\u002Frevocation, UI-based configuration, or priority support, consider checking out \u003Cstrong>\u003Ca href=\"https:\u002F\u002Fjwtauth.pro\u002F?utm_source=wp_plugin_readme&utm_medium=link&utm_campaign=pro_promotion&utm_content=description_link_soft\" rel=\"nofollow ugc\">JWT Authentication PRO\u003C\u002Fa>\u003C\u002Fstrong>.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Support and Requests:\u003C\u002Fstrong> Please use \u003Ca href=\"https:\u002F\u002Fgithub.com\u002FTmeister\u002Fwp-api-jwt-auth\u002Fissues\" rel=\"nofollow ugc\">GitHub Issues\u003C\u002Fa>. For priority support, consider upgrading to \u003Ca href=\"https:\u002F\u002Fjwtauth.pro\u002F?utm_source=wp_plugin_readme&utm_medium=link&utm_campaign=pro_promotion&utm_content=description_support_link\" rel=\"nofollow ugc\">PRO\u003C\u002Fa>.\u003C\u002Fp>\n\u003Ch3>REQUIREMENTS\u003C\u002Fh3>\n\u003Ch4>WP REST API V2\u003C\u002Fh4>\n\u003Cp>This plugin was conceived to extend the \u003Ca href=\"https:\u002F\u002Fgithub.com\u002FWP-API\u002FWP-API\" rel=\"nofollow ugc\">WP REST API V2\u003C\u002Fa> plugin features and, of course, was built on top of it.\u003C\u002Fp>\n\u003Cp>So, to use the \u003Cstrong>wp-api-jwt-auth\u003C\u002Fstrong> you need to install and activate \u003Ca href=\"https:\u002F\u002Fgithub.com\u002FWP-API\u002FWP-API\" rel=\"nofollow ugc\">WP REST API\u003C\u002Fa>.\u003C\u002Fp>\n\u003Ch3>PHP\u003C\u002Fh3>\n\u003Cp>\u003Cstrong>Minimum PHP version: 7.4.0\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Ch3>PHP HTTP Authorization Header Enable\u003C\u002Fh3>\n\u003Cp>Most shared hosting providers have disabled the \u003Cstrong>HTTP Authorization Header\u003C\u002Fstrong> by default.\u003C\u002Fp>\n\u003Cp>To enable this option you’ll need to edit your \u003Cstrong>.htaccess\u003C\u002Fstrong> file by adding the following:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>RewriteEngine on\nRewriteCond %{HTTP:Authorization} ^(.*)\nRewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>WPENGINE\u003C\u002Fh4>\n\u003Cp>For WPEngine hosting, you’ll need to edit your \u003Cstrong>.htaccess\u003C\u002Fstrong> file by adding the following:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>SetEnvIf Authorization \"(.*)\" HTTP_AUTHORIZATION=$1\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>See https:\u002F\u002Fgithub.com\u002FTmeister\u002Fwp-api-jwt-auth\u002Fissues\u002F1 for more details.\u003C\u002Fp>\n\u003Ch3>CONFIGURATION\u003C\u002Fh3>\n\u003Ch3>Configure the Secret Key\u003C\u002Fh3>\n\u003Cp>The JWT needs a \u003Cstrong>secret key\u003C\u002Fstrong> to sign the token. This \u003Cstrong>secret key\u003C\u002Fstrong> must be unique and never revealed.\u003C\u002Fp>\n\u003Cp>To add the \u003Cstrong>secret key\u003C\u002Fstrong>, edit your wp-config.php file and add a new constant called \u003Cstrong>JWT_AUTH_SECRET_KEY\u003C\u002Fstrong>:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>define('JWT_AUTH_SECRET_KEY', 'your-top-secret-key');\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>You can generate a secure key from: https:\u002F\u002Fapi.wordpress.org\u002Fsecret-key\u002F1.1\u002Fsalt\u002F\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Looking for easier configuration?\u003C\u002Fstrong> \u003Ca href=\"https:\u002F\u002Fjwtauth.pro\u002F?utm_source=wp_plugin_readme&utm_medium=link&utm_campaign=pro_promotion&utm_content=config_secret_key_link\" rel=\"nofollow ugc\">JWT Authentication PRO\u003C\u002Fa> allows you to manage all settings through a simple admin UI.\u003C\u002Fp>\n\u003Ch3>Configure CORS Support\u003C\u002Fh3>\n\u003Cp>The \u003Cstrong>wp-api-jwt-auth\u003C\u002Fstrong> plugin has the option to activate \u003Ca href=\"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FCross-origin_resource_sharing\" rel=\"nofollow ugc\">CORS\u003C\u002Fa> support.\u003C\u002Fp>\n\u003Cp>To enable CORS Support, edit your wp-config.php file and add a new constant called \u003Cstrong>JWT_AUTH_CORS_ENABLE\u003C\u002Fstrong>:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>define('JWT_AUTH_CORS_ENABLE', true);\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Finally, activate the plugin within your wp-admin.