Tarot and Horoscope Security & Risk Analysis

wordpress.org/plugins/tarot-and-horoscope

Add interactive tarot card games and live chat to your WordPress site for free, powered by TarotandHoroscope.com.

40 active installs v1.0.4 PHP 7.0+ WP 5.0+ Updated Dec 1, 2025
astrologygameshoroscopetarottarot-reader
100
A · Safe
CVEs total0
Unpatched0
Last CVENever
Download
Safety Verdict

Is Tarot and Horoscope Safe to Use in 2026?

Generally Safe

Score 100/100

Tarot and Horoscope has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs Updated 4mo ago
Risk Assessment

The 'tarot-and-horoscope' plugin, v1.0.4, exhibits a strong security posture based on the provided static analysis. It demonstrates excellent adherence to best practices, with all identified entry points (AJAX handlers, REST API routes, and shortcodes) appearing to be protected by authentication and authorization checks. The code also shows a commendable commitment to secure coding by using prepared statements for all SQL queries and properly escaping a vast majority of its output. The absence of any critical or high-severity taint flows further reinforces this positive assessment.

Vulnerabilities
None known

Tarot and Horoscope Security Vulnerabilities

No known vulnerabilities — this is a good sign.
Code Analysis
Analyzed Mar 16, 2026

Tarot and Horoscope Code Analysis

Dangerous Functions
0
Raw SQL Queries
0
0 prepared
Unescaped Output
9
635 escaped
Nonce Checks
18
Capability Checks
5
File Operations
1
External Requests
4
Bundled Libraries
0

Output Escaping

99% escaped644 total outputs
Data Flows
All sanitized

Data Flow Analysis

12 flows
tarotxhoroscope_daily_tarot_admin_save (admin\gamestyles\dailytarot.php:180)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface

Tarot and Horoscope Attack Surface

Entry Points20
Unprotected0

AJAX Handlers 16

authwp_ajax_onecard_api_callapi\api-handler.php:91
noprivwp_ajax_onecard_api_callapi\api-handler.php:92
authwp_ajax_dailytarot_api_callapi\api-handler.php:93
noprivwp_ajax_dailytarot_api_callapi\api-handler.php:94
authwp_ajax_threecard_api_callapi\api-handler.php:95
noprivwp_ajax_threecard_api_callapi\api-handler.php:96
authwp_ajax_tarotxhoroscope_chat_token_api_callapi\api-handler.php:211
noprivwp_ajax_tarotxhoroscope_chat_token_api_callapi\api-handler.php:212
authwp_ajax_tarotxhoroscope_horoscopemonthly_api_callapi\api-handler.php:213
noprivwp_ajax_tarotxhoroscope_horoscopemonthly_api_callapi\api-handler.php:214
authwp_ajax_tarotxhoroscope_reset_daily_game_and_chatshortcodes\dailytarot.php:9
noprivwp_ajax_tarotxhoroscope_reset_daily_game_and_chatshortcodes\dailytarot.php:10
authwp_ajax_tarotxhoroscope_reset_onecard_game_and_chatshortcodes\onecard.php:9
noprivwp_ajax_tarotxhoroscope_reset_onecard_game_and_chatshortcodes\onecard.php:10
authwp_ajax_tarotxhoroscope_reset_threecard_game_and_chatshortcodes\threecard.php:9
noprivwp_ajax_tarotxhoroscope_reset_threecard_game_and_chatshortcodes\threecard.php:10

Shortcodes 4

[tarotxhoroscope_dailytarot] shortcodes\dailytarot.php:182
[tarotxhoroscope_monthly_horoscope] shortcodes\monthly_horoscope.php:50
[tarotxhoroscope_onecard] shortcodes\onecard.php:182
[tarotxhoroscope_threecard] shortcodes\threecard.php:188
WordPress Hooks 7
actionadmin_menutarot-and-horoscope.php:20
actionadmin_inittarot-and-horoscope.php:21
actionadmin_inittarot-and-horoscope.php:22
actionadmin_enqueue_scriptstarot-and-horoscope.php:23
actionadmin_noticestarot-and-horoscope.php:208
filterpre_update_option_tarotxhoroscope_api_keytarot-and-horoscope.php:370
filterpre_update_option_tarotxhoroscope_domaintarot-and-horoscope.php:371
Maintenance & Trust

Tarot and Horoscope Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.4
Last updatedDec 1, 2025
PHP min version7.0
Downloads1K

Community Trust

Rating0/100
Number of ratings0
Active installs40
Developer Profile

Tarot and Horoscope Developer Profile

Tarot and Horoscope

1 plugin · 40 total installs

94
trust score
Avg Security Score
100/100
Avg Patch Time
30 days
View full developer profile
Detection Fingerprints

How We Detect Tarot and Horoscope

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/tarot-and-horoscope/admin/admin-styles.css/wp-content/plugins/tarot-and-horoscope/admin/admin-scripts.js/wp-content/plugins/tarot-and-horoscope/games/images/tarotandhoroscopeplugin.png/wp-content/plugins/tarot-and-horoscope/games/images/tarotandhoroscopepluginsettings.JPG/wp-content/plugins/tarot-and-horoscope/games/images/tarotandhoroscopepluginmoresettings.JPG/wp-content/plugins/tarot-and-horoscope/games/images/tarotandhoroscopegamesettings.JPG/wp-content/plugins/tarot-and-horoscope/games/images/tarotandhoroscopemoregamesettings.JPG/wp-content/plugins/tarot-and-horoscope/games/images/tarotandhoroscopeshortcodes.JPG
Script Paths
/wp-content/plugins/tarot-and-horoscope/admin/admin-scripts.js
Version Parameters
tarot-and-horoscope/admin/admin-styles.css?ver=1.0.4tarot-and-horoscope/admin/admin-scripts.js?ver=1.0.4

HTML / DOM Fingerprints

CSS Classes
tarot-horoscope-containertarot-logoapi-key-warning
Data Attributes
data-urldata-gamedata-sitekeydata-readerdata-themedata-title+2 more
JS Globals
tarotxhoroscope_vars
REST Endpoints
/wp-json/tarotxhoroscope/v1/chat/wp-json/tarotxhoroscope/v1/horoscope
Shortcode Output
[tarotxhoroscope_onecard][tarotxhoroscope_dailytarot][tarotxhoroscope_threecard][tarotxhoroscope_monthly_horoscope]
FAQ

Frequently Asked Questions about Tarot and Horoscope