[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwFzG_9DRxfox9Vn1O-94m2JOfXyvppziAmUK_HAShiE":3,"$fITbDaocCj6mS59ktSKstTB7Lfxr9Et0z0qnB8YCkzB4":145,"$fH0Y1gp_QYdqAGS17Y3z_z7mtF3wBS2VxR-ku8fxUuvo":150},{"slug":4,"name":5,"version":6,"author":7,"author_profile":8,"description":9,"short_description":10,"active_installs":11,"downloaded":12,"rating":11,"num_ratings":11,"last_updated":13,"tested_up_to":14,"requires_at_least":15,"requires_php":16,"tags":17,"homepage":18,"download_link":19,"security_score":20,"vuln_count":11,"unpatched_count":11,"last_vuln_date":21,"fetched_at":22,"discovery_status":23,"vulnerabilities":24,"developer":25,"crawl_stats":21,"alternatives":31,"analysis":32,"fingerprints":122},"site-security-auditor","Site Security Auditor","1.3.3","Gopal Bogati","https:\u002F\u002Fprofiles.wordpress.org\u002Fgopalbogati\u002F","\u003Cp>Site Security Auditor helps admins spot risks from outdated\u002Finactive plugins, monitor file changes in plugins\u002Fthemes, and review hardening settings like DISALLOW_FILE_EDIT or FORCE_SSL_ADMIN. It uses only WordPress core APIs and stores data in options.\u003C\u002Fp>\n\u003Ch3>Changeling\u003C\u002Fh3>\n\u003Cp>= 1.0 =\u003Cbr \u002F>\n* Add full dashboard sections and escaping\u003Cbr \u002F>\n* Fix text domain packaging\u003C\u002Fp>\n","A simple admin tool to audit plugins, file integrity (baseline + changes), and hardening settings. No tracking or updater hooks.",0,1045,"2025-09-22T00:24:00.000Z","6.8.6","5.8","7.4",[],"","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsite-security-auditor.1.0.zip",100,null,"2026-07-22T17:31:50.256Z","no_bundle",[],{"slug":26,"display_name":7,"profile_url":8,"plugin_count":27,"total_installs":11,"avg_security_score":20,"avg_patch_time_days":28,"trust_score":29,"computed_at":30},"gopalbogati",3,30,94,"2026-08-29T04:04:05.871Z",[],{"attackSurface":33,"codeSignals":53,"taintFlows":114,"riskAssessment":115,"analyzedAt":121},{"hooks":34,"ajaxHandlers":49,"restRoutes":50,"shortcodes":51,"cronEvents":52,"entryPointCount":11,"unprotectedCount":11},[35,41,45],{"type":36,"name":37,"callback":38,"file":39,"line":40},"action","admin_menu","add_menu","site-security-auditor.php",38,{"type":36,"name":42,"callback":43,"file":39,"line":44},"admin_post_ssa_make_baseline","handle_baseline",39,{"type":36,"name":46,"callback":47,"file":39,"line":48},"admin_post_ssa_run_scan","handle_scan",40,[],[],[],[],{"dangerousFunctions":54,"sqlUsage":55,"outputEscaping":57,"fileOperations":11,"externalRequests":11,"nonceChecks":112,"capabilityChecks":27,"bundledLibraries":113},[],{"prepared":11,"raw":11,"locations":56},[],{"escaped":58,"rawEcho":59,"locations":60},11,25,[61,64,66,68,70,72,74,76,78,80,82,84,86,88,90,92,94,96,98,100,102,104,106,108,110],{"file":39,"line":62,"context":63},106,"raw output",{"file":39,"line":65,"context":63},109,{"file":39,"line":67,"context":63},113,{"file":39,"line":69,"context":63},114,{"file":39,"line":71,"context":63},116,{"file":39,"line":73,"context":63},117,{"file":39,"line":75,"context":63},118,{"file":39,"line":77,"context":63},119,{"file":39,"line":79,"context":63},120,{"file":39,"line":81,"context":63},121,{"file":39,"line":83,"context":63},125,{"file":39,"line":85,"context":63},151,{"file":39,"line":87,"context":63},152,{"file":39,"line":89,"context":63},159,{"file":39,"line":91,"context":63},165,{"file":39,"line":93,"context":63},171,{"file":39,"line":95,"context":63},175,{"file":39,"line":97,"context":63},176,{"file":39,"line":99,"context":63},187,{"file":39,"line":101,"context":63},193,{"file":39,"line":103,"context":63},194,{"file":39,"line":105,"context":63},196,{"file":39,"line":107,"context":63},197,{"file":39,"line":109,"context":63},198,{"file":39,"line":111,"context":63},199,2,[],[],{"summary":116,"deductions":117},"The 'site-security-auditor' v1.3.3 plugin exhibits a generally strong security posture based on the provided static analysis. The absence of any identified AJAX handlers, REST API routes, shortcodes, or cron events with unprotected entry points significantly limits the plugin's attack surface. Furthermore, the code analysis shows no dangerous functions, SQL queries are exclusively using prepared statements, there are no file operations or external HTTP requests, and a reasonable number of nonce and capability checks are present. The taint analysis also reported zero flows, indicating no immediate concerns regarding unsanitized data leading to vulnerabilities.  The plugin's vulnerability history is completely clear, with no known CVEs, which suggests a history of secure development practices or a lack of past discoveries.  However, a notable weakness is the low percentage of properly escaped output (31%), which could leave the plugin susceptible to Cross-Site Scripting (XSS) vulnerabilities if user-supplied data is not handled carefully in the remaining unescaped outputs. While the overall picture is positive, this output escaping deficiency warrants attention and potential remediation.",[118],{"reason":119,"points":120},"Low percentage of properly escaped output",8,"2026-03-17T07:11:07.499Z",{"wat":123,"direct":132},{"assetPaths":124,"generatorPatterns":127,"scriptPaths":128,"versionParams":129},[125,126],"\u002Fwp-content\u002Fplugins\u002Fsite-security-auditor\u002Fcss\u002Fssa-admin.css","\u002Fwp-content\u002Fplugins\u002Fsite-security-auditor\u002Fjs\u002Fssa-admin.js",[],[126],[130,131],"site-security-auditor\u002Fcss\u002Fssa-admin.css?ver=","site-security-auditor\u002Fjs\u002Fssa-admin.js?ver=",{"cssClasses":133,"htmlComments":139,"htmlAttributes":140,"restEndpoints":142,"jsGlobals":143,"shortcodeOutput":144},[134,135,136,137,138],"wrap","widefat","striped","notice","notice-success",[],[141],"onclick",[],[],[],{"error":146,"url":147,"statusCode":148,"statusMessage":149,"message":149},true,"http:\u002F\u002Flocalhost\u002Fapi\u002Fplugins\u002Fsite-security-auditor\u002Fbundle",404,"no bundle for this plugin yet",{"slug":4,"current_version":6,"total_versions":151,"versions":152},1,[153],{"version":154,"download_url":19,"svn_tag_url":155,"released_at":21,"has_diff":156,"diff_files_changed":157,"diff_lines":21,"trac_diff_url":21,"vulnerabilities":158,"is_current":156},"1.0","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fsite-security-auditor\u002Ftags\u002F1.0\u002F",false,[],[]]