[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpG5x30TCo41XpCvo-RNT44JkgeUWN--91XTGWRHpWr0":3},{"slug":4,"name":5,"version":6,"author":7,"author_profile":8,"description":9,"short_description":10,"active_installs":11,"downloaded":12,"rating":13,"num_ratings":13,"last_updated":14,"tested_up_to":15,"requires_at_least":16,"requires_php":17,"tags":18,"homepage":24,"download_link":25,"security_score":26,"vuln_count":13,"unpatched_count":13,"last_vuln_date":27,"fetched_at":28,"vulnerabilities":29,"developer":30,"crawl_stats":27,"alternatives":36,"analysis":136,"fingerprints":172},"wp-simple-spamcheck","WP Simple SpamCheck","1.2","sdesalas","https:\u002F\u002Fprofiles.wordpress.org\u002Fsdesalas\u002F","\u003Cp>This plugin allows WordPress to block over 95% of spam comments using a time-based hash.\u003C\u002Fp>\n\u003Cp>This allows for a minimum sanity check and yet should remove almost all spam comments\u003Cbr \u002F>\nwithout the need to sign up to any third party APIs.\u003C\u002Fp>\n\u003Cp>The plugin has been tested in real world conditions for around 12 months. It will not block\u003Cbr \u002F>\nreal comments and it is pretty effective against spam, however it only uses a very simple\u003Cbr \u002F>\nalgorithm and for that reason some spam comments may still make it through.\u003C\u002Fp>\n","This plugin allows WordPress to block over 95% of spam comments using a time-based hash.",200,8639,0,"2012-07-11T22:28:00.000Z","3.4.2","2.0","",[19,20,21,22,23],"bots","check","comments","prevent","spam","http:\u002F\u002Fdesalasworks.com\u002Fwp-simple-spamcheck\u002F","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwp-simple-spamcheck.zip",85,null,"2026-03-15T15:16:48.613Z",[],{"slug":7,"display_name":7,"profile_url":8,"plugin_count":31,"total_installs":32,"avg_security_score":26,"avg_patch_time_days":33,"trust_score":34,"computed_at":35},2,700,30,84,"2026-04-04T21:06:20.130Z",[37,59,83,102,120],{"slug":38,"name":39,"version":40,"author":41,"author_profile":42,"description":43,"short_description":44,"active_installs":45,"downloaded":46,"rating":47,"num_ratings":48,"last_updated":49,"tested_up_to":50,"requires_at_least":51,"requires_php":52,"tags":53,"homepage":56,"download_link":57,"security_score":58,"vuln_count":13,"unpatched_count":13,"last_vuln_date":27,"fetched_at":28},"block-comment-spam-bots","Block Comment Spam Bots","2.62","Rick Hellewell","https:\u002F\u002Fprofiles.wordpress.org\u002Frhellewellgmailcom\u002F","\u003Cp>Professional spammers use programs to automate their spamming. The ‘Block Comment Spam Bots’ (BCSB) plugin efficiently blocks their process. No more comment spam!\u003C\u002Fp>\n\u003Cp>As no legitimate user will use the professional spammer’s automated process which relies on cURL and WGET commands, real users will never notice the BCSB plugin at work. There are no CAPTCHAS for your visitors to interact with. No silly questions. Just the comment form as designed in any theme.\u003C\u002Fp>\n\u003Cp>On the admin side, there are no blacklists, special keys (like Askimet), overloaded spam queues, or overworked databases that store spam comments until you manually delete them.\u003C\u002Fp>\n\u003Cp>Install the plugin and that’s it. Invisible, to you and your visitors. The only change you will notice is in your admin area. The list of comments now has a green check next to them. That way you know that comment was made on your website by a real person and was not bypassed by hacking spammers connecting directly to your server.\u003C\u002Fp>\n\u003Cp>All that remains is comments made by real people, and while real people can spam, it takes them time and effort. The amount of spam from real people is a lot more manageable than the tsunami from automated spammers, saving you time to concentrate on the important things in life, like your readers, and making connections.\u003C\u002Fp>\n\u003Cp>We’ve tested it on multiple websites and it wipes out automated spam completely. If it doesn’t on your site, please let us know.\u003C\u002Fp>\n\u003Cp>** Geeky Stuff **\u003Cbr \u002F>\n…in case you are interested in how it works…\u003C\u002Fp>\n\u003Cp>tl;dr – \u003Cstrong>This provides a total and easy solution to comment spam from spam bots.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Comments are processed by the WordPress wp-post-comments.php file. Automated spammers (‘spam bots’) can provide (‘post’) data directly to that page, bypassing any comment processing, by using CURL\u002FWGET commands.