[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCpJucFuYI0XNbfN5rzGkBUkO4OGTRP8dEqZ3FE_gFhk":3,"$f2XB-GhtomCSqy3rUsAPeycSSsSq0bTXBrfIQMBe8YLM":639,"$fbnbE_rxnp-Q-94rtpBtSDS78lwgSlTUMV33vHKFZWuU":643},{"slug":4,"name":5,"version":6,"author":7,"author_profile":8,"description":9,"short_description":10,"active_installs":11,"downloaded":12,"rating":13,"num_ratings":14,"last_updated":15,"tested_up_to":16,"requires_at_least":17,"requires_php":18,"tags":19,"homepage":25,"download_link":26,"security_score":27,"vuln_count":28,"unpatched_count":29,"last_vuln_date":30,"fetched_at":31,"discovery_status":32,"vulnerabilities":33,"developer":64,"crawl_stats":39,"alternatives":68,"analysis":167,"fingerprints":591},"trackserver","Trackserver","5.1.1","tinuzz","https:\u002F\u002Fprofiles.wordpress.org\u002Ftinuzz\u002F","\u003Cp>NOTE: Trackserver v5.0 contains backwards-incompatible changes and changes to client configurations are needed. Please read the \u003Ca href=\"https:\u002F\u002Fwww.grendelman.net\u002Fwp\u002Ftrackserver-v5-0-released\u002F\" rel=\"nofollow ugc\">release notes\u003C\u002Fa> for more information.\u003C\u002Fp>\n\u003Cp>Getting your GPS tracks into WordPress and publishing them has never been easier!\u003C\u002Fp>\n\u003Cp>Trackserver is a plugin for storing and publishing GPS routes. It is a server companion to several mobile apps for location tracking, and it can display maps with your tracks on them by using a shortcode. It can also be used for live tracking, where your visitors can follow you or your users on a map.\u003C\u002Fp>\n\u003Cp>Unlike other plugins that are about maps and tracks, Trackserver’s main focus is not the publishing, but rather the collection and storing of tracks and locations. It’s all about keeping your data to yourself. Several mobile apps and protocols are supported for getting tracks into trackserver:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"http:\u002F\u002Fwww.luisespinosa.com\u002Ftrackme_eng.html\" rel=\"nofollow ugc\">TrackMe\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002FMapMyTracks\u002Fapi\" rel=\"nofollow ugc\">MapMyTracks protocol\u003C\u002Fa>, for example using \u003Ca href=\"http:\u002F\u002Fwww.oruxmaps.com\u002Findex_en.html\" rel=\"nofollow ugc\">OruxMaps\u003C\u002Fa>, including upload functionality\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"http:\u002F\u002Fosmand.net\u002F\" rel=\"nofollow ugc\">OsmAnd’s\u003C\u002Fa> live tracking protocol\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Ff-droid.org\u002Fen\u002Fpackages\u002Fnet.fabiszewski.ulogger\u002F\" rel=\"nofollow ugc\">µLogger\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fgpslogger.app\u002F\" rel=\"nofollow ugc\">GPSLogger\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fgitlab.com\u002Feneiluj\u002Fphonetrack-android\" rel=\"nofollow ugc\">PhoneTrack-Android\u003C\u002Fa> also works with OsmAnd’s protocol (Trackserver >= 4.3)\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fitunes.apple.com\u002Fbm\u002Fapp\u002Fsendlocation\u002Fid377724446?mt=8\" rel=\"nofollow ugc\">SendLocation\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.traccar.org\u002Fclient\u002F\" rel=\"nofollow ugc\">Traccar client\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"http:\u002F\u002Fowntracks.org\u002F\" rel=\"nofollow ugc\">OwnTracks\u003C\u002Fa> (experimental support)\u003C\u002Fli>\n\u003Cli>HTTP POST, for example using \u003Ca href=\"https:\u002F\u002Fplay.google.com\u002Fstore\u002Fapps\u002Fdetails?id=com.dngames.autoshare\" rel=\"nofollow ugc\">AutoShare\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>A shortcode [tsmap] is provided for displaying your tracks on a map. Maps are displayed using the fantastic \u003Ca href=\"http:\u002F\u002Fleafletjs.com\u002F\" rel=\"nofollow ugc\">Leaflet library\u003C\u002Fa> and some useful Leaflet plugins are included. Maps can be viewed in full-screen on modern browsers.\u003C\u002Fp>\n\u003Cp>To publish a map with a track in a post or a page, just include the shortcode:\u003C\u002Fp>\n\u003Cp>[tsmap track=\u003Cid>]\u003C\u002Fp>\n\u003Cp>See the FAQ section for more information on the shortcode’s supported attributes.\u003C\u002Fp>\n\u003Ch4>Requirements\u003C\u002Fh4>\n\u003Cp>Trackserver requires PHP 7.3 or newer and it needs both DOMDocument and SimpleXML extensions installed.\u003C\u002Fp>\n\u003Ch4>Credits\u003C\u002Fh4>\n\u003Cp>This plugin was written by Martijn Grendelman. Development is tracked on \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Ftinuzz\u002Fwp-plugin-trackserver\" rel=\"nofollow ugc\">Github\u003C\u002Fa>.\u003C\u002Fp>\n\u003Cp>It includes some code and libraries written by other people:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"http:\u002F\u002Fleafletjs.com\u002F\" rel=\"nofollow ugc\">Leaflet.js\u003C\u002Fa> by Vladimir Agafonkin and others\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Femcconville\u002Fpolyline-encoder\" rel=\"nofollow ugc\">Polyline encoder\u003C\u002Fa> by Eric McConville\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fmapbox\u002Fleaflet-omnivore\" rel=\"nofollow ugc\">Leaflet-omnivore\u003C\u002Fa> by Mapbox\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002FLeaflet\u002FLeaflet.fullscreen\" rel=\"nofollow ugc\">Leaflet.fullscreen\u003C\u002Fa> by John Firebaugh and others\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Ftaylorhakes\u002Fpromise-polyfill\" rel=\"nofollow ugc\">Promise-polyfill\u003C\u002Fa> by Taylor Hakes\u003C\u002Fli>\n\u003C\u002Ful>\n","GPS Track Server for TrackMe, OruxMaps and others",400,21395,100,19,"2025-09-06T07:45:00.000Z","6.8.6","4.7","7.3",[20,21,22,23,24],"gps","map","mobile","track","tracking","https:\u002F\u002Fwww.grendelman.net\u002Fwp\u002Ftrackserver-wordpress-plugin\u002F","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Ftrackserver.5.1.1.zip",99,2,0,"2025-03-31 