WP To Top Security & Risk Analysis

wordpress.org/plugins/wp-to-top

This plugin will add a "back to top/ scroll to top" icon automatically to your blog.

1K active installs v0.2.1 PHP + WP 2+ Updated Nov 28, 2017
jquerypostpostsscrolltop
85
A · Safe
CVEs total0
Unpatched0
Last CVENever
Safety Verdict

Is WP To Top Safe to Use in 2026?

Generally Safe

Score 85/100

WP To Top has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs Updated 8yr ago
Risk Assessment

The 'wp-to-top' plugin version 0.2.1 exhibits a generally strong security posture based on the provided static analysis. There are no identified dangerous functions, SQL injection vulnerabilities due to prepared statements, file operations, external HTTP requests, or vulnerabilities identified through taint analysis. The absence of known CVEs and a clean vulnerability history further suggests a low likelihood of historical security flaws. However, a significant concern lies in the complete lack of capability checks and nonce checks across all potential entry points. While the current attack surface is zero, this indicates a fundamental lack of security best practices that could become a significant risk if new features or entry points are introduced without proper authorization and validation.

Key Concerns

  • Missing capability checks
  • Missing nonce checks
  • 47% of output properly escaped
Vulnerabilities
None known

WP To Top Security Vulnerabilities

No known vulnerabilities — this is a good sign.
Code Analysis
Analyzed Mar 16, 2026

WP To Top Code Analysis

Dangerous Functions
0
Raw SQL Queries
0
0 prepared
Unescaped Output
16
14 escaped
Nonce Checks
0
Capability Checks
0
File Operations
0
External Requests
0
Bundled Libraries
0

Output Escaping

47% escaped30 total outputs
Attack Surface

WP To Top Attack Surface

Entry Points0
Unprotected0
WordPress Hooks 5
actionadmin_menuclasses\class-wp-to-top-admin.php:24
actionadmin_initclasses\class-wp-to-top-admin.php:25
actionadmin_enqueue_scriptsclasses\class-wp-to-top-admin.php:26
actionwp_enqueue_scriptsclasses\class-wp-to-top.php:24
actionwp_footerclasses\class-wp-to-top.php:25
Maintenance & Trust

WP To Top Maintenance & Trust

Maintenance Signals

WordPress version tested4.1.42
Last updatedNov 28, 2017
PHP min version
Downloads67K

Community Trust

Rating100/100
Number of ratings1
Active installs1K
Developer Profile

WP To Top Developer Profile

Asvin Balloo

1 plugin · 1K total installs

84
trust score
Avg Security Score
85/100
Avg Patch Time
30 days
View full developer profile
Detection Fingerprints

How We Detect WP To Top

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/wp-to-top/css/wp-to-top-admin.css/wp-content/plugins/wp-to-top/css/wp-to-top.css/wp-content/plugins/wp-to-top/js/wp-to-top.js
Script Paths
wp-to-top/js/wp-to-top.js
Version Parameters
wp-to-top/css/wp-to-top.css?ver=wp-to-top/js/wp-to-top.js?ver=

HTML / DOM Fingerprints

CSS Classes
wp-to-top
JS Globals
wpToTopVars
FAQ

Frequently Asked Questions about WP To Top