Taxonomy Tree Toggler Security & Risk Analysis
wordpress.org/plugins/taxonomy-tree-togglerCheck all parent taxonomies on check, uncheck all sub-taxnomies on uncheck. Compatible with WordPress Gutenberg. Working with WordPress hierarchical …
Is Taxonomy Tree Toggler Safe to Use in 2026?
Generally Safe
Score 85/100Taxonomy Tree Toggler has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.
The taxonomy-tree-toggler plugin v1.0.0 exhibits a seemingly strong security posture based on the provided static analysis. There are no identified AJAX handlers, REST API routes, shortcodes, or cron events, resulting in a zero attack surface. Furthermore, the code signals indicate no dangerous functions, all SQL queries use prepared statements, and there are no file operations or external HTTP requests. The absence of known vulnerabilities and CVEs in its history is also a positive indicator.
However, a significant concern arises from the "Output escaping" metric, which shows 1 total output with 0% properly escaped. This suggests a potential for Cross-Site Scripting (XSS) vulnerabilities if any user-supplied data is reflected directly into the output without proper sanitization. While the taint analysis shows no flows with unsanitized paths, this could be due to the limited number of flows analyzed or the absence of specific entry points that would trigger such analysis. The plugin also lacks nonce and capability checks, which, while not immediately exploitable given the zero attack surface, represent a gap in robust security practices should new entry points be introduced in future versions.
In conclusion, while the plugin has avoided known vulnerabilities and boasts a clean code signal in most areas, the unescaped output is a critical weakness that must be addressed. The lack of authentication checks, though currently mitigated by the absence of entry points, also presents a future risk. The plugin is likely safe for now due to its limited scope, but the output escaping issue makes it susceptible to XSS if it interacts with user-controlled data in its output.
Key Concerns
- 100% of outputs unescaped
- No nonce checks
- No capability checks
Taxonomy Tree Toggler Security Vulnerabilities
Taxonomy Tree Toggler Code Analysis
Output Escaping
Taxonomy Tree Toggler Attack Surface
WordPress Hooks 3
Maintenance & Trust
Taxonomy Tree Toggler Maintenance & Trust
Maintenance Signals
Community Trust
Taxonomy Tree Toggler Alternatives
Parent Category Toggler
parent-category-toggler
Automatically toggle the parent categories when a sub category is selected.
WP Category Order
wp-category-order
Display WordPress post categories in parent–child hierarchy while editing posts in the admin panel
Simple Category List
categorylist
Major features in Simple category list include:
Custom Post Type UI
custom-post-type-ui
Admin UI for creating custom content types like post types and taxonomies
Category Order and Taxonomy Terms Order
taxonomy-terms-order
Drag-and-drop ordering for Categories & any taxonomy (hierarchically) using a Drag and Drop Sortable JavaScript capability.
Taxonomy Tree Toggler Developer Profile
1 plugin · 90 total installs
How We Detect Taxonomy Tree Toggler
Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.
Asset Fingerprints
HTML / DOM Fingerprints
components-checkbox-control__inputeditor-post-taxonomies__hierarchical-terms-subchoices<script>
(function () {
jQuery(document).on('change', '.selectit input[type="checkbox"]', function(){
if (jQuery(this).prop('checked')) {
checkParentNodes(jQuery(this));
} else {
uncheckChildNodes(jQuery(this));
}
}).on('change', 'input.components-checkbox-control__input[type="checkbox"]', function() {
if (jQuery(this).prop('checked')) {
gtCheckParent(jQuery(this));
} else {
gtUncheckChildren(jQuery(this));
}
});
function checkParentNodes(_el)
{
var _parent = findParentObj(_el);
if (_parent.length != 0)
{
_parent[0].checked = 1;
checkParentNodes(_parent);
}
}
function findParentWithDepth(_el, _depth) {
var parent = _el;
var c = 0;
do {
parent = parent.parent();
} while (++c < _depth);
return parent;
}
function findParentObj(_el)
{
return findParentWithDepth(_el, 3).prev().children("input");
}
function uncheckChildNodes(_el)
{
_el.parent().siblings().find('input[type="checkbox"]').each(function() {
jQuery(this).prop('checked', false);
});
}
// Gutenberg, find labels and click
function gtCheckParent(_el)
{
var _parent = gtFindParentCheckbox(_el);
if (_parent.length != 0)
{
if (!_parent.prop('checked')) {
_parent.parent().next().trigger('click');
}
gtCheckParent(_parent.parent());
}
}
function gtFindParentCheckbox(_el)
{
var p = findParentWithDepth(_el, 5);
if (p.hasClass('editor-post-taxonomies__hierarchical-terms-subchoices')) {
return p.prev().find('input[type="checkbox"]');
} else {
return [];
}
}
function gtUncheckChildren(_el)
{
var selector = '.editor-post-taxonomies__hierarchical-terms-subchoices';
findParentWithDepth(_el, 3).next(selector).find('input[type="checkbox"]').each(function() {
if (jQuery(this).prop('checked')) {
jQuery(this).parent().next().trigger('click');
}
});
}
})();
</script>