\u003C\u002Fp>\n\u003Cp>Bypassing the comment form by posting directly (via CURL or WGET commands), is quite easy. Just send the post ID number, and the bot’s fake name and email, and the spammy content. Boom! Comment spam is on your site!\u003C\u002Fp>\n\u003Cp>The result is comment spam – and that is not always caught by other comment spam checkers. Even if it is caught by programs such as Akismet, processing that spam takes some server resources, including writing to the database.\u003C\u002Fp>\n\u003Cp>This plugin uses several techniques to ‘sense’ a spambot. There are hidden fields that are changed after a delay. There is a delay in displaying the submit button. And it blocks direct access to the WordPress post\u002Fprocessing functions.\u003C\u002Fp>\n\u003Cp>The techniques, also used in our standalone “FormSpemmerTrap” (FST) program, and our other anti-spam plugins (like FormSpammerTrap for Comments), are very effective. They use a bit of JavaScript to block spambots – since automated processes via CURL\u002FWGET\u002Fetc cannot process JS code.\u003C\u002Fp>\n\u003Cp>It’s simple: you install this plugin, activate it, and bot comments will stop. Immediately.\u003C\u002Fp>\n\u003Cp>And it doesn’t add any visual impediments to your comments. No reCaptcha things (which many see as a pain). No silly questions (‘what is 2+8’) on the form. Your comment form does not change. Regular users will not notice a difference. But you will. No more spam comments for you!\u003C\u002Fp>\n\u003Cp>\u003Cstrong>This is the best solution to block comment spam.\u003C\u002Fstrong> We’ve tested it on a site that had 20-40 spam comments a day. With this plugin enabled, the spam comment stopped. Immediately. And there have been none since installing this plugin. ** Not one. Zero.**\u003C\u002Fp>\n\u003Cp>The Admin, Comments list page is modified to show a column with a green checkmark icon if the comment was entered by a real person and not a bot. This is an assurance that the comment was not entered via an automated CURL\u002FWGET to the wp-comments-post.php file. A comment that is on the list that does not show the checkmark was done by a bot. But you won’t see those blocked comments with this plugin enabled. They never get into your database. You can hover over the checkmark icon to see the GUID value indicating a person entered the comment.\u003C\u002Fp>\n\u003Cp>The plugins ‘Settings’ screen has no settings. You don’t even need to look at the Settings screen. If you do, you’ll see information about the plugin. And there is a CURL command you can use to test the effectiveness of blocking (or not blocking) direct access to the wp-comments-post.php file.\u003C\u002Fp>\n\u003Cp>The plugin also adds the hidden GUID field to the comment form after a delay to help block bots that are using the comment form to submit. If the hidden field is not submitted then a bot tried to bypass the comment form. And a short delay happens before the comment submit button is displayed – another bot protection.\u003C\u002Fp>\n","A simple to use plugin that stops automated spam. Install and forget, and any automated spam targeting your native WordPress comments is immediately t …",800,6808,100,4,"2024-04-10T22:16:00.000Z","6.5.8","4.9","5.4",[54,55,19,21,23],"automated-spam","blocking","https:\u002F\u002Fwww.cellarweb.com\u002Fwordpress-plugins\u002F","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fblock-comment-spam-bots.zip",92,{"slug":60,"name":61,"version":62,"author":63,"author_profile":64,"description":65,"short_description":66,"active_installs":67,"downloaded":68,"rating":69,"num_ratings":70,"last_updated":71,"tested_up_to":72,"requires_at_least":73,"requires_php":74,"tags":75,"homepage":17,"download_link":81,"security_score":58,"vuln_count":48,"unpatched_count":13,"last_vuln_date":82,"fetched_at":28},"debounce-io-email-validator","DeBounce Email Validator","5.8.7","debounce","https:\u002F\u002Fprofiles.wordpress.org\u002Fdebounce\u002F","\u003Ch3>🚀 Transform Your Email Quality with AI-Powered Validation\u003C\u002Fh3>\n\u003Cp>Tired of fake emails, spam traps, and disposable addresses cluttering your database? DeBounce Email Validator is the ultimate solution for WordPress websites that demand real, deliverable email addresses.