JAZ-X Code Inspection is a read-only static inspection tool. It highlights code capabilities that deserve review, including dynamic code execution, obfuscation, filesystem writes, direct database changes, outbound requests, REST routes, scheduled tasks, and user privilege changes.<\/p>\n\n
It also lists literal external domains referenced by the scanned code.<\/p>\n\n
Important: a finding is not proof of malware, and a clean report is not a guarantee of safety. Legitimate plugins often need powerful WordPress capabilities. JAZ-X Code Inspection helps administrators ask better questions before trusting code.<\/p>\n\n
JAZ-X Code Inspection does not send scan data to an external service and does not retain uploaded ZIP files.<\/p>\n\n
The free edition is fully usable for on-demand static inspection. If you need continuous monitoring, baselines, scan history, change alerts, and other advanced workflow features, an optional Pro edition is available from JAZ-X Innovation:\nhttps:\/\/store.jazx.online\/product\/code-x-ray-pro-wordpress-plugin-security-scanner\/<\/p>\n\n\n
\/wp-content\/plugins\/<\/code> or install the ZIP in WordPress.<\/li>\n- Activate JAZ-X Code Inspection.<\/li>\n
- Open Tools > JAZ-X Code Inspection.<\/li>\n
- Select an installed plugin or upload a plugin ZIP for inspection.<\/li>\n<\/ol>\n\n\n
\nDoes a high score mean a plugin is malicious?<\/h3><\/dt>\nNo. The score measures potentially powerful capabilities detected by static signatures. Review the identified code and the plugin's documentation before making a trust decision.<\/p><\/dd>\n
Does a low score guarantee safety?<\/h3><\/dt>\nNo. Static analysis has limitations, including code assembled at runtime or behavior supplied by remote services.<\/p><\/dd>\n
Is uploaded code executed?<\/h3><\/dt>\nNo. JAZ-X Code Inspection reads supported source files as text and removes extracted temporary files after the scan.<\/p><\/dd>\n
Is there a Pro edition?<\/h3><\/dt>\nYes. JAZ-X Code Inspection Pro is an optional commercial edition for users who need continuous monitoring, baselines, scan history, change alerts, and additional advanced workflows. The free edition remains fully usable for its listed on-demand scanning features.<\/p>\n\n
Learn more: https:\/\/store.jazx.online\/product\/code-x-ray-pro-wordpress-plugin-security-scanner\/<\/p><\/dd>\n\n<\/dl>\n\n\n
0.7.1<\/h4>\n\n\n- Add a restrained, optional JAZ-X Code Inspection Pro information link on the plugin screen.<\/li>\n
- Document the optional Pro edition in the readme and FAQ.<\/li>\n<\/ul>\n\n
0.7.0<\/h4>\n\n\n- Add live report search across capabilities, files, evidence, and review guidance.<\/li>\n
- Add type, severity, and status filters with one-click reset.<\/li>\n
- Add sorting by severity, capability, location, status, or original report order.<\/li>\n
- Add total, security, access, dependency, and informational finding counters.<\/li>\n<\/ul>\n\n
0.6.1<\/h4>\n\n\n- Limit nearby controls to those relevant to each finding type.<\/li>\n
- Tighten the context window to reduce controls leaking across unrelated functions.<\/li>\n
- Add URL and uploaded-file validation context.<\/li>\n
- Clear older report data when the context schema changes.<\/li>\n<\/ul>\n\n
0.6.0<\/h4>\n\n\n- Add short redacted evidence excerpts to each finding.<\/li>\n
- Detect nearby nonce, capability, sanitization, prepared SQL, safe redirect, and REST permission controls.<\/li>\n
- Add a review status to every finding.<\/li>\n
- Include status, detected controls, and evidence in JSON and CSV exports.<\/li>\n<\/ul>\n\n
0.5.1<\/h4>\n\n\n- Require a remote source as well as hidden styling before reporting hidden iframe markup.<\/li>\n
- Suppress direct redirect findings when nearby executable code verifies a nonce or checks authorization.<\/li>\n
- Add visible separators between referenced external domains.<\/li>\n<\/ul>\n\n
0.5.0<\/h4>\n\n\n- Detect user input flowing directly into code loading or execution.<\/li>\n