\u003C\u002Fp>\n\u003Ch3>Namespace and Endpoints\u003C\u002Fh3>\n\u003Cp>When the plugin is activated, a new namespace is added:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>\u002Fjwt-auth\u002Fv1\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Also, two new endpoints are added to this namespace:\u003C\u002Fp>\n\u003Cp>Endpoint | HTTP Verb\u003Cbr \u002F>\n\u003Cem>\u002Fwp-json\u002Fjwt-auth\u002Fv1\u002Ftoken\u003C\u002Fem> | POST\u003Cbr \u002F>\n\u003Cem>\u002Fwp-json\u002Fjwt-auth\u002Fv1\u002Ftoken\u002Fvalidate\u003C\u002Fem> | POST\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Need more functionality?\u003C\u002Fstrong> \u003Ca href=\"https:\u002F\u002Fjwtauth.pro\u002F?utm_source=wp_plugin_readme&utm_medium=link&utm_campaign=pro_promotion&utm_content=endpoints_pro_note\" rel=\"nofollow ugc\">JWT Authentication PRO\u003C\u002Fa> includes additional endpoints for token refresh and revocation.\u003C\u002Fp>\n\u003Ch3>USAGE\u003C\u002Fh3>\n\u003Ch4>\u002Fwp-json\u002Fjwt-auth\u002Fv1\u002Ftoken\u003C\u002Fh4>\n\u003Cp>This is the entry point for JWT Authentication.\u003C\u002Fp>\n\u003Cp>It validates the user credentials, \u003Cem>username\u003C\u002Fem> and \u003Cem>password\u003C\u002Fem>, and returns a token to use in future requests to the API if the authentication is correct, or an error if authentication fails.\u003C\u002Fp>\n\u003Cp>Sample Request Using AngularJS\u003C\u002Fp>\n\u003Cpre>\u003Ccode>(function() {\n  var app = angular.module('jwtAuth', []);\n\n  app.controller('MainController', function($scope, $http) {\n    var apiHost = 'http:\u002F\u002Fyourdomain.com\u002Fwp-json';\n\n    $http.post(apiHost + '\u002Fjwt-auth\u002Fv1\u002Ftoken', {\n      username: 'admin',\n      password: 'password'\n    })\n    .then(function(response) {\n      console.log(response.data)\n    })\n    .catch(function(error) {\n      console.error('Error', error.data[0]);\n    });\n  });\n})();\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Success Response From The Server\u003C\u002Fp>\n\u003Cpre>\u003Ccode>{\n  \"token\": \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwOlwvXC9qd3QuZGV2IiwiaWF0IjoxNDM4NTcxMDUwLCJuYmYiOjE0Mzg1NzEwNTAsImV4cCI6MTQzOTE3NTg1MCwiZGF0YSI6eyJ1c2VyIjp7ImlkIjoiMSJ9fX0.YNe6AyWW4B7ZwfFE5wJ0O6qQ8QFcYizimDmBy6hCH_8\",\n  \"user_display_name\": \"admin\",\n  \"user_email\": \"admin@localhost.dev\",\n  \"user_nicename\": \"admin\"\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Error Response From The Server\u003C\u002Fp>\n\u003Cpre>\u003Ccode>{\n  \"code\": \"jwt_auth_failed\",\n  \"data\": {\n    \"status\": 403\n  },\n  \"message\": \"Invalid Credentials.\"\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Once you get the token, you must store it somewhere in your application, e.g., in a \u003Cstrong>cookie\u003C\u002Fstrong> or using \u003Cstrong>localStorage\u003C\u002Fstrong>.\u003C\u002Fp>\n\u003Cp>From this point, you should pass this token with every API call.\u003C\u002Fp>\n\u003Cp>Sample Call Using The Authorization Header With AngularJS\u003C\u002Fp>\n\u003Cpre>\u003Ccode>app.config(function($httpProvider) {\n  $httpProvider.interceptors.push(['$q', '$location', '$cookies', function($q, $location, $cookies) {\n    return {\n      'request': function(config) {\n        config.headers = config.headers || {};\n        \u002F\u002F Assume that you store the token in a cookie\n        var globals = $cookies.getObject('globals') || {};\n        \u002F\u002F If the cookie has the CurrentUser and the token\n        \u002F\u002F add the Authorization header in each request\n        if (globals.currentUser && globals.currentUser.token) {\n          config.headers.Authorization = 'Bearer ' + globals.currentUser.token;\n        }\n        return config;\n      }\n    };\n  }]);\n});\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>The \u003Cstrong>wp-api-jwt-auth\u003C\u002Fstrong> plugin will intercept every call to the server and will look for the Authorization Header. If the Authorization header is present, it will try to decode the token and will set the user according to the data stored in it.\u003C\u002Fp>\n\u003Cp>If the token is valid, the API call flow will continue as normal.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Sample Headers\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cpre>\u003Ccode>POST \u002Fresource HTTP\u002F1.1\nHost: server.example.com\nAuthorization: Bearer mF_s9.B5f-4.1JqM\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch3>ERRORS\u003C\u002Fh3>\n\u003Cp>If the token is invalid, an error will be returned. Here are some sample errors:\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Invalid Credentials\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cpre>\u003Ccode>[\n  {\n    \"code\": \"jwt_auth_failed\",\n    \"message\": \"Invalid Credentials.