Themes4WP Social Counter Widget Security & Risk Analysis

wordpress.org/plugins/themes4wp-social-counter-widget

A plugin to display your social accounts fans, subscribers, followers and like buttons on your widget.

20 active installs v1.0 PHP + WP 4.0+ Updated Feb 9, 2016
social-mediasocial-media-counterssocial-networksocial-profile-countsocial-profiles-counter
85
A · Safe
CVEs total0
Unpatched0
Last CVENever
Safety Verdict

Is Themes4WP Social Counter Widget Safe to Use in 2026?

Generally Safe

Score 85/100

Themes4WP Social Counter Widget has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs Updated 10yr ago
Risk Assessment

The security posture of the themes4wp-social-counter-widget plugin version 1.0 appears to be mixed, with some strong positive indicators but also significant areas of concern. The absence of any known CVEs and no critical or high-severity taint flows is a positive sign, suggesting a lack of historically exploitable vulnerabilities. Furthermore, the plugin demonstrates good practices by exclusively using prepared statements for its SQL queries. However, the static analysis reveals critical weaknesses. The low percentage of properly escaped output (18%) is a major red flag, indicating a high risk of Cross-Site Scripting (XSS) vulnerabilities. The complete lack of nonce checks and capability checks for any potential entry points, despite the analysis showing zero such points, still leaves a theoretical open door for attackers if functionality were to be added later without proper security implementations. The presence of file operations and an external HTTP request without explicit mention of sanitization or authentication for these actions also warrants caution.

Key Concerns

  • Insufficient output escaping
  • Missing nonce checks
  • Missing capability checks
  • Potential risks from file operations
  • Potential risks from external HTTP requests
Vulnerabilities
None known

Themes4WP Social Counter Widget Security Vulnerabilities

No known vulnerabilities — this is a good sign.
Code Analysis
Analyzed Mar 16, 2026

Themes4WP Social Counter Widget Code Analysis

Dangerous Functions
0
Raw SQL Queries
0
0 prepared
Unescaped Output
89
19 escaped
Nonce Checks
0
Capability Checks
0
File Operations
2
External Requests
1
Bundled Libraries
0

Output Escaping

18% escaped108 total outputs
Attack Surface

Themes4WP Social Counter Widget Attack Surface

Entry Points0
Unprotected0
WordPress Hooks 3
actionwp_enqueue_scriptstwp-social-counter-widget.php:20
actionwidgets_inittwp-social-counter-widget.php:310
actionwp_headtwp-social-counter-widget.php:373
Maintenance & Trust

Themes4WP Social Counter Widget Maintenance & Trust

Maintenance Signals

WordPress version tested4.4.34
Last updatedFeb 9, 2016
PHP min version
Downloads6K

Community Trust

Rating100/100
Number of ratings1
Active installs20
Developer Profile

Themes4WP Social Counter Widget Developer Profile

Themes4WP

14 plugins · 26K total installs

90
trust score
Avg Security Score
94/100
Avg Patch Time
22 days
View full developer profile
Detection Fingerprints

How We Detect Themes4WP Social Counter Widget

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/themes4wp-social-counter-widget/css/twp-social.css/wp-content/plugins/themes4wp-social-counter-widget/js/twp-social.js
Script Paths
/wp-content/plugins/themes4wp-social-counter-widget/js/twp-social.js
Version Parameters
themes4wp-social-counter-widget/css/twp-social.css?ver=themes4wp-social-counter-widget/js/twp-social.js?ver=

HTML / DOM Fingerprints

CSS Classes
twp-social-widgetrss-subscribersgoogle-fansfacebook-fanstwitter-followersgoogle-likesfacebook-likespost-count+2 more
Data Attributes
data-sizedata-hrefdata-layoutdata-actiondata-show-facesdata-share
JS Globals
twp_social_google_plus_countstwp_social_facebook_like_countstwp_social_tweet_counts
FAQ

Frequently Asked Questions about Themes4WP Social Counter Widget