\u003C\u002Fp>\n\u003Ch3>Why Choose DeBounce?\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>99.9% Accuracy Rate\u003C\u002Fstrong> – Industry-leading validation precision  \u003C\u002Fli>\n\u003Cli>\u003Cstrong>Zero IP Impact\u003C\u002Fstrong> – No emails sent, no blacklisting risk  \u003C\u002Fli>\n\u003Cli>\u003Cstrong>GDPR Compliant\u003C\u002Fstrong> – Complete privacy protection  \u003C\u002Fli>\n\u003Cli>\u003Cstrong>Real-time Validation\u003C\u002Fstrong> – Instant feedback for users  \u003C\u002Fli>\n\u003Cli>\u003Cstrong>Advanced AI Detection\u003C\u002Fstrong> – Catches sophisticated spam attempts\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Perfect For\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>E-commerce stores (WooCommerce)  \u003C\u002Fli>\n\u003Cli>Lead generation forms  \u003C\u002Fli>\n\u003Cli>User registration systems  \u003C\u002Fli>\n\u003Cli>Contact forms  \u003C\u002Fli>\n\u003Cli>Newsletter signups  \u003C\u002Fli>\n\u003Cli>Any WordPress form  \u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Install, connect your API key, and watch your email quality soar while reducing spam and improving conversion rates.\u003C\u002Fp>\n\u003Ch3>Supported Forms and Plugins\u003C\u002Fh3>\n\u003Cp>\u003Cstrong>🛒 E-COMMERCE & BUSINESS FORMS\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>WooCommerce – Validate shipping and billing emails  \u003C\u002Fli>\n\u003Cli>Gravity Forms – Enterprise-grade form validation  \u003C\u002Fli>\n\u003Cli>Contact Form 7 – Most popular contact form plugin  \u003C\u002Fli>\n\u003Cli>WPForms – Drag & drop form builder  \u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>🏗️ ADVANCED FORM BUILDERS\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Ninja Forms – Professional form creation  \u003C\u002Fli>\n\u003Cli>Formidable Forms – Complex form solutions  \u003C\u002Fli>\n\u003Cli>Forminator – Modern form builder  \u003C\u002Fli>\n\u003Cli>Fluent Forms – Advanced form management  \u003C\u002Fli>\n\u003Cli>Elementor Forms – Page builder integration  \u003C\u002Fli>\n\u003Cli>WSForms – Premium form builder  \u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>⚙️ WORDPRESS CORE FEATURES\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>WordPress Comments – Validate commenter emails  \u003C\u002Fli>\n\u003Cli>User Registration – Ensure valid signup emails  \u003C\u002Fli>\n\u003Cli>Jetpack Forms – Automattic’s form solution  \u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>🔧 CUSTOM INTEGRATION\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Any Custom Form – Works with \u003Ccode>is_email()\u003C\u002Fcode> function  \u003C\u002Fli>\n\u003Cli>Third-party Plugins – Automatic compatibility  \u003C\u002Fli>\n\u003Cli>API Integration – Direct API access available\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Key Features\u003C\u002Fh3>\n\u003Cp>\u003Cstrong>🔍 CORE VALIDATION CHECKS\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>DNS & MX Record Validation – Verify domain authenticity  \u003C\u002Fli>\n\u003Cli>Syntax Verification – IETF\u002FRFC standard compliance  \u003C\u002Fli>\n\u003Cli>Mailbox Existence – Confirm email actually exists  \u003C\u002Fli>\n\u003Cli>SMTP Connection Testing – Real server verification  \u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>🛡️ SECURITY & SPAM PROTECTION\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Disposable Email Detection – Block temporary email services  \u003C\u002Fli>\n\u003Cli>Spam Trap Identification – Prevent honeypot emails  \u003C\u002Fli>\n\u003Cli>Typosquatting Prevention – Catch misspelled domains  \u003C\u002Fli>\n\u003Cli>Role-based Email Filtering – Block info@, admin@, etc.  \u003C\u002Fli>\n\u003Cli>Custom Blocklist – Your own domain\u002Femail restrictions  \u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>⚡ PERFORMANCE & RELIABILITY\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Real-time Validation – Instant user feedback  \u003C\u002Fli>\n\u003Cli>Temporary Unavailability Detection – Handle server issues  \u003C\u002Fli>\n\u003Cli>Catch-All Domain Testing – Identify low-quality domains  \u003C\u002Fli>\n\u003Cli>Greylisting Detection – Advanced spam protection  \u003C\u002Fli>\n\u003Cli>99.9% Accuracy Rate – Industry-leading precision  \u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>🔒 PRIVACY & COMPLIANCE\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>GDPR Compliant – No email storage  \u003C\u002Fli>\n\u003Cli>Zero IP Impact – No emails sent from your servers  \u003C\u002Fli>\n\u003Cli>Secure API Communication – Encrypted data transfer  \u003C\u002Fli>\n\u003Cli>Privacy-First Design – Your data stays private  \u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>📊 ANALYTICS & MONITORING\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Validation Logs – Track all validation attempts  \u003C\u002Fli>\n\u003Cli>Performance Metrics – Monitor validation success rates  \u003C\u002Fli>\n\u003Cli>Custom Error Messages – Branded user feedback  \u003C\u002Fli>\n\u003Cli>Multi-language Support – Global accessibility  \u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Start with 100 Free Validations\u003C\u002Fstrong> – \u003Ca href=\"https:\u002F\u002Fdebounce.com\u002Fpricing\u002F\" rel=\"nofollow ugc\">Get your API key now\u003C\u002Fa>\u003C\u002Fp>\n","Real-time email validation for WordPress forms. Block invalid, disposable, and risky emails to keep your database clean and improve deliverability.",300,22560,78,16,"2026-01-21T23:40:00.000Z","6.9.4","3.0.1","7.0",[76,77,78,79,80],"disposable-email","email-checker","email-validation","email-verification","spam-prevention","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fdebounce-io-email-validator.zip","2025-04-09 00:00:00",{"slug":84,"name":85,"version":86,"author":87,"author_profile":88,"description":89,"short_description":90,"active_installs":11,"downloaded":91,"rating":13,"num_ratings":13,"last_updated":92,"tested_up_to":72,"requires_at_least":93,"requires_php":94,"tags":95,"homepage":100,"download_link":101,"security_score":47,"vuln_count":13,"unpatched_count":13,"last_vuln_date":27,"fetched_at":28},"cleantalk-bbpress-spam-scanner","CleanTalk bbPress spam scanner","1.0.3","CleanTalk Inc","https:\u002F\u002Fprofiles.wordpress.org\u002Fcleantalk\u002F","\u003Cp>CleanTalk bbPress spam scanner is an add-on for \u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fcleantalk-spam-protect\u002F\" rel=\"ugc\">CleanTalk Anti-Spam Plugin\u003C\u002Fa> and extends its capabilities. The plugin is designed to help you find and move to trash all existing bbPress spam topics.\u003C\u002Fp>\n\u003Cp>The plugin scans all bbPress topics and checks the author parameters through the CleanTalk database. After scanning, you will receive a list of all found spam topics and you can choose which of them to move to the trash or move them all at once.\u003C\u002Fp>\n","Check existing bbPress topics for spam and move to trash all found spam.",5342,"2026-01-22T08:47:00.000Z","3.0","7.2",[96,97,23,98,99],"bbpress","cleaner","spam-check","spam-comments","https:\u002F\u002Fcleantalk.org","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcleantalk-bbpress-spam-scanner.1.0.3.zip",{"slug":103,"name":104,"version":105,"author":106,"author_profile":107,"description":108,"short_description":109,"active_installs":110,"downloaded":111,"rating":47,"num_ratings":31,"last_updated":112,"tested_up_to":113,"requires_at_least":114,"requires_php":17,"tags":115,"homepage":118,"download_link":119,"security_score":26,"vuln_count":13,"unpatched_count":13,"last_vuln_date":27,"fetched_at":28},"hsoub-captcha","Hsoub CAPTCHA","1.0","web2dev","https:\u002F\u002Fprofiles.wordpress.org\u002Fweb2dev\u002F","\u003Cp>A simple comment captcha protection based on \u003Ca href=\"http:\u002F\u002Fcaptcha.hsoub.com\u002F\" rel=\"nofollow ugc\">Hsoub API\u003C\u002Fa> (support arabic & english).\u003C\u002Fp>\n\u003Ch3>About the plugin\u003C\u002Fh3>\n\u003Cp>This plugin use the great \u003Ca href=\"http:\u002F\u002Fcaptcha.hsoub.com\u002F\" rel=\"nofollow ugc\">Hsoub API\u003C\u002Fa>, and is a \u003Ca href=\"http:\u002F\u002Fweb2dev.me\u002F\" rel=\"nofollow ugc\">web2dev\u003C\u002Fa> concept.\u003C\u002Fp>\n","A simple comment captcha protection.",10,3821,"2012-01-05T17:04:00.000Z","3.3.2","3.0.0",[116,117,21,22,23],"anti-spam","comment","http:\u002F\u002Fweb2dev.me\u002Flabs\u002Fhsoub-captcha\u002F","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fhsoub-captcha.1.0.1.zip",{"slug":121,"name":122,"version":123,"author":124,"author_profile":125,"description":126,"short_description":127,"active_installs":110,"downloaded":128,"rating":13,"num_ratings":13,"last_updated":129,"tested_up_to":130,"requires_at_least":131,"requires_php":17,"tags":132,"homepage":134,"download_link":135,"security_score":26,"vuln_count":13,"unpatched_count":13,"last_vuln_date":27,"fetched_at":28},"no-spam","No Spam","1.0.2","Pierre Sylvestre","https:\u002F\u002Fprofiles.wordpress.org\u002Fstrategio\u002F","\u003Cp>\u003Cstrong>No Spam\u003C\u002Fstrong> is a simple, lightweight and efficient anti-spam plugin.