\",\n    \"data\": {\n      \"status\": 403\n    }\n  }\n]\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>\u003Cstrong>Invalid Signature\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cpre>\u003Ccode>[\n  {\n    \"code\": \"jwt_auth_invalid_token\",\n    \"message\": \"Signature verification failed\",\n    \"data\": {\n      \"status\": 403\n    }\n  }\n]\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>\u003Cstrong>Expired Token\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cpre>\u003Ccode>[\n  {\n    \"code\": \"jwt_auth_invalid_token\",\n    \"message\": \"Expired token\",\n    \"data\": {\n      \"status\": 403\n    }\n  }\n]\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>\u003Cstrong>Need advanced error tracking?\u003C\u002Fstrong> \u003Ca href=\"https:\u002F\u002Fjwtauth.pro\u002F?utm_source=wp_plugin_readme&utm_medium=link&utm_campaign=pro_promotion&utm_content=errors_pro_note\" rel=\"nofollow ugc\">JWT Authentication PRO\u003C\u002Fa> offers enhanced error tracking and monitoring capabilities.\u003C\u002Fp>\n\u003Ch4>\u002Fwp-json\u002Fjwt-auth\u002Fv1\u002Ftoken\u002Fvalidate\u003C\u002Fh4>\n\u003Cp>This is a simple helper endpoint to validate a token. You only need to make a POST request with the Authorization header.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Valid Token Response\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cpre>\u003Ccode>{\n  \"code\": \"jwt_auth_valid_token\",\n  \"data\": {\n    \"status\": 200\n  }\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch3>AVAILABLE HOOKS\u003C\u002Fh3>\n\u003Cp>The \u003Cstrong>wp-api-jwt-auth\u003C\u002Fstrong> plugin is developer-friendly and provides five filters to override the default settings.\u003C\u002Fp>\n\u003Ch4>jwt_auth_cors_allow_headers\u003C\u002Fh4>\n\u003Cp>The \u003Cstrong>jwt_auth_cors_allow_headers\u003C\u002Fstrong> filter allows you to modify the available headers when CORS support is enabled.\u003C\u002Fp>\n\u003Cp>Default Value:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>'Access-Control-Allow-Headers, Content-Type, Authorization'\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>jwt_auth_not_before\u003C\u002Fh4>\n\u003Cp>The \u003Cstrong>jwt_auth_not_before\u003C\u002Fstrong> filter allows you to change the \u003Ca href=\"https:\u002F\u002Ftools.ietf.org\u002Fhtml\u002Frfc7519#section-4.1.5\" rel=\"nofollow ugc\">\u003Cstrong>nbf\u003C\u002Fstrong>\u003C\u002Fa> value before the token is created.\u003C\u002Fp>\n\u003Cp>Default Value:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>Creation time - time()\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>jwt_auth_expire\u003C\u002Fh4>\n\u003Cp>The \u003Cstrong>jwt_auth_expire\u003C\u002Fstrong> filter allows you to change the \u003Ca href=\"https:\u002F\u002Ftools.ietf.org\u002Fhtml\u002Frfc7519#section-4.1.4\" rel=\"nofollow ugc\">\u003Cstrong>exp\u003C\u002Fstrong>\u003C\u002Fa> value before the token is created.\u003C\u002Fp>\n\u003Cp>Default Value:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>time() + (DAY_IN_SECONDS * 7)\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>jwt_auth_token_before_sign\u003C\u002Fh4>\n\u003Cp>The \u003Cstrong>jwt_auth_token_before_sign\u003C\u002Fstrong> filter allows you to modify all token data before it is encoded and signed.\u003C\u002Fp>\n\u003Cp>Default Value:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>$token = array(\n    'iss' => get_bloginfo('url'),\n    'iat' => $issuedAt,\n    'nbf' => $notBefore,\n    'exp' => $expire,\n    'data' => array(\n        'user' => array(\n            'id' => $user->data->ID,\n        )\n    )\n);\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>\u003Cstrong>Want easier customization?\u003C\u002Fstrong> \u003Ca href=\"https:\u002F\u002Fjwtauth.pro\u002F?utm_source=wp_plugin_readme&utm_medium=link&utm_campaign=pro_promotion&utm_content=hook_payload_pro_note\" rel=\"nofollow ugc\">JWT Authentication PRO\u003C\u002Fa> allows you to add custom claims directly through the admin UI.\u003C\u002Fp>\n\u003Ch4>jwt_auth_token_before_dispatch\u003C\u002Fh4>\n\u003Cp>The \u003Cstrong>jwt_auth_token_before_dispatch\u003C\u002Fstrong> filter allows you to modify the response array before it is sent to the client.