00:00:00","2026-07-22T17:31:50.256Z","no_bundle",[34,51],{"id":35,"url_slug":36,"title":37,"description":38,"plugin_slug":4,"theme_slug":39,"affected_versions":40,"patched_in_version":6,"severity":41,"cvss_score":42,"cvss_vector":43,"vuln_type":44,"published_date":30,"updated_date":45,"references":46,"days_to_patch":48,"patch_diff_files":49,"patch_trac_url":39,"research_status":39,"research_verified":50,"research_rounds_completed":29,"research_plan":39,"research_summary":39,"research_vulnerable_code":39,"research_fix_diff":39,"research_exploit_outline":39,"research_model_used":39,"research_started_at":39,"research_completed_at":39,"research_error":39,"poc_status":39,"poc_video_id":39,"poc_summary":39,"poc_steps":39,"poc_tested_at":39,"poc_wp_version":39,"poc_php_version":39,"poc_playwright_script":39,"poc_exploit_code":39,"poc_has_trace":50,"poc_model_used":39,"poc_verification_depth":39},"CVE-2025-30961","trackserver-authenticated-contributor-stored-cross-site-scripting-2","Trackserver \u003C= 5.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","The Trackserver plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",null,"\u003C=5.1.0","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2025-04-17 12:43:06",[47],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fbf5904b4-a2a5-4cbc-9e38-b41459cedb45?source=api-prod",18,[],false,{"id":52,"url_slug":53,"title":54,"description":55,"plugin_slug":4,"theme_slug":39,"affected_versions":56,"patched_in_version":57,"severity":41,"cvss_score":42,"cvss_vector":43,"vuln_type":44,"published_date":58,"updated_date":59,"references":60,"days_to_patch":62,"patch_diff_files":63,"patch_trac_url":39,"research_status":39,"research_verified":50,"research_rounds_completed":29,"research_plan":39,"research_summary":39,"research_vulnerable_code":39,"research_fix_diff":39,"research_exploit_outline":39,"research_model_used":39,"research_started_at":39,"research_completed_at":39,"research_error":39,"poc_status":39,"poc_video_id":39,"poc_summary":39,"poc_steps":39,"poc_tested_at":39,"poc_wp_version":39,"poc_php_version":39,"poc_playwright_script":39,"poc_exploit_code":39,"poc_has_trace":50,"poc_model_used":39,"poc_verification_depth":39},"CVE-2024-12505","trackserver-authenticated-contributor-stored-cross-site-scripting","Trackserver \u003C= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","The Trackserver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tsmap' shortcode in all versions up to, and including, 5.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","\u003C=5.0.2","5.0.3","2025-01-10 14:10:04","2025-01-11 02:20:54",[61],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F63ade911-f9e7-4b1c-87c8-78e7664feff7?source=api-prod",1,[],{"slug":7,"display_name":7,"profile_url":8,"plugin_count":62,"total_installs":11,"avg_security_score":27,"avg_patch_time_days":65,"trust_score":66,"computed_at":67},10,93,"2026-08-29T01:17:20.659Z",[69,89,110,130,149],{"slug":70,"name":71,"version":72,"author":73,"author_profile":74,"description":75,"short_description":76,"active_installs":77,"downloaded":78,"rating":79,"num_ratings":62,"last_updated":80,"tested_up_to":81,"requires_at_least":82,"requires_php":83,"tags":84,"homepage":87,"download_link":88,"security_score":13,"vuln_count":29,"unpatched_count":29,"last_vuln_date":39,"fetched_at":31},"spotmap","Spotmap","1.0.0","techtimo","https:\u002F\u002Fprofiles.wordpress.org\u002Ftechtimo\u002F","\u003Cp>Spotmap turns your WordPress site into a self-hosted GPS tracking platform. Connect your devices, and Spotmap stores every position in your own database — no third-party cloud required.\u003C\u002Fp>\n\u003Ch3>Supported devices (data feeds)\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>SPOT\u003C\u002Fstrong> (FindMeSPOT) — automatic feed polling via XML API\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Garmin inReach\u003C\u002Fstrong> — receives positions via Garmin’s MapShare feed\u003C\u002Fli>\n\u003Cli>\u003Cstrong>OsmAnd\u003C\u002Fstrong> — receives positions via HTTP from the OsmAnd smartphone app\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Teltonika\u003C\u002Fstrong> — direct integration for Teltonika GPS routers and trackers\u003C\u002Fli>\n\u003Cli>\u003Cstrong>WordPress Media Library\u003C\u002Fstrong> — photos with GPS EXIF data can appear on the map\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Post Locations\u003C\u002Fstrong> — assign GPS coordinates to any WordPresspost or page via the block editor sidebar. Posts appear on the map as clickable markers that link directly to the article so readers can jump from the map to the full story.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Zoleo\u003C\u002Fstrong> — if you have a Zoleo device please reach out to the plugin author\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Map & visualization\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>Interactive Leaflet map with full \u003Cstrong>Gutenberg block\u003C\u002Fstrong> support — type \u003Ccode>\u002Fspotmap\u003C\u002Fcode> in the editor\u003C\u002Fli>\n\u003Cli>Wide range of tile providers: OpenStreetMap, Mapbox, Thunderforest, LINZ (NZ), IGN France, UK Ordnance Survey, USGS, OpenSeaMap, ESRI Ocean, and any custom XYZ tile URL\u003C\u002Fli>\n\u003Cli>GPX track overlay via the built-in \u003Cstrong>GPX manager\u003C\u002Fstrong> — upload and manage GPX files for planned routes, waypoints, and recorded tracks\u003C\u002Fli>\n\u003Cli>Photo EXIF GPS display — images from your media library with location data appear on the map\u003C\u002Fli>\n\u003Cli>Configurable line breaks when no positions arrive within a set time interval\u003C\u002Fli>\n\u003Cli>Multiple feeds and devices on a single map, each with its own color\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Post location markers\u003C\u002Fstrong> — each marker shows the post title and links to the article, turning any map block into a navigable index of location-tagged content\u003C\u002Fli>\n\u003Cli>Configurable marker styles and icons\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Filtering & interaction\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>Rich \u003Cstrong>time filtering\u003C\u002Fstrong> including relative ranges like “last 24 hours” or “last 7 days”, and absolute date ranges\u003C\u002Fli>\n\u003Cli>Interactive \u003Cstrong>data table\u003C\u002Fstrong> linked to the map — click a check-in to zoom to that position\u003C\u002Fli>\n\u003Cli>Initial map state options: show all points, zoom to last position, or zoom to last trip\u003C\u002Fli>\n\u003Cli>Auto-refresh without full page reload\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Data management\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Long-term position storage\u003C\u002Fstrong> — your data stays in your WordPress database for as long as you want\u003C\u002Fli>\n\u003Cli>Convert tracked positions to \u003Cstrong>GPX export\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>Manage, move, and delete points from the WordPress dashboard\u003C\u002Fli>\n\u003Cli>Upload and organize GPX files through the GPX manager\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Performance\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>Rewritten map engine in TypeScript for better reliability\u003C\u002Fli>\n\u003Cli>Significantly faster rendering with large numbers of points compared to 0.11.x\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Why Spotmap?\u003C\u002Fh3>\n\u003Cp>Most GPS tracking solutions lock your data into a vendor cloud. SPOT’s own platform doesn’t even offer free long-term storage. Spotmap keeps everything on your server — whether you’re documenting a sailing trip, sharing a bike tour with friends and family, or tracking vehicles. Your data, your rules.\u003C\u002Fp>\n\u003Ch3>Security\u003C\u002Fh3>\n\u003Ch3>Message content and phone numbers\u003C\u002Fh3>\n\u003Cp>SPOT devices can include a phone number or personal message in their transmission data. This information is stored in the database and may appear in marker popups on your map.\u003Cbr \u002F>\nTo overwrite this content, use the \u003Cstrong>Marker\u003C\u002Fstrong> section in \u003Ccode>Settings > Spotmap\u003C\u002Fcode>.\u003Cbr \u002F>\nSetting a feed password in your SPOT account (and entering it in the plugin settings) ensures that the message content is not stored in the WordPress database and thus not accessible by the public.\u003C\u002Fp>\n\u003Ch3>Live location privacy\u003C\u002Fh3>\n\u003Cp>The plugin offers a cosmetic filter to hide points newer than a configurable threshold (e.g. 30 minutes, 2 hours, or 1 day). This prevents the most recent positions from appearing on the public map.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Important:\u003C\u002Fstrong> this filter is display-only. The REST API endpoint exposed by the plugin can return all points stored in the database, regardless of the block filter setting. There is currently no way to fully hide the latest positions from a technically capable visitor. If hiding live locations from the API is a requirement, you should restrict access to the REST API endpoint at the server or WordPress level.\u003C\u002Fp>\n\u003Ch3>Map tokens\u003C\u002Fh3>\n\u003Cp>API tokens for tile layer providers (Mapbox, Thunderforest, LINZ, IGN France, OS UK, etc.) are stored in WordPress settings and embedded in the page HTML at render time. Any visitor who views the page source can read your token.\u003C\u002Fp>\n\u003Cp>To reduce the risk of token abuse, \u003Cstrong>restrict each token to your domain using the provider’s referrer\u002FHTTP origin restrictions\u003C\u002Fstrong> (e.g. \u003Ccode>https:\u002F\u002Fyoursite.com\u002F*\u003C\u002Fcode>).\u003C\u002Fp>\n\u003Ch3>Shortcodes\u003C\u002Fh3>\n\u003Cp>If you use a legacy text editor and require shortcodes, you are able to use the shortcode builder from the settings page of Spotmap. there you can interactively create the shortcode you need.\u003C\u002Fp>\n\u003Cp>The following shortcodes are supported:\u003C\u002Fp>\n\u003Cp>\u003Cstrong>\u003Ccode>[spotmap]\u003C\u002Fcode>\u003C\u002Fstrong> — embeds an interactive map\u003Cbr \u002F>\n\u003Cstrong>\u003Ccode>[spotmessages]\u003C\u002Fcode>\u003C\u002Fstrong> — embeds a table of SPOT messages and check-ins\u003C\u002Fp>\n\u003Cp>For the full attribute reference, see \u003Cstrong>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Ftechtimo\u002FSpotmap\u002Fblob\u002Fmain\u002FREADME-SHORTCODE.md\" rel=\"nofollow ugc\">README-SHORTCODE.md\u003C\u002Fa>\u003C\u002Fstrong> on GitHub.\u003C\u002Fp>\n","Live GPS tracking for WordPress — display positions from SPOT, Garmin inReach, OsmAnd, Teltonika, and more on interactive maps.",40,2591,80,"2026-05-27T06:16:00.000Z","7.0.2","6.5","8.2",[20,85,86,21,24],"gpx","live-tracking","https:\u002F\u002Fgithub.com\u002Ftechtimo\u002Fspotmap","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fspotmap.1.0.0.zip",{"slug":90,"name":91,"version":92,"author":93,"author_profile":94,"description":95,"short_description":96,"active_installs":97,"downloaded":98,"rating":29,"num_ratings":29,"last_updated":99,"tested_up_to":100,"requires_at_least":101,"requires_php":102,"tags":103,"homepage":108,"download_link":109,"security_score":13,"vuln_count":29,"unpatched_count":29,"last_vuln_date":39,"fetched_at":31},"anonindo-heatmap-analytics","Anonindo Heatmap Analytics","2.2.5","Akshay Vasoya","https:\u002F\u002Fprofiles.wordpress.org\u002Fanonymoustech\u002F","\u003Cp>Anonindo Heatmap Analytics records anonymous visitor interactions on the front end of your WordPress site and turns them into built-in heatmap reports.\u003C\u002Fp>\n\u003Cp>The plugin is designed for site owners who want to review page-level behavior without relying on an external analytics account. Recorded event data is stored in your WordPress database and viewed from the WordPress admin area.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Features\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Track anonymous click, scroll, and hover activity on public pages.