- Detect unsafe deserialization of request data.<\/li>\n
- Detect remote-response-to-file write chains for manual review.<\/li>\n
- Detect direct upload handling, privileged account creation, user-controlled redirects, and hidden iframe markup.<\/li>\n
- Preserve comment filtering while allowing selected compound checks to inspect ordinary string literals without matching scanner-rule regex definitions.<\/li>\n<\/ul>\n\n
0.4.2<\/h4>\n\n\n- Stop treating PHP assert calls as dynamic code execution signals.<\/li>\n
- Recognize bundled code under lib\/packages as third-party dependency context.<\/li>\n<\/ul>\n\n
0.4.1<\/h4>\n\n\n- Increase scan capacity to 5,000 source files and 50 MB of inspected code.<\/li>\n
- Correctly mark a report as partial when the next eligible file exceeds a scan limit.<\/li>\n<\/ul>\n\n
0.4.0<\/h4>\n\n\n- Add an automatic, plain-language scan verdict.<\/li>\n
- Add grouped capability summaries and collapse repeated technical evidence.<\/li>\n
- Add downloadable JSON and CSV scan reports.<\/li>\n<\/ul>\n\n
0.3.0<\/h4>\n\n\n- Rename the plugin to JAZ-X Code Inspection for WordPress.org naming compliance.<\/li>\n
- Use the WordPress Filesystem API for temporary directory cleanup.<\/li>\n
- Improve nonce verification placement and translation comments for Plugin Check.<\/li>\n
- Remove obsolete manual translation loading and the unused language path header.<\/li>\n<\/ul>\n\n
0.2.1<\/h4>\n\n\n- Add JAZ-X Innovation author branding and website link.<\/li>\n<\/ul>\n\n
0.2.0<\/h4>\n\n\n- Separate suspicious security signals from legitimate access exposure.<\/li>\n
- Make dangerous PHP signatures language-aware so JavaScript assertions are not reported as PHP execution.<\/li>\n
- Require suspicious decoding\/execution chains before reporting possible obfuscation.<\/li>\n
- Separate first-party, dependency, and capability scoring.<\/li>\n<\/ul>\n\n
0.1.2<\/h4>\n\n\n- Split first-party plugin risk from bundled dependency risk.<\/li>\n
- Collapse dependency and low-confidence test\/tooling evidence by default.<\/li>\n
- Limit the domain inventory to runtime-relevant source files with outbound calls.<\/li>\n<\/ul>\n\n
0.1.1<\/h4>\n\n\n- Reduce false positives by excluding PHP comments and string literals from capability matching.<\/li>\n
- Count each capability once in the risk score instead of once per matching file.<\/li>\n
- Add confidence and source-context labels for first-party, vendor, and test\/tooling findings.<\/li>\n<\/ul>\n\n
0.1.0<\/h4>\n\n\n- Initial MVP.<\/li>\n
- Scan installed plugins and uploaded ZIP files.<\/li>\n
- Risk scoring, capability findings, file locations, and referenced domains.<\/li>\n<\/ul>","raw_excerpt":"Inspect installed plugins and plugin ZIP files for potentially risky capabilities without executing their code.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/yor.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/372268","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/yor.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/yor.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/yor.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=372268"}],"author":[{"embeddable":true,"href":"https:\/\/yor.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/jazxinnovation"}],"wp:attachment":[{"href":"https:\/\/yor.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=372268"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/yor.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=372268"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/yor.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=372268"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/yor.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=372268"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/yor.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=372268"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/yor.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=372268"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}