\u003C\u002Fp>\n\u003Cp>Default Value:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>$data = array(\n    'token' => $token,\n    'user_email' => $user->data->user_email,\n    'user_nicename' => $user->data->user_nicename,\n    'user_display_name' => $user->data->display_name,\n);\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>jwt_auth_algorithm\u003C\u002Fh4>\n\u003Cp>The \u003Cstrong>jwt_auth_algorithm\u003C\u002Fstrong> filter allows you to modify the signing algorithm.\u003C\u002Fp>\n\u003Cp>Default value:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>$token = JWT::encode(\n    apply_filters('jwt_auth_token_before_sign', $token, $user),\n    $secret_key,\n    apply_filters('jwt_auth_algorithm', 'HS256')\n);\n\n\u002F\u002F ...\n\n$token = JWT::decode(\n    $token,\n    new Key($secret_key, apply_filters('jwt_auth_algorithm', 'HS256'))\n);\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch3>JWT Authentication PRO\u003C\u002Fh3>\n\u003Cp>Elevate your WordPress security and integration capabilities with \u003Cstrong>JWT Authentication PRO\u003C\u002Fstrong>. Building upon the solid foundation of the free version, the PRO version offers advanced features, enhanced security options, and a streamlined user experience:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cstrong>Easy Configuration UI:\u003C\u002Fstrong> Manage all settings directly from the WordPress admin area.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Token Refresh Endpoint:\u003C\u002Fstrong> Allow users to refresh expired tokens seamlessly without requiring re-login.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Token Revocation Endpoint:\u003C\u002Fstrong> Immediately invalidate specific tokens for enhanced security control.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Customizable Token Payload:\u003C\u002Fstrong> Add custom claims to your JWT payload to suit your specific application needs.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Granular CORS Control:\u003C\u002Fstrong> Define allowed origins and headers with more precision directly in the settings.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Rate Limiting:\u003C\u002Fstrong> Protect your endpoints from abuse with configurable rate limits.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Audit Logs:\u003C\u002Fstrong> Keep track of token generation, validation, and errors.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Priority Support:\u003C\u002Fstrong> Get faster, dedicated support directly from the developer.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>\u003Ca href=\"https:\u002F\u002Fjwtauth.pro\u002F?utm_source=wp_plugin_readme&utm_medium=link&utm_campaign=pro_promotion&utm_content=pro_section_cta\" rel=\"nofollow ugc\">Upgrade to JWT Authentication PRO Today!\u003C\u002Fa>\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Ch3>Free vs. PRO Comparison\u003C\u002Fh3>\n\u003Cp>Here’s a quick look at the key differences:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cstrong>Basic JWT Authentication:\u003C\u002Fstrong> Included (Free), Included (PRO)\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Token Generation:\u003C\u002Fstrong> Included (Free), Included (PRO)\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Token Validation:\u003C\u002Fstrong> Included (Free), Included (PRO)\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Token Refresh Mechanism:\u003C\u002Fstrong> Not Included (Free), Included (PRO)\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Token Revocation:\u003C\u002Fstrong> Not Included (Free), Included (PRO)\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Token Management Dashboard:\u003C\u002Fstrong> Not Included (Free), Included (PRO)\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Analytics & Monitoring:\u003C\u002Fstrong> Not Included (Free), Included (PRO)\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Geo-IP Identification:\u003C\u002Fstrong> Not Included (Free), Included (PRO)\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Rate Limiting:\u003C\u002Fstrong> Not Included (Free), Included (PRO)\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Detailed Documentation:\u003C\u002Fstrong> Basic (Free), Comprehensive (PRO)\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Developer Tools:\u003C\u002Fstrong> Not Included (Free), Included (PRO)\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Premium Support:\u003C\u002Fstrong> Community via GitHub (Free), Priority Direct Support (PRO)\u003C\u002Fli>\n\u003C\u002Ful>\n","Extends the WP REST API using JSON Web Tokens Authentication as an authentication