\u003C\u002Fli>\n\u003Cli>Review a heatmap overlay, trend charts, and event tables inside WordPress.\u003C\u002Fli>\n\u003Cli>Keep reports in WordPress with no third-party dashboard required.\u003C\u002Fli>\n\u003Cli>Exclude administrators from tracking to avoid contaminating reports.\u003C\u002Fli>\n\u003Cli>Configure how many days interaction data should be retained.\u003C\u002Fli>\n\u003C\u002Ful>\n","Record anonymous clicks, scroll depth, and hover activity, then review heatmap reports directly inside WordPress.",20,179,"2026-04-22T02:15:00.000Z","6.9.5","6.2","7.2",[104,105,106,107],"analytics","click-tracking","heatmap","visitor-behavior","","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fanonindo-heatmap-analytics.2.2.5.zip",{"slug":111,"name":112,"version":113,"author":114,"author_profile":115,"description":116,"short_description":117,"active_installs":97,"downloaded":118,"rating":29,"num_ratings":29,"last_updated":119,"tested_up_to":120,"requires_at_least":121,"requires_php":108,"tags":122,"homepage":127,"download_link":128,"security_score":129,"vuln_count":29,"unpatched_count":29,"last_vuln_date":39,"fetched_at":31},"geo-location","Geo Location","2.5.1","UjW0L","https:\u002F\u002Fprofiles.wordpress.org\u002Fujw0l\u002F","\u003Cp>This plugin lets you track vistors IP and Map them in Bing Map, or just can be use in backend only. Good for tracking website activities based on geographical region.\u003C\u002Fp>\n\u003Cp>This plugin also lets you block users based on IP address from admin menu.\u003C\u002Fp>\n\u003Cp>You can also use it with out IPinfoDB API key, just to block IP address, however Location functionality will not work.\u003C\u002Fp>\n\u003Cp>It displays all of the unique vistiors on the bing map\u003C\u002Fp>\n\u003Cp>You need to get IPinfobd API key from\u003Cbr \u002F>\nhttps:\u002F\u002Fipinfodb.com\u002Fregister.php\u003C\u002Fp>\n\u003Cp>Bing Map API key from(Developers have option of getting free key)\u003Cbr \u002F>\nhttps:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fmaps\u002Fchoose-your-bing-maps-api\u003C\u002Fp>\n\u003Cp>Note:\u003C\u002Fp>\n","Plugin that that collect geological info of visitors and display them in Bing Map and gives admin ability to block them.",6102,"2024-08-27T03:20:00.000Z","4.9.29","3.5",[123,124,125,24,126],"bing-map","ip-tracking","mapping","visitor","https:\u002F\u002Fgithub.com\u002Fujw0l\u002Fgeo_location","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fgeo-location.zip",85,{"slug":131,"name":132,"version":72,"author":133,"author_profile":134,"description":135,"short_description":136,"active_installs":65,"downloaded":137,"rating":29,"num_ratings":29,"last_updated":138,"tested_up_to":139,"requires_at_least":140,"requires_php":141,"tags":142,"homepage":108,"download_link":146,"security_score":147,"vuln_count":29,"unpatched_count":29,"last_vuln_date":39,"fetched_at":148},"boat-tracker","Boat Tracker","Skipperblogs","https:\u002F\u002Fprofiles.wordpress.org\u002Fskipperblgs\u002F","\u003Cp>Track your boat with AIS, Iridium, Garmin InReach SPOT, E-mail and embed a live map on your website with this \u003Ca href=\"https:\u002F\u002Fwww.skipperblogs.com\u002F?source=wp\" rel=\"nofollow ugc\">Skipperblogs\u003C\u002Fa> WordPress plugin.\u003Cbr \u002F>\nYour position will be live updated anywhere in the world with custom messages and weather. Map statistics shows the total distance sailed, average speed etc… as well as visited countries.\u003Cbr \u002F>\nPerfect for a travel website to highlight your sailing achievements.\u003C\u002Fp>\n\u003Cp>While the free version of Skipperblogs allows you to create a map, import GPX files, and edit your track with a powerful editor, the Premium version allow you to automatically update your position through marine trackers like AIS, Iridium etc.\u003C\u002Fp>\n\u003Cp>In order to display the map your must create a free account on \u003Ca href=\"https:\u002F\u002Fwww.skipperblogs.com\u002Fregister?source=wp\" rel=\"nofollow ugc\">Skipperblogs\u003C\u002Fa>. This plugin will send your MapId to fetch your navigation data from Skipperblogs and display it on your WordPress site.\u003Cbr \u002F>\nIt uses Leaflet.js to display the navigation data on OpenStreetMap tiles layer.\u003C\u002Fp>\n\u003Ch3>Adding the map\u003C\u002Fh3>\n\u003Cp>Simply display the \u003Cstrong>map\u003C\u002Fstrong> in your content with the shortcode:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>[boat-tracker]\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>The above shortcode will display a map centered on the last position of your boat.\u003Cbr \u002F>\nTo customize the map dimension add the following attributes to the short code\u003C\u002Fp>\n\u003Cpre>\u003Ccode>[boat-tracker width=\"200\" width=\"100%\"]\u003Ch3>Personalize the map\u003C\u002Fh3>\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Log-in to your Skipperblogs’ account and open the map editor under Dashboard > Navigation > Map\u003Cbr \u002F>\nThere you can change your boat icon, track style, map background and many more.\u003C\u002Fp>\n\u003Ch3>Free version\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>Interactive map\u003C\u002Fli>\n\u003Cli>Manual tracking\u003C\u002Fli>\n\u003Cli>Customize map background and traces\u003C\u002Fli>\n\u003Cli>Track editor to freely edit your trace\u003C\u002Fli>\n\u003Cli>Import GPS trace from GPX files, PredictWind, Saiblogs, FollowingSea, Farkwar\u003C\u002Fli>\n\u003Cli>And more\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Explore the full list of \u003Ca href=\"https:\u002F\u002Fwww.skipperblogs.com\u002Ffeatures\u002F?source=wp\" rel=\"nofollow ugc\">Skipperblogs features\u003C\u002Fa>.