Security

Security you can check

Plugins are where most WordPress security risk lives, so we publish how ours are reviewed: a score for each plugin, the version and date it applies to, and the method behind it.

A score for each plugin
Each reviewed plugin gets a security score out of 100, shown with the plugin version and the review date. A score belongs to that version only.
Findings published once fixed
We publish what a review found once it is fixed, never before. Describing an unfixed weakness in public would put sites at risk.
An AI-driven source review
The scores come from an AI agent reading each plugin’s source code against a written checklist. It is not a penetration test or an independent audit.

How we review

Every review follows the same written checklist, so one score can be compared with the next.

Map every way in
List every admin page, AJAX and REST endpoint, form, webhook, scheduled task and WP-CLI command, and who can reach each one.
Trace input to where it is used
Follow each value a visitor or user can control through the code to where it is stored, queried, displayed or fetched, checking the guard at each step.
Confirm before deducting
Only confirmed findings cost points. Anything that cannot be proved from the code, or needs a live server to settle, is recorded as unverified and costs nothing.
Score and record
The plugin starts at 100 and loses points for each confirmed finding. The report records the plugin version, the date and a fingerprint of the exact source reviewed.

What every review checks

  • Authentication, permissions and CSRF: nonces, capability checks, who owns each object, REST permissions.
  • SQL injection: every custom database query, including table names, sorting and limits.
  • Cross-site scripting: page output, admin notices, emails and JavaScript.
  • SSRF, open redirects and header injection: any URL the plugin fetches or redirects to.
  • File uploads and path traversal: uploads, imports, exports, downloads and deletes.
  • Remote code execution and unsafe deserialisation: shell calls, dynamic includes and callbacks.
  • XML parser safety: external entities in XML, SOAP, SVG and import parsers.
  • Secrets and personal data: keys, tokens and personal data in pages, responses and logs.
  • Business logic, replay and race conditions: prices, coupons, limits and repeated requests.
  • Dependencies and supply chain: third-party libraries, published advisories and what goes into the release.
  • JWT, GraphQL and server-side templates: checked wherever a plugin uses them.

How points are deducted

  • Each confirmed finding is given a severity, Critical, High, Medium or Low, and a deduction.
  • The checklist sets the largest deductions: 30 points for SQL injection, a missing request-authenticity check or an unauthenticated webhook that changes data, and 25 for exploitable cross-site scripting, a missing permission or ownership check, SSRF, path traversal or unsafe deserialisation.
  • Smaller findings cost less. In the reviews below, each finding cost between 5 and 20 points.
  • Repeats of one underlying mistake are capped at three times the single deduction, and total deductions stop at 60 unless a finding is Critical.
  • Unverified risks cost nothing, but are listed in the report so they can be settled later.
What a score does not cover
  • It is not a penetration test. The September reviews read the source code only. The October review of Super Speedy Chat also reproduced its findings on a private test site.
  • It is not an independent audit. We wrote the checklist, and an AI agent working for us ran it.
  • It covers one plugin version. A later version is not covered until it is reviewed again.
  • It does not cover your server, your hosting, WordPress core or your other plugins.
  • Third-party libraries are checked against published advisories, not read line by line.
  • A high score is not a guarantee. It measures what was checked.

Scores

Each score applies to the plugin version named, on the date shown.

Reviews so far

Super Speedy Chat was reviewed on 29 October 2026 and the other plugins on 4 September 2026, each on the version named. Each is due for re-review in the weekly series, and its card will be updated when that happens.

90/100
Auto Infinite Scroll
Version 1.72.11
Reviewed 4 September 2026
Re-review due
90/100
Delayed Image Import
Version 2.28.13
Reviewed 4 September 2026
Re-review due
90/100
External Images
Version 3.43.9
Reviewed 4 September 2026
Re-review due
90/100
Fullscreen Typeform
Version 2.0.9
Reviewed 4 September 2026
Re-review due
90/100
Scalability Pro
Version 6.33
Reviewed 4 September 2026
Re-review due
90/100
Super Speedy AJAX Prices
Version 1.13.25
Reviewed 4 September 2026
Re-review due
90/100
AJAX Prices: Country Based Prices
Version 1.13.10
Reviewed 4 September 2026
Re-review due
90/100
Super Speedy Archives
Version 3.3.14
Reviewed 4 September 2026
Re-review due
90/100
Super Speedy Filters
Version 6.52.48
Reviewed 4 September 2026
Re-review due
90/100
Super Speedy Imports
Version 2.89.1
Reviewed 4 September 2026
Re-review due
90/100
Super Speedy Sitemaps
Version 1.11.13
Reviewed 4 September 2026
Re-review due
75/100
Super Speedy Coming Soon Products
Version 1.7.13
Reviewed 4 September 2026
Re-review due
75/100
Super Speedy Comments
Version 1.6.18
Reviewed 4 September 2026
Re-review due
75/100
Super Speedy Emails
Version 1.19.34
Reviewed 4 September 2026
Re-review due
70/100
Super Speedy Search
Version 5.62.3
Reviewed 4 September 2026
Re-review due
65/100
Super Speedy Chat
Version 1.20.9
Reviewed 29 October 2026
Fixes in progress

The weekly review series

One plugin a week, reviewed again on its current release.

One plugin each week
Each week one plugin is reviewed on its current release with the same checklist, and its card above is updated with the new score, version and date.
What was found and fixed
Each post covers what the review checked, what it found, what we fixed and the score before and after. A finding is described only once it is fixed.
Posts appear here
The series has not started yet. Posts will be listed on this page as they are published.

Report a vulnerability

Found a security problem in one of our plugins? Please tell us privately.

Report privately

Use the contact form, and include the plugin, its version and the steps to reproduce the problem. Please don’t post security problems on the public issue tracker, where anyone can read them before a fix is out.

Report a vulnerability privately

Everything else

Ordinary bugs and customisation have their own places.

Bugs and feature requests
Report ordinary bugs and ask for features on the public issue tracker. Security problems go through the contact form instead.
Customise without losing fixes
The Dev Hub shows how to change how a plugin behaves with a separate add-on, so every update and security fix still reaches you.
▲
▼
1/1