method.",60000,934365,88,53,"2026-02-18T00:58:00.000Z","6.9.5","4.2","7.4.0",[55,56,57,58,24],"json-web-authentication","jwt","oauth","rest-api","https:\u002F\u002Fenriquechavez.co","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fjwt-authentication-for-wp-rest-api.1.5.0.zip",{"slug":62,"name":63,"version":64,"author":65,"author_profile":66,"description":67,"short_description":68,"active_installs":69,"downloaded":70,"rating":71,"num_ratings":72,"last_updated":73,"tested_up_to":74,"requires_at_least":75,"requires_php":25,"tags":76,"homepage":78,"download_link":79,"security_score":13,"vuln_count":28,"unpatched_count":28,"last_vuln_date":29,"fetched_at":30},"wp-rest-api-log","REST API Log","1.7.1","Pete Nelson","https:\u002F\u002Fprofiles.wordpress.org\u002Fgungeekatx\u002F","\u003Cp>WordPress plugin to log \u003Ca href=\"http:\u002F\u002Fv2.wp-api.org\u002F\" rel=\"nofollow ugc\">REST API\u003C\u002Fa> requests and responses (for v2 of the API).\u003C\u002Fp>\n\u003Cp>Includes:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>WordPress admin page to view and search log entries\u003C\u002Fli>\n\u003Cli>API endpoint to access log entries via JSON\u003C\u002Fli>\n\u003Cli>Filters to customize logging\u003C\u002Fli>\n\u003Cli>Custom endpoint logging\u003C\u002Fli>\n\u003Cli>ElasticPress logging\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Find us on \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fpetenelson\u002Fwp-rest-api-log\" rel=\"nofollow ugc\">GitHub\u003C\u002Fa>!\u003C\u002Fp>\n\u003Cp>Roadmap\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Better search capabilities for log entries via the REST API endpoint\u003C\u002Fli>\n\u003C\u002Ful>\n","WordPress plugin to log REST API requests and responses",5000,118628,72,24,"2026-07-20T19:44:00.000Z","7.0.2","4.7",[20,22,58,24,77],"wp-rest-api","https:\u002F\u002Fgithub.com\u002Fpetenelson\u002Fwp-rest-api-log","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwp-rest-api-log.1.7.1.zip",{"slug":81,"name":82,"version":83,"author":84,"author_profile":85,"description":86,"short_description":87,"active_installs":88,"downloaded":89,"rating":13,"num_ratings":90,"last_updated":91,"tested_up_to":92,"requires_at_least":93,"requires_php":25,"tags":94,"homepage":97,"download_link":98,"security_score":27,"vuln_count":28,"unpatched_count":28,"last_vuln_date":29,"fetched_at":30},"wp-api-menus","WP API Menus","1.3.2","Fulvio Notarstefano","https:\u002F\u002Fprofiles.wordpress.org\u002Fnekojira\u002F","\u003Cp>This plugin extends the \u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fjson-rest-api\u002F\" rel=\"ugc\">WordPress JSON REST API\u003C\u002Fa> with new routes for WordPress registered menus\u003C\u002Fp>\n\u003Cp>The new routes available will be:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ccode>\u002Fmenus\u003C\u002Fcode> list of every registered menu.\u003C\u002Fli>\n\u003Cli>\u003Ccode>\u002Fmenus\u002F\u003Cid>\u003C\u002Fcode> data for a specific menu.\u003C\u002Fli>\n\u003Cli>\u003Ccode>\u002Fmenu-locations\u003C\u002Fcode> list of all registered theme locations.\u003C\u002Fli>\n\u003Cli>\u003Ccode>\u002Fmenu-locations\u002F\u003Clocation>\u003C\u002Fcode> data for menu in specified menu in theme location.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Currently, the \u003Ccode>menu-locations\u002F\u003Clocation>\u003C\u002Fcode> route for individual menus will return a tree with full menu hierarchy, with correct menu item order and listing children for each menu item. The \u003Ccode>menus\u002F\u003Cid>\u003C\u002Fcode> route will output menu details and a flat array of menu items. Item order or if each item has a parent will be indicated in each item attributes, but this route won’t output items as a tree.\u003C\u002Fp>\n\u003Cp>You can alter the data arrangement of each individual menu items and children using the filter hook \u003Ccode>json_menus_format_menu_item\u003C\u002Fcode>.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>An important note on WP API V2:\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>In V1 the routes are located by default at \u003Ccode>wp-json\u002Fmenus\u002F\u003C\u002Fcode> etc.\u003C\u002Fp>\n\u003Cp>In V2 the routes by default are at \u003Ccode>wp-json\u002Fwp-api-menus\u002Fv2\u002F\u003C\u002Fcode> (e.g. \u003Ccode>wp-json\u002Fwp-api-menus\u002Fv2\u002Fmenus\u002F\u003C\u002Fcode>, etc.) since V2 encourages prefixing and version namespacing.