\u003C\u002Fp>\n\u003Ch3>Premium & Pro version\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>Automatic tracking\n\u003Cul>\n\u003Cli>AIS\u003C\u002Fli>\n\u003Cli>Iridium\u003C\u002Fli>\n\u003Cli>Mobile App\u003C\u002Fli>\n\u003Cli>Garmin InReach\u003C\u002Fli>\n\u003Cli>SPOT\u003C\u002Fli>\n\u003Cli>Telegram\u003C\u002Fli>\n\u003Cli>Skymate\u003C\u002Fli>\n\u003Cli>SSB radio\u003C\u002Fli>\n\u003Cli>E-mail\u003C\u002Fli>\n\u003Cli>API\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Windy Weather map\u003C\u002Fli>\n\u003Cli>Custom boat icon\u003C\u002Fli>\n\u003Cli>Automatic visited countries\u003C\u002Fli>\n\u003Cli>And more\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Unlock advanced features with \u003Ca href=\"https:\u002F\u002Fwww.skipperblogs.com\u002Fpricing\u002F?source=wp\" rel=\"nofollow ugc\">Skipperblogs Premium or Pro\u003C\u002Fa>.\u003C\u002Fp>\n\u003Ch3>OUR USERS LOVE IT!\u003C\u002Fh3>\n\u003Cp>We are proud to have near perfect 5\u002F5 score on Trustpilot:\u003C\u002Fp>\n\u003Cp>\u003Cem>“I think it’s a great app for keeping track of your sail trips, both past, current and future. Unlike most (or rather all) apps, the map can be embedded on other websites. Also love the track details,”\u003C\u002Fem> – L.Delboca\u003C\u002Fp>\n\u003Cp>\u003Cem>“We are very happy with our new website and Alain has been a real star helping us build it and making modifications to suit our needs. For us, one of the main attractions is that we can send photos to the website using email – even from our very slow IridiumGo. Alain has always been very quick with responses to our requests and has given very good explanations and guidance.”\u003C\u002Fem> – Andrez Short S\u002FV Kelper\u003C\u002Fp>\n\u003Ch3>Terms of use\u003C\u002Fh3>\n\u003Cp>While this plugin is distributed under GNU-GPLv2 licence, the use of skipperblogs.com services remains under the acceptance of terms of use and privacy policies:\u003Cbr \u002F>\n\u003Ca href=\"https:\u002F\u002Fwww.skipperblogs.com\u002Fterms\" rel=\"nofollow ugc\">https:\u002F\u002Fwww.skipperblogs.com\u002Fterms\u003C\u002Fa>\u003Cbr \u002F>\n\u003Ca href=\"https:\u002F\u002Fwww.skipperblogs.com\u002Fterms\u002Fprivacy\" rel=\"nofollow ugc\">https:\u002F\u002Fwww.skipperblogs.com\u002Fterms\u002Fprivacy\u003C\u002Fa>\u003C\u002Fp>\n","Track your boat around the globe with Iridium, AIS, InReach, PredictWind, SPOT, Startlink, etc, and display an interactive map on your website.",546,"2024-11-09T18:24:00.000Z","6.6.5","4.6","5.4",[143,144,21,24,145],"boat","embed","vessel","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fboat-tracker.zip",92,"2026-04-16T10:56:18.058Z",{"slug":150,"name":151,"version":152,"author":153,"author_profile":154,"description":155,"short_description":156,"active_installs":65,"downloaded":157,"rating":29,"num_ratings":29,"last_updated":158,"tested_up_to":159,"requires_at_least":160,"requires_php":108,"tags":161,"homepage":165,"download_link":166,"security_score":129,"vuln_count":29,"unpatched_count":29,"last_vuln_date":39,"fetched_at":148},"crazyegg-integrator-for-wordpress","CrazyEgg Integrator for WordPress","1.0","cardanopress","https:\u002F\u002Fprofiles.wordpress.org\u002Fpbwebdev\u002F","\u003Ch4>Plugin Overview: \u003C\u002Fh4>\n\u003Cp>This plugin will allow you to integrate in the CrazyEgg integration code into your website without the need of modifying your websites code or themes.\u003C\u002Fp>\n\u003Ch4>CrazyEgg:\u003C\u002Fh4>\n\u003Cp>CrazyEgg allows you to track your users site usage and see on a visual map just where they are clicking and how they use your website. This in turn will give you an idea of the usability of your website. CrazyEgg does have a subscription fee.\u003C\u002Fp>\n","Add the Crazyegg code required to integrate it to your WordPress site",2072,"2011-01-05T09:57:00.000Z","3.0.5","3.0",[162,106,163,164],"crazyegg","pb-web-development","user-tracking","http:\u002F\u002Fwww.pbwebdev.com.au\u002Fblog\u002Fcrazyegg-integrator-wordpress","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcrazyegg-integrator-for-wordpress.zip",{"attackSurface":168,"codeSignals":267,"taintFlows":303,"riskAssessment":581,"analyzedAt":590},{"hooks":169,"ajaxHandlers":259,"restRoutes":264,"shortcodes":265,"cronEvents":266,"entryPointCount":62,"unprotectedCount":62},[170,175,178,181,186,189,193,196,200,204,208,211,214,219,223,226,229,232,235,238,242,246,250,254],{"type":171,"name":172,"callback":172,"file":173,"line":174},"action","admin_init","class-trackserver-admin.php",56,{"type":171,"name":176,"callback":176,"file":173,"line":177},"admin_head",57,{"type":171,"name":179,"callback":179,"file":173,"line":180},"add_meta_boxes",58,{"type":182,"name":183,"callback":184,"priority":65,"file":173,"line":185},"filter","default_content","embedded_map_default_content",59,{"type":182,"name":187,"callback":187,"priority":65,"file":173,"line":188},"plugin_row_meta",60,{"type":171,"name":190,"callback":190,"priority":191,"file":173,"line":192},"admin_menu",9,61,{"type":171,"name":194,"callback":194,"file":173,"line":195},"admin_enqueue_scripts",62,{"type":182,"name":197,"callback":198,"file":173,"line":199},"plugin_action_links_trackserver\u002Ftrackserver.php","add_settings_link",63,{"type":171,"name":201,"callback":202,"file":173,"line":203},"admin_post_trackserver_save_track","admin_post_save_track",64,{"type":171,"name":205,"callback":206,"file":173,"line":207},"admin_post_trackserver_upload_track","admin_post_upload_track",67,{"type":171,"name":209,"callback":209,"file":173,"line":210},"wpmu_new_blog",71,{"type":182,"name":212,"callback":212,"file":173,"line":213},"wpmu_drop_tables",72,{"type":171,"name":215,"callback":216,"file":217,"line":218},"trackserver_add_settings_sections","add_sections","class-trackserver-settings.php",37,{"type":171,"name":220,"callback":220,"file":221,"line":222},"wp_loaded","class-trackserver.php",217,{"type":171,"name":224,"callback":224,"file":221,"line":225},"parse_request",220,{"type":171,"name":227,"callback":227,"file":221,"line":228},"wp_enqueue_scripts",223,{"type":171,"name":230,"callback":230,"file":221,"line":231},"wp_footer",224,{"type":182,"name":233,"callback":233,"file":221,"line":234},"upload_mimes",230,{"type":182,"name":236,"callback