{"repo":"dimasma0305/wp-taint-scan","free":true,"listed":false,"github":"https://github.com/dimasma0305/wp-taint-scan","clone":"git clone https://github.com/dimasma0305/wp-taint-scan.git","description":"Go static taint-analysis engine that finds vulnerabilities in WordPress plugins — WordPress-aware (capability tiers, nonce≠authz, REST/AJAX entrypoints). Detects SQLi, XSS, IDOR, privesc, RCE. Built on php-parser-go.","language":"Go","stars":20,"topics":["appsec","bug-bounty","golang","php","sast","security","security-tools","static-analysis","taint-analysis","vulnerability-scanner"],"license":"MIT","category":"security-tools","readme_excerpt":"Find real vulnerabilities in WordPress plugins. Search the plugin directory, scan any version — or every version — in parallel, and diff findings across releases. A native Go taint-analysis engine that understands the WordPress security model , not just generic source→sink flow. Quick start · Web UI · How it works · HTTP API ⭐ If this is useful, a star helps others find it. --- Screenshots :--: :--: Search the WordPress.org directory Pick a version, or scan them all Parallel scan dashboard (live) Findings + source→sink dataflow trace Version diff — see exactly which findings were introduced or fixed between two releases: The analysis engine ships as a CLI ( taint-scan , installed as phparser ) and a web app ( taint-web ). No PHP runtime, no Semgrep, no external services — just Go. Why it's different Generic taint scanners drown in false positives on WordPress code because they don't model how WordPress actually gates access. This engine encodes the real rules that decide whether a finding is exploitable: - A nonce is not authorization. A valid nonce only proves the request came from the site's UI; it does not prove the user is allowed to perform the action. Nonce-without-capability is the dominant WordPress bounty pattern, and the engine treats it as such. - is admin() is not an auth gate. It checks whether the URL is under /wp-admin/ — and admin-ajax.php always returns true . It is never treated as a capability check. - Capability tiers matter. current user can('read') (subs","default_branch":null,"files":null,"tree":[],"storefront":"/r/dimasma0305","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/dimasma0305/wp-taint-scan/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}