\u003C\u002Fp>\n","Extends WordPress WP REST API with new routes pointing to WordPress menus.",2000,109612,8,"2020-08-18T07:21:00.000Z","5.5.0","3.6.0",[22,95,96,24,77],"json-rest-api","menus","https:\u002F\u002Fgithub.com\u002Fnekojira\u002Fwp-api-menus","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwp-api-menus.1.3.2.zip",{"slug":100,"name":101,"version":102,"author":103,"author_profile":104,"description":105,"short_description":106,"active_installs":107,"downloaded":108,"rating":13,"num_ratings":109,"last_updated":110,"tested_up_to":51,"requires_at_least":111,"requires_php":112,"tags":113,"homepage":116,"download_link":117,"security_score":13,"vuln_count":28,"unpatched_count":28,"last_vuln_date":29,"fetched_at":30},"rest-api-blocks","REST API blocks","2.0.0","Jonny Harris","https:\u002F\u002Fprofiles.wordpress.org\u002Fspacedmonkey\u002F","\u003Cp>A simple plugin to add block data in json format into the rest api. Once installed, there will be two new fields added to the rest api, \u003Ccode>has_blocks\u003C\u002Fcode> and \u003Ccode>blocks\u003C\u002Fcode>.\u003Cbr \u002F>\nFor example output.\u003Cbr \u002F>\n    \u003Ccode>\"has_blocks\": true,\u003Cbr \u002F>\n\"block_data\": [\u003Cbr \u002F>\n  {\u003Cbr \u002F>\n    \"blockName\": \"core\u002Fimage\",\u003Cbr \u002F>\n    \"attrs\": {\u003Cbr \u002F>\n      \"url\": \"https:\u002F\u002Fwww.spacedmonkey.com\u002Fwp-content\u002Fuploads\u002F2018\u002F12\u002Ftest-image.jpg\",\u003Cbr \u002F>\n      \"alt\": \"Terminal de aeropuerto\",\u003Cbr \u002F>\n      \"caption\": \"fsfsdfdsfdssfd\",\u003Cbr \u002F>\n      \"href\": \"https:\u002F\u002Fwww.spacedmonkey.com\u002Ftest-image\",\u003Cbr \u002F>\n      \"rel\": \"noreferrer noopener\",\u003Cbr \u002F>\n      \"linkClass\": \"jonny-123\",\u003Cbr \u002F>\n      \"linkTarget\": \"_blank\",\u003Cbr \u002F>\n      \"id\": 147355,\u003Cbr \u002F>\n      \"width\": 582,\u003Cbr \u002F>\n      \"height\": 327,\u003Cbr \u002F>\n      \"linkDestination\": \"attachment\"\u003Cbr \u002F>\n    },\u003Cbr \u002F>\n    \"innerBlocks\": [\u003Cbr \u002F>\n    ],\u003Cbr \u002F>\n    \"innerHTML\": \"\\n\u003Cfigure class=\\\"wp-block-image is-resized\\\">\u003Ca class=\\\"jonny-123\\\" href=\\\"https:\u002F\u002Fwww.spacedmonkey.com\u002Ftest-image\\\" target=\\\"_blank\\\" rel=\\\"noreferrer noopener\\\">\u003Cimg src=\\\"https:\u002F\u002Fwww.spacedmonkey.com\u002Fwp-content\u002Fuploads\u002F2018\u002F12\u002Ftest-image.jpg\\\" alt=\\\"Terminal de aeropuerto\\\" class=\\\"wp-image-147355\\\" width=\\\"582\\\" height=\\\"327\\\"\u002F>\u003C\u002Fa>\u003Cfigcaption>fsfsdfdsfdssfd\u003C\u002Ffigcaption>\u003C\u002Ffigure>\\n\",\u003Cbr \u002F>\n    \"innerContent\": [\u003Cbr \u002F>\n      \"\\n\u003Cfigure class=\\\"wp-block-image is-resized\\\">\u003Ca class=\\\"jonny-123\\\" href=\\\"https:\u002F\u002Fwww.spacedmonkey.com\u002Ftest-image\\\" target=\\\"_blank\\\" rel=\\\"noreferrer noopener\\\">\u003Cimg src=\\\"https:\u002F\u002Fwww.spacedmonkey.com\u002Fwp-content\u002Fuploads\u002F2018\u002F12\u002Ftest-image.jpg\\\" alt=\\\"Terminal de aeropuerto\\\" class=\\\"wp-image-147355\\\" width=\\\"582\\\" height=\\\"327\\\"\u002F>\u003C\u002Fa>\u003Cfigcaption>fsfsdfdsfdssfd\u003C\u002Ffigcaption>\u003C\u002Ffigure>\\n\"\u003Cbr \u002F>\n    ],\u003Cbr \u002F>\n    \"rendered\": \"\\n\u003Cfigure class=\\\"wp-block-image is-resized\\\">\u003Ca class=\\\"jonny-123\\\" href=\\\"https:\u002F\u002Fwww.spacedmonkey.com\u002Ftest-image\\\" target=\\\"_blank\\\" rel=\\\"noreferrer noopener\\\">\u003Cimg src=\\\"https:\u002F\u002Fwww.spacedmonkey.com\u002Fwp-content\u002Fuploads\u002F2018\u002F12\u002Ftest-image.jpg\\\" alt=\\\"Terminal de aeropuerto\\\" class=\\\"wp-image-147355\\\" width=\\\"582\\\" height=\\\"327\\\"\u002F>\u003C\u002Fa>\u003Cfigcaption>fsfsdfdsfdssfd\u003C\u002Ffigcaption>\u003C\u002Ffigure>\\n\"\u003Cbr \u002F>\n  }\u003Cbr \u002F>\n],\u003C\u002Fcode>\u003C\u002Fp>\n\u003Ch3>Technical Notes\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>Requires PHP 5.6+.\u003C\u002Fli>\n\u003Cli>Requires WordPress 5.5+.\u003C\u002Fli>\n\u003Cli>Issues and Pull requests welcome on the GitHub repository: https:\u002F\u002Fgithub.com\u002Fspacedmonkey\u002Fwp-rest-blocks\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Development\u003C\u002Fh3>\n\u003Cp>This plugin uses \u003Ccode>@wordpress\u002Fenv\u003C\u002Fcode> for local development and testing.