":236,"priority":65,"file":221,"line":237},"media_send_to_editor",231,{"type":171,"name":239,"callback":240,"file":221,"line":241},"init","wp_init",234,{"type":182,"name":243,"callback":244,"file":221,"line":245},"single_template","get_tsmap_single_template",235,{"type":182,"name":247,"callback":248,"file":221,"line":249},"404_template","get_tsmap_404_template",236,{"type":182,"name":251,"callback":252,"file":221,"line":253},"show_admin_bar","hide_tsmap_admin_bar",237,{"type":171,"name":255,"callback":256,"priority":257,"file":221,"line":258},"wp_head","tsmap_dequeue_scripts",5,376,[260],{"action":261,"nopriv":50,"callback":262,"hasNonce":50,"hasCapCheck":50,"file":173,"line":263},"trackserver_save_track","admin_ajax_save_modified_track",68,[],[],[],{"dangerousFunctions":268,"sqlUsage":269,"outputEscaping":275,"fileOperations":62,"externalRequests":28,"nonceChecks":300,"capabilityChecks":301,"bundledLibraries":302},[],{"prepared":263,"raw":28,"locations":270},[271,274],{"file":272,"line":191,"context":273},"uninstall.php","$wpdb->query() with variable interpolation",{"file":272,"line":65,"context":273},{"escaped":276,"rawEcho":191,"locations":277},126,[278,282,284,286,289,291,293,295,298],{"file":279,"line":280,"context":281},"class-trackserver-mapmytracks.php",89,"raw output",{"file":217,"line":283,"context":281},568,{"file":217,"line":285,"context":281},620,{"file":287,"line":288,"context":281},"class-trackserver-shortcode.php",729,{"file":287,"line":290,"context":281},780,{"file":287,"line":292,"context":281},859,{"file":287,"line":294,"context":281},887,{"file":296,"line":297,"context":281},"class-trackserver-ulogger.php",74,{"file":221,"line":299,"context":281},1611,12,8,[],[304,320,335,360,377,411,423,445,458,471,480,499,510,518,546],{"entryPoint":305,"graph":306,"unsanitizedCount":62,"severity":41},"process_profile_update (class-trackserver.php:1473)",{"nodes":307,"edges":318},[308,313],{"id":309,"type":310,"label":311,"file":221,"line":312},"n0","source","$_REQUEST['_wp_http_referer']",1541,{"id":314,"type":315,"label":316,"file":221,"line":312,"wp_function":317},"n1","sink","wp_redirect() [Open Redirect]","wp_redirect",[319],{"from":309,"to":314,"sanitized":50},{"entryPoint":321,"graph":322,"unsanitizedCount":29,"severity":334},"manage_tracks_html (class-trackserver-admin.php:444)",{"nodes":323,"edges":331},[324,327],{"id":309,"type":310,"label":325,"file":173,"line":326},"$_REQUEST",453,{"id":314,"type":315,"label":328,"file":173,"line":329,"wp_function":330},"echo() [XSS]",466,"echo",[332],{"from":309,"to":314,"sanitized":333},true,"low",{"entryPoint":336,"graph":337,"unsanitizedCount":29,"severity":334},"admin_post_save_track (class-trackserver-admin.php:609)",{"nodes":338,"edges":356},[339,342,344,347,351],{"id":309,"type":310,"label":340,"file":173,"line":341},"$_POST",653,{"id":314,"type":315,"label":316,"file":173,"line":343,"wp_function":317},655,{"id":345,"type":310,"label":325,"file":173,"line":346},"n2",628,{"id":348,"type":349,"label":350,"file":173,"line":346},"n3","transform","→ wpdb_split_track()",{"id":352,"type":315,"label":353,"file":173,"line":354,"wp_function":355},"n4","query() [SQLi]",826,"query",[357,358,359],{"from":309,"to":314,"sanitized":333},{"from":345,"to":348,"sanitized":50},{"from":348,"to":352,"sanitized":333},{"entryPoint":361,"graph":362,"unsanitizedCount":29,"severity":334},"process_bulk_action (class-trackserver-admin.php:662)",{"nodes":363,"edges":374},[364,367,369,372],{"id":309,"type":310,"label":365,"file":173,"line":366},"$_POST (x4)",672,{"id":314,"type":315,"label":316,"file":173,"line":368,"wp_function":317},687,{"id":345,"type":310,"label":370,"file":173,"line":371},"$_REQUEST (x5)",667,{"id":348,"type":315,"label":353,"file":173,"line":373,"wp_function":355},701,[375,376],{"from":309,"to":314,"sanitized":333},{"from":345,"to":348,"sanitized":333},{"entryPoint":378,"graph":379,"unsanitizedCount":29,"severity":334},"\u003Cclass-trackserver-admin> (class-trackserver-admin.php:0)",{"nodes":380,"edges":404},[381,382,383,385,386,388,390,393,398,400,402],{"id":309,"type":310,"label":325,"file":173,"line":326},{"id":314,"type":315,"label":328,"file":173,"line":329,"wp_function":330},{"id":345,"type":310,"label":384,"file":173,"line":341},"$_POST (x5)",{"id":348,"type":315,"label":316,"file":173,"line":343,"wp_function":317},{"id":352,"type":310,"label":387,"file":173,"line":371},"$_REQUEST (x8)",{"id":389,"type":315,"label":353,"file":173,"line":373,"wp_function":355},"n5",{"id":391,"type":310,"label":325,"file":173,"line":392},"n6",612,{"id":394,"type":315,"label":395,"file":173,"line":396,"wp_function":397},"n7","get_var() [SQLi]",806,"get_var",{"id":399,"type":310,"label":325,"file":173,"line":346},"n8",{"id":401,"type":349,"label":350,"file":173,"line":346},"n9",{"id":403,"type":315,"label":353,"file":173,"line":354,"wp_function":355},"n10",[405,406,407,408,409,410],{"from":309,"to":314,"sanitized":333},{"from":345,"to":348,"sanitized":333},{"from":352,"to":389,"sanitized":333},{"from":391,"to":394,"sanitized":333},{"from":399,"to":401,"sanitized":50},{"from":401,"to":403,"sanitized":333},{"entryPoint":412,"graph":413,"unsanitizedCount":29,"severity":334},"handle_gettrack (class-trackserver-shortcode.php:590)",{"nodes":414,"edges":421},[415,417],{"id":309,"type":310,"label":325,"file":287,"line":416},595,{"id":314,"type":315,"label":418,"file":287,"line":419,"wp_function":420},"get_results() [SQLi]",624,"get_results",[422],{"from":309,"to":314,"sanitized":333},{"entryPoint":424,"graph":425,"unsanitizedCount":29,"severity":334},"handle_gettrack_proxy (class-trackserver-shortcode.php:707)",{"nodes":426,"edges":441},[427,429,433,435,439,440],{"id":309,"type":310,"label":325,"file":287,"line":428},708,{"id":314,"type":315,"label":430,"file":287,"line":431,"wp_function":432},"wp_remote_get() [SSRF]",717,"wp_remote_get",{"id":345,"type":310,"label":434,"file":287,"line":428},"$_REQUEST (x2)",{"id":348,"type":315,"label":436,"file":287,"line":437,"wp_function":438},"header() [Header