\u003C\u002Fp>\n\u003Cp>It relies on differences between \u003Cstrong>humans\u003C\u002Fstrong> and \u003Cstrong>robots\u003C\u002Fstrong> when they visit (or crawl) a page.\u003C\u002Fp>\n\u003Col>\n\u003Cli>\n\u003Cp>Most of human visitors clients are javascript enabled and most of spam bot are not. Then the No Spam plugin adds an input field in the comment form using javascript. After submission, the plugin check if this field exists.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>As spam bots usually don’t kown which fields are required and which are not, they use to fill all the fields. The plugin adds a extra field (with empty value) in the comment form and hide it with CSS styling. After submission, the plugin check if the field is still empty.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003C\u002Fol>\n","A simple and efficient anti-spam plugin",9706,"2014-06-23T14:47:00.000Z","3.9.40","3.5.1",[116,21,23,133],"spam-bots","http:\u002F\u002Fnospam.strategio.fr\u002F","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fno-spam.1.0.3.zip",{"attackSurface":137,"codeSignals":152,"taintFlows":164,"riskAssessment":165,"analyzedAt":171},{"hooks":138,"ajaxHandlers":148,"restRoutes":149,"shortcodes":150,"cronEvents":151,"entryPointCount":13,"unprotectedCount":13},[139,144],{"type":140,"name":141,"callback":142,"file":143,"line":58},"action","comment_form","wp_simple_spamcheck__comment_form","wp-simple-spamcheck.php",{"type":140,"name":145,"callback":146,"file":143,"line":147},"pre_comment_on_post","wp_simple_spamcheck__pre_comment_on_post",95,[],[],[],[],{"dangerousFunctions":153,"sqlUsage":154,"outputEscaping":156,"fileOperations":13,"externalRequests":13,"nonceChecks":13,"capabilityChecks":13,"bundledLibraries":163},[],{"prepared":13,"raw":13,"locations":155},[],{"escaped":13,"rawEcho":31,"locations":157},[158,161],{"file":143,"line":159,"context":160},53,"raw output",{"file":143,"line":162,"context":160},55,[],[],{"summary":166,"deductions":167},"The \"wp-simple-spamcheck\" v1.2 plugin exhibits a generally positive security posture based on the static analysis provided. There are no identified AJAX handlers, REST API routes, shortcodes, or cron events, which significantly limits the plugin's attack surface. Furthermore, the code analysis reveals no dangerous functions, file operations, external HTTP requests, or bundled libraries, all of which are strong indicators of secure coding practices. The complete absence of recorded CVEs and historical vulnerabilities further supports a perception of low risk.\n\nHowever, a critical concern arises from the output escaping analysis, where 100% of the detected outputs are not properly escaped. This indicates a high potential for cross-site scripting (XSS) vulnerabilities, where malicious scripts could be injected into the website through user-controlled input that is subsequently displayed without proper sanitization. While the plugin appears robust in other areas, this lack of output escaping represents a significant weakness that could be exploited by attackers.\n\nIn conclusion, while the plugin demonstrates strengths in minimizing its attack surface and avoiding common vulnerability vectors, the unescaped output is a serious flaw. The absence of historical vulnerabilities is encouraging but does not mitigate the immediate risk posed by the identified output escaping issue. A thorough review and correction of output escaping mechanisms are highly recommended to improve the plugin's overall security.",[168],{"reason":169,"points":170},"All outputs are unescaped",8,"2026-03-16T20:27:11.157Z",{"wat":173,"direct":178},{"assetPaths":174,"generatorPatterns":175,"scriptPaths":176,"versionParams":177},[],[],[],[],{"cssClasses":179,"htmlComments":181,"htmlAttributes":182,"restEndpoints":185,"jsGlobals":186,"shortcodeOutput":188},[180],"wp_ssc",[],[183,184],"id=\"wp_ssc\"","id=\"wp_scck[5]\"",[],[187,180],"wp_scck",[]]