\u003C\u002Fp>\n\u003Ch3>Prerequisites\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>Node.js 20+ and npm\u003C\u002Fli>\n\u003Cli>Docker Desktop (must be installed and running)\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Setup\u003C\u002Fh3>\n\u003Col>\n\u003Cli>Clone the repository\u003C\u002Fli>\n\u003Cli>\n\u003Cp>Install dependencies:\u003Cbr \u002F>\n   \u003Ccode>bash\u003Cbr \u002F>\nnpm install\u003Cbr \u002F>\ncomposer install\u003C\u002Fcode>\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>Start the WordPress environment:\u003Cbr \u002F>\n   \u003Ccode>bash\u003Cbr \u002F>\nnpm run env:start\u003C\u002Fcode>\u003C\u002Fp>\n\u003Cp>This will start a local WordPress instance at \u003Ccode>http:\u002F\u002Flocalhost:8888\u003C\u002Fcode> (admin: \u003Ccode>http:\u002F\u002Flocalhost:8888\u002Fwp-admin\u003C\u002Fcode> with username \u003Ccode>admin\u003C\u002Fcode> and password \u003Ccode>password\u003C\u002Fcode>)\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong> Docker must be running for this to work. The first time you run this, it will download WordPress and set up the database, which may take a few minutes.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch3>Available Commands\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Ccode>npm run env:start\u003C\u002Fcode> – Start the WordPress environment\u003C\u002Fli>\n\u003Cli>\u003Ccode>npm run env:stop\u003C\u002Fcode> – Stop the WordPress environment\u003C\u002Fli>\n\u003Cli>\u003Ccode>npm run env:reset\u003C\u002Fcode> – Reset the environment (clean database)\u003C\u002Fli>\n\u003Cli>\u003Ccode>npm run env:destroy\u003C\u002Fcode> – Destroy the environment completely\u003C\u002Fli>\n\u003Cli>\u003Ccode>npm run test:php\u003C\u002Fcode> – Run PHPUnit tests\u003C\u002Fli>\n\u003Cli>\u003Ccode>npm run test:php:multisite\u003C\u002Fcode> – Run PHPUnit tests in multisite mode\u003C\u002Fli>\n\u003Cli>\u003Ccode>npm run lint:php\u003C\u002Fcode> – Run PHP CodeSniffer\u003C\u002Fli>\n\u003Cli>\u003Ccode>npm run lint:php:fix\u003C\u002Fcode> – Fix PHP coding standards issues automatically\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Running Tests\u003C\u002Fh3>\n\u003Cp>After starting the environment with \u003Ccode>npm run env:start\u003C\u002Fcode>, you can run the tests:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>`bash\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>npm run test:php\u003Cbr \u002F>\n    `\u003C\u002Fp>\n\u003Cp>For multisite tests:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>`bash\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>npm run test:php:multisite\u003Cbr \u002F>\n    `\u003C\u002Fp>\n\u003Ch3>Accessing the Site\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Development site\u003C\u002Fstrong>: http:\u002F\u002Flocalhost:8888\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Admin dashboard\u003C\u002Fstrong>: http:\u002F\u002Flocalhost:8888\u002Fwp-admin (admin\u002Fpassword)\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Test site\u003C\u002Fstrong>: http:\u002F\u002Flocalhost:8889\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Test admin\u003C\u002Fstrong>: http:\u002F\u002Flocalhost:8889\u002Fwp-admin (admin\u002Fpassword)\u003C\u002Fli>\n\u003C\u002Ful>\n","Add gutenberg blocks data into the post \u002F page REST API endpoints.",200,7311,2,"2026-01-03T16:16:00.000Z","5.9","7.4",[20,114,21,58,115],"blocks","wp-json","https:\u002F\u002Fgithub.com\u002Fspacedmonkey\u002Fwp-rest-blocks","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Frest-api-blocks.2.0.0.zip",{"slug":119,"name":120,"version":121,"author":122,"author_profile":123,"description":124,"short_description":125,"active_installs":13,"downloaded":126,"rating":13,"num_ratings":127,"last_updated":128,"tested_up_to":129,"requires_at_least":130,"requires_php":25,"tags":131,"homepage":134,"download_link":135,"security_score":27,"vuln_count":28,"unpatched_count":28,"last_vuln_date":29,"fetched_at":30},"searchwp-api","SearchWP API","1.1.0","Josh Pollock","https:\u002F\u002Fprofiles.wordpress.org\u002Fshelob9\u002F","\u003Cp>Run advanced searches via the WordPress REST API and SearchWP.\u003C\u002Fp>\n\u003Cp>Adds an endpoint to the WordPress REST API for searching via \u003Ca href=\"https:\u002F\u002Fsearchwp.com\u002F\" rel=\"nofollow ugc\">SearchWP\u003C\u002Fa> — the best tool for improving the usefulness and performance of WordPress search.\u003C\u002Fp>\n\u003Cp>This plugin is a free plugin by \u003Ca href=\"https:\u002F\u002FCalderaWP.com\" rel=\"nofollow ugc\">CalderaWP\u003C\u002Fa>. It is not an official add-on for SearchWP.