Injection]",721,"header",{"id":352,"type":310,"label":325,"file":287,"line":428},{"id":389,"type":315,"label":328,"file":287,"line":288,"wp_function":330},[442,443,444],{"from":309,"to":314,"sanitized":333},{"from":345,"to":348,"sanitized":333},{"from":352,"to":389,"sanitized":333},{"entryPoint":446,"graph":447,"unsanitizedCount":29,"severity":334},"setup_tracks_list_table (class-trackserver.php:1331)",{"nodes":448,"edges":455},[449,451,453],{"id":309,"type":310,"label":325,"file":221,"line":450},1351,{"id":314,"type":349,"label":452,"file":221,"line":450},"→ user_has_tracks()",{"id":345,"type":315,"label":395,"file":221,"line":454,"wp_function":397},1326,[456,457],{"from":309,"to":314,"sanitized":50},{"from":314,"to":345,"sanitized":333},{"entryPoint":459,"graph":460,"unsanitizedCount":29,"severity":334},"admin_ajax_save_modified_track (class-trackserver.php:1404)",{"nodes":461,"edges":468},[462,464,466],{"id":309,"type":310,"label":340,"file":221,"line":463},1423,{"id":314,"type":349,"label":465,"file":221,"line":463},"→ get_location_ids_by_index()",{"id":345,"type":315,"label":418,"file":221,"line":467,"wp_function":420},1396,[469,470],{"from":309,"to":314,"sanitized":50},{"from":314,"to":345,"sanitized":333},{"entryPoint":472,"graph":473,"unsanitizedCount":29,"severity":334},"admin_post_upload_track (class-trackserver.php:1457)",{"nodes":474,"edges":478},[475,477],{"id":309,"type":310,"label":311,"file":221,"line":476},1462,{"id":314,"type":315,"label":316,"file":221,"line":476,"wp_function":317},[479],{"from":309,"to":314,"sanitized":333},{"entryPoint":481,"graph":482,"unsanitizedCount":29,"severity":334},"\u003Cclass-trackserver> (class-trackserver.php:0)",{"nodes":483,"edges":493},[484,486,487,488,489,490,491,492],{"id":309,"type":310,"label":485,"file":221,"line":476},"$_REQUEST['_wp_http_referer'] (x2)",{"id":314,"type":315,"label":316,"file":221,"line":476,"wp_function":317},{"id":345,"type":310,"label":325,"file":221,"line":450},{"id":348,"type":349,"label":452,"file":221,"line":450},{"id":352,"type":315,"label":395,"file":221,"line":454,"wp_function":397},{"id":389,"type":310,"label":340,"file":221,"line":463},{"id":391,"type":349,"label":465,"file":221,"line":463},{"id":394,"type":315,"label":418,"file":221,"line":467,"wp_function":420},[494,495,496,497,498],{"from":309,"to":314,"sanitized":333},{"from":345,"to":348,"sanitized":50},{"from":348,"to":352,"sanitized":333},{"from":389,"to":391,"sanitized":50},{"from":391,"to":394,"sanitized":333},{"entryPoint":500,"graph":501,"unsanitizedCount":62,"severity":509},"handle_upload_activity (class-trackserver-mapmytracks.php:177)",{"nodes":502,"edges":507},[503,505],{"id":309,"type":310,"label":340,"file":279,"line":504},191,{"id":314,"type":315,"label":353,"file":279,"line":506,"wp_function":355},192,[508],{"from":309,"to":314,"sanitized":50},"high",{"entryPoint":511,"graph":512,"unsanitizedCount":62,"severity":509},"\u003Cclass-trackserver-mapmytracks> (class-trackserver-mapmytracks.php:0)",{"nodes":513,"edges":516},[514,515],{"id":309,"type":310,"label":340,"file":279,"line":504},{"id":314,"type":315,"label":353,"file":279,"line":506,"wp_function":355},[517],{"from":309,"to":314,"sanitized":50},{"entryPoint":519,"graph":520,"unsanitizedCount":62,"severity":509},"handle_gettrack_query (class-trackserver-shortcode.php:644)",{"nodes":521,"edges":540},[522,524,526,528,530,534,536,538],{"id":309,"type":310,"label":325,"file":287,"line":523},647,{"id":314,"type":315,"label":418,"file":287,"line":525,"wp_function":420},684,{"id":345,"type":310,"label":325,"file":287,"line":527},675,{"id":348,"type":349,"label":529,"file":287,"line":527},"→ validate_track_ids()",{"id":352,"type":315,"label":531,"file":287,"line":532,"wp_function":533},"get_col() [SQLi]",992,"get_col",{"id":389,"type":310,"label":325,"file":287,"line":535},676,{"id":391,"type":349,"label":537,"file":287,"line":535},"→ validate_user_ids()",{"id":394,"type":315,"label":531,"file":287,"line":539,"wp_function":533},1031,[541,542,543,544,545],{"from":309,"to":314,"sanitized":333},{"from":345,"to":348,"sanitized":50},{"from":348,"to":352,"sanitized":333},{"from":389,"to":391,"sanitized":50},{"from":391,"to":394,"sanitized":50},{"entryPoint":547,"graph":548,"unsanitizedCount":62,"severity":509},"\u003Cclass-trackserver-shortcode> (class-trackserver-shortcode.php:0)",{"nodes":549,"edges":571},[550,551,552,553,554,555,556,557,558,559,560,561,563,565,567,569],{"id":309,"type":310,"label":434,"file":287,"line":416},{"id":314,"type":315,"label":418,"file":287,"line":419,"wp_function":420},{"id":345,"type":310,"label":325,"file":287,"line":428},{"id":348,"type":315,"label":430,"file":287,"line":431,"wp_function":432},{"id":352,"type":310,"label":434,"file":287,"line":428},{"id":389,"type":315,"label":436,"file":287,"line":437,"wp_function":438},{"id":391,"type":310,"label":325,"file":287,"line":428},{"id":394,"type":315,"label":328,"file":287,"line":288,"wp_function":330},{"id":399,"type":310,"label":434,"file":287,"line":523},{"id":401,"type":315,"label":531,"file":287,"line":532,"wp_function":533},{"id":403,"type":310,"label":325,"file":287,"line":527},{"id":562,"type":349,"label":529,"file":287,"line":527},"n11",{"id":564,"type":315,"label":531,"file":287,"line":532,"wp_function":533},"n12",{"id":566,"type":310,"label":325,"file":287,"line":535},"n13",{"id":568,"type":349,"label":537,"file":287,"line":535},"n14",{"id":570,"type":315,"label":531,"file":287,"line":539,"wp_function":533},"n15",[572,573,574,575,576,577,578,579,580],{"from":309,"to":314,"sanitized":333},{"from":345,"to":348,"sanitized":333},{"from":352,"to":389,"sanitized":333},{"from":391,"to":394,"sanitized":333},{"from":399,"to":401,"sanitized":333},{"from":403,"to":562,"sanitized":50},{"from":562,"to":564,"sanitized":333},{"from":566,"to":568,"sanitized":50},{"from":568,"to":570,"sanitized":50},{"summary":582,"deductions":583},"The \"trackserver\" v5.1.1 plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices such as a high percentage of prepared SQL statements and properly escaped output. The plugin also implements a significant number of nonce and capability checks, indicating an awareness of common WordPress security vulnerabilities.