Scan report

WordPress / ai

View on GitHub (opens in a new tab)
PHP
347 stars
Scanned 24 Sep 2026, 10:10

Report Rescan

Vulnerability Low

Could an attacker exploit mistakes in this code?

17 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 0
Medium: 6
Low: 3

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Safe

Does this code look like it is trying to cause harm?

0 risk score

No issues of this kind were found.

High: 0
Medium: 0
Low: 0

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

9 total findings

Likely real: 6
Uncertain: 3
Likely noise: 0

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

6 findings likely need attention. Most notable: Found direct access to a PHP variable wihout HTML escaping inside an inline PHP stateme... in /includes/Experiments/Abilities_Explorer/Admin_Page.php (98% confidence).

Detections by engine

Semgrep 9

Pattern-based code analysis · Vulnerability

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/includes/Experiments/Abilities_Explorer/Admin_Page.php line 184

Likely real
Yes, 98% confidence

Found direct access to a PHP variable wihout HTML escaping inside an inline PHP statement setting data from `$_REQUEST[...]`. When untrusted input can be used to tamper with a web page rendering, it can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte.
```
<a href="<?php echo esc_url( $test_url ); ?>" class="button button-primary"><?php esc_html_e( 'Test Ability', 'ai' ); ?></a>
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/includes/Experiments/Abilities_Explorer/Admin_Page.php line 275

Likely real
Yes, 98% confidence

Found direct access to a PHP variable wihout HTML escaping inside an inline PHP statement setting data from `$_REQUEST[...]`. When untrusted input can be used to tamper with a web page rendering, it can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte.
```
<a href="<?php echo esc_url( $detail_url ); ?>" class="button"><?php esc_html_e( 'View Details', 'ai' ); ?></a>
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/includes/Experiments/Abilities_Explorer/Admin_Page.php line 314

Likely real
Yes, 98% confidence

Found direct access to a PHP variable wihout HTML escaping inside an inline PHP statement setting data from `$_REQUEST[...]`. When untrusted input can be used to tamper with a web page rendering, it can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte.
```
<textarea id="ability-test-payload" rows="12"><?php echo esc_textarea( (string) wp_json_encode( $example_input, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE ) ); ?></textarea>
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/includes/Experiments/Abilities_Explorer/Admin_Page.php line 348

Likely real
Yes, 98% confidence

Found direct access to a PHP variable wihout HTML escaping inside an inline PHP statement setting data from `$_REQUEST[...]`. When untrusted input can be used to tamper with a web page rendering, it can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte.
```
<?php echo wp_json_encode( $ability['input_schema'], JSON_HEX_TAG | JSON_UNESCAPED_UNICODE ); ?>
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.npmrc line 3

Likely real
Yes, 97% confidence

This .npmrc does not set a minimum release age or sets it too low. Newly published packages can be malicious or unstable. Add `min-release-age = 7` to wait 7 days before resolving newly published package versions. Added in: v11.10 Reference: https://github.blog/changelog/2026-02-18-npm-bulk-trusted-publishing-config-and-script-security-now-generally-available/
```
min-release-age = 1
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/props-bot.yml line 74

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: WordPress/props-bot-action@trunk
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/src/experiments/comment-moderation/components/LazyAnalysisController.tsx line 324

Likely real
Uncertain, 33% confidence

Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.
```
`Failed to analyze comment ${ comment.id }:`,
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/src/experiments/editorial-updates/hooks/useEditorialUpdates.ts line 443

Likely real
Uncertain, 33% confidence

Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.
```
`[Refine Notes] Failed to refine block ${ block.clientId }`,
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/src/utils/notes.ts line 72

Likely real
Uncertain, 33% confidence

Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.
```
`[AI Notes] Failed to fetch ${ status } Notes page ${ page }:`,
```