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Requires WordPress REST API (WP-API) 2.0-beta9 or later or WordPress 4.4 or later.\u003C\u002Fli>\n\u003Cli>Requires SearchWP Version 2.6 or later\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Technically will work without SearchWP, but queries will run through WP_Query.\u003C\u002Fp>\n\u003Ch3>Example Queries\u003C\u002Fh3>\n\u003Cp>For a complete list of possible queries, see: \u003Ca href=\"https:\u002F\u002Fcalderawp.com\u002Fdoc\u002Fsearchwp-api-queries\u002F\" rel=\"nofollow ugc\">https:\u002F\u002Fcalderawp.com\u002Fdoc\u002Fsearchwp-api-queries\u002F\u003C\u002Fa>\u003Cbr \u002F>\n* \u003Ccode>wp-json\u002Fswp_api\u002Fsearch?s=jedi&egnine=star-wars\u003C\u002Fcode>\u003Cbr \u002F>\n* \u003Ccode>wp-json\u002Fswp_api\u002Fsearch?&tax_query[field]=slug&tax_query[taxonomy]=categories&tax_query[terms]=1\u003C\u002Fcode>\u003Cbr \u002F>\n* \u003Ccode>wp-json\u002Fswp_api\u002Fsearch?meta_query[key]=jedi&meta_query[value]=luke&tax_query[compare]=IN\u003C\u002Fcode>\u003C\u002Fp>\n\u003Ch3>Does It Work With Version 1 of The REST API?\u003C\u002Fh3>\n\u003Cp>No, it does not.\u003C\u002Fp>\n\u003Ch3>I Installed It And Nothing Happened\u003C\u002Fh3>\n\u003Cp>You are probably using version 1 of the REST API, or have not updated SearchWP past 2.6.\u003C\u002Fp>\n\u003Ch3>How Shiny Is This Plugin?\u003C\u002Fh3>\n\u003Cp>Very shiny.\u003C\u002Fp>\n\u003Ch3>Version 1.1.0 – January, 2015\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>Complex meta queries\u003C\u002Fli>\n\u003Cli>Fallback to WP_Query if not possible to use SearchWP\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Version 1.0.0 – July 6, 2015\u003C\u002Fh3>\n\u003Cp>Initial release\u003C\u002Fp>\n","Run advanced searches via the WordPress REST API and SearchWP.",15129,4,"2016-01-07T17:16:00.000Z","4.4.34","4.3.1",[22,58,132,133,24],"search","searchwp","http:\u002F\u002FCalderaWP.com","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsearchwp-api.zip",{"attackSurface":137,"codeSignals":149,"taintFlows":156,"riskAssessment":157,"analyzedAt":165},{"hooks":138,"ajaxHandlers":145,"restRoutes":146,"shortcodes":147,"cronEvents":148,"entryPointCount":28,"unprotectedCount":28},[139],{"type":140,"name":141,"callback":142,"file":143,"line":144},"action","rest_api_init","closure","rest-gutenberg.php",11,[],[],[],[],{"dangerousFunctions":150,"sqlUsage":151,"outputEscaping":153,"fileOperations":28,"externalRequests":28,"nonceChecks":28,"capabilityChecks":28,"bundledLibraries":155},[],{"prepared":28,"raw":28,"locations":152},[],{"escaped":28,"rawEcho":28,"locations":154},[],[],[],{"summary":158,"deductions":159},"Based on the provided static analysis and vulnerability history, the \"rest-gutenberg\" plugin version 1.0 appears to have a very strong security posture. The absence of any identified attack surface, dangerous functions, raw SQL queries, unescaped output, file operations, external HTTP requests, or taint flows is exceptionally positive. This indicates a developer who is likely employing secure coding practices and carefully sanitizing any potential inputs or outputs. The complete lack of any recorded CVEs further reinforces this assessment, suggesting a history of stable and secure development.  However, it's important to note that the analysis reports zero nonce checks and zero capability checks. While the current lack of an attack surface might mitigate immediate risks, this absence of protective measures could become a significant concern if the plugin's functionality evolves or if new vulnerabilities are discovered in underlying WordPress core or other plugins it interacts with.  In conclusion, the plugin is currently exhibiting excellent security but the lack of explicit authorization checks presents a latent risk that should be monitored.",[160,163],{"reason":161,"points":162},"No nonce checks implemented",10,{"reason":164,"points":162},"No capability checks implemented","2026-03-16T23:09:03.449Z",{"wat":167,"direct":172},{"assetPaths":168,"generatorPatterns":169,"scriptPaths":170,"versionParams":171},[],[],[],[],{"cssClasses":173,"htmlComments":174,"htmlAttributes":175,"restEndpoints":176,"jsGlobals":178,"shortcodeOutput":179},[],[],[],[177],"\u002Fwp-json\u002Frest-gutenberg",[],[],{"error":181,"url":182,"statusCode":183,"statusMessage":184,"message":184},true,"http:\u002F\u002Flocalhost\u002Fapi\u002Fplugins\u002Frest-gutenberg\u002Fbundle",404,"no bundle for this plugin yet",{"slug":4,"current_version":6,"total_versions":28,"versions":186},[]]