\n\nHowever, there are notable concerns. The presence of one unprotected AJAX handler represents a significant attack vector. The taint analysis reveals four high-severity flows with unsanitized paths, suggesting potential vulnerabilities that could be exploited if these paths are reachable by user input. Furthermore, the plugin has a history of two medium-severity Cross-Site Scripting (XSS) vulnerabilities, with the most recent one being in 2025. While currently unpatched CVEs are zero, this historical pattern of XSS, coupled with unsanitized taint flows, indicates a recurrent risk of input validation and output sanitization issues.\n\nIn conclusion, while \"trackserver\" has strengths in its use of prepared statements and output escaping, the unprotected AJAX handler and high-severity unsanitized taint flows are critical points of concern. The past XSS vulnerabilities, even if addressed in this version, suggest a need for vigilant review of input handling and sanitization throughout the plugin's codebase.",[584,586,588],{"reason":585,"points":65},"Unprotected AJAX handler",{"reason":587,"points":65},"High severity unsanitized taint flows",{"reason":589,"points":257},"History of XSS vulnerabilities","2026-03-16T19:42:51.726Z",{"wat":592,"direct":611},{"assetPaths":593,"generatorPatterns":601,"scriptPaths":602,"versionParams":603},[594,595,596,597,598,599,600],"\u002Fwp-content\u002Fplugins\u002Ftrackserver\u002Fcss\u002Ftrackserver-map.css","\u002Fwp-content\u002Fplugins\u002Ftrackserver\u002Fjs\u002Ftrackserver-map.js","\u002Fwp-content\u002Fplugins\u002Ftrackserver\u002Fcss\u002Ftrackserver-admin.css","\u002Fwp-content\u002Fplugins\u002Ftrackserver\u002Fjs\u002Ftrackserver-admin.js","\u002Fwp-content\u002Fplugins\u002Ftrackserver\u002Flib\u002Fleaflet.js","\u002Fwp-content\u002Fplugins\u002Ftrackserver\u002Flib\u002Fesri-leaflet.js","\u002Fwp-content\u002Fplugins\u002Ftrackserver\u002Flib\u002Ftrackserver.js",[],[595,598,599,600,597],[604,605,606,607,608,609,610],"trackserver\u002Fcss\u002Ftrackserver-map.css?ver=","trackserver\u002Fjs\u002Ftrackserver-map.js?ver=","trackserver\u002Fcss\u002Ftrackserver-admin.css?ver=","trackserver\u002Fjs\u002Ftrackserver-admin.js?ver=","trackserver\u002Flib\u002Fleaflet.js?ver=","trackserver\u002Flib\u002Fesri-leaflet.js?ver=","trackserver\u002Flib\u002Ftrackserver.js?ver=",{"cssClasses":612,"htmlComments":616,"htmlAttributes":623,"restEndpoints":627,"jsGlobals":630,"shortcodeOutput":635},[613,614,615],"trackserver-map","trackserver-admin-wrap","trackserver-upload-form",[617,618,619,620,621,622],"\u003C!-- START TRACKSERVER TRACKLIST -->","\u003C!-- END TRACKSERVER TRACKLIST -->","\u003C!-- START TRACKSERVER UPLOAD FORM -->","\u003C!-- END TRACKSERVER UPLOAD FORM -->","\u003C!-- START TRACKSERVER MAP EMBED -->","\u003C!-- END TRACKSERVER MAP EMBED -->",[624,625,626],"data-trackserver-map-id","data-trackserver-map-options","data-trackserver-track-id",[628,629],"\u002Fwp-json\u002Ftrackserver\u002Fv1\u002Ftrack\u002F","\u002Fwp-json\u002Ftrackserver\u002Fv1\u002Ftracks\u002F",[631,632,633,634],"trackserver_map_settings","trackserver_tracks","trackserver_track_data","trackserver_tracklist",[636,637,638],"[trackserver_map]","[trackserver_tracklist]","[trackserver_upload_track]",{"error":333,"url":640,"statusCode":641,"statusMessage":642,"message":642},"http:\u002F\u002Flocalhost\u002Fapi\u002Fplugins\u002Ftrackserver\u002Fbundle",404,"no bundle for this plugin yet",{"slug":4,"current_version":6,"total_versions":644,"versions":645},4,[646,651,659,668],{"version":6,"download_url":26,"svn_tag_url":647,"released_at":39,"has_diff":50,"diff_files_changed":648,"diff_lines":39,"trac_diff_url":649,"vulnerabilities":650,"is_current":333},"https:\u002F\u002Fplugins.svn.wordpress.org\u002Ftrackserver\u002Ftags\u002F5.1.1\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Ftrackserver%2Ftags%2Fv5.0.3&new_path=%2Ftrackserver%2Ftags%2F5.1.1",[],{"version":652,"download_url":653,"svn_tag_url":654,"released_at":39,"has_diff":50,"diff_files_changed":655,"diff_lines":39,"trac_diff_url":656,"vulnerabilities":657,"is_current":50},"v5.0.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Ftrackserver.v5.0.3.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Ftrackserver\u002Ftags\u002Fv5.0.3\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Ftrackserver%2Ftags%2Fv2.2&new_path=%2Ftrackserver%2Ftags%2Fv5.0.3",[658],{"id":35,"url_slug":36,"title":37,"severity":41,"cvss_score":42,"vuln_type":44,"patched_in_version":6},{"version":660,"download_url":661,"svn_tag_url":662,"released_at":39,"has_diff":50,"diff_files_changed":663,"diff_lines":39,"trac_diff_url":664,"vulnerabilities":665,"is_current":50},"v2.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Ftrackserver.v2.2.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Ftrackserver\u002Ftags\u002Fv2.2\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Ftrackserver%2Ftags%2Fv2.1&new_path=%2Ftrackserver%2Ftags%2Fv2.2",[666,667],{"id":52,"url_slug":53,"title":54,"severity":41,"cvss_score":42,"vuln_type":44,"patched_in_version":57},{"id":35,"url_slug":36,"title":37,"severity":41,"cvss_score":42,"vuln_type":44,"patched_in_version":6},{"version":669,"download_url":670,"svn_tag_url":671,"released_at":39,"has_diff":50,"diff_files_changed":672,"diff_lines":39,"trac_diff_url":39,"vulnerabilities":673,"is_current":50},"v2.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Ftrackserver.v2.1.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Ftrackserver\u002Ftags\u002Fv2.1\u002F",[],[674,675],{"id":52,"url_slug":53,"title":54,"severity":41,"cvss_score":42,"vuln_type":44,"patched_in_version":57},{"id":35,"url_slug":36,"title":37,"severity":41,"cvss_score":42,"vuln_type":44,"patched_in_version":6}]