Kodlo Media Manager

v1.8.6WordPress Plugin10+ installsAudited 31 days ago

HIGH

Stable

WP.org

Total Findings

Security Grade

Active Installs

10+

Coding Score

100/100

Security Findings

Critical0

High1

Medium27

Low12

Info4

Executive Summary

Free-tier AI cap reached. This report contains deterministic-scanner findings only. Upgrade to a paid tier for security / quality / accessibility AI engine analysis.

Security Report Card

Readiness

Coding Standards

100/100

PHP Compatibility

Requires PHP 8.0Declared minimum: 8.1

Categories with Findings

Coding StandardsType SafetySecurityPerformancePlugin ConflictscompatibilityWordPress Compatibility

Positive Observations

Plugin correctly uses is_admin() to gate all admin-only code, preventing unnecessary loading on frontend requests.

Audit History

Date	Version	Rating	Findings	Standards
7/19/2026Latest	v1.8.6	HIGH	44	100/100
7/17/2026	v1.8.5	HIGH	45	100/100
7/6/2026	v1.8.4	MEDIUM	21	100/100
6/19/2026	v1.7.4

Plugin Info

Active Installs: 10+
Requires WP: 5.6+
Tested Up To: 7.0
Requires PHP: 7.4+
Audit Count: 4
Type: plugin

Embed Audit Badge

Show your audit status in your README or website.

[![Kodlo Media Manager security audit by WP HealthKit](https://wphealthkit.com/api/badge/by-slug/kodlo-media-manager)](https://wphealthkit.com/directory/kodlo-media-manager)

Paste this in your GitHub README or any Markdown file. The badge updates automatically on every re-audit — no need to refresh the snippet.

Site owners: should they update? See the update-safety verdict for Kodlo Media Manager

Are you the developer?

Claim this listing to get a Verified badge, control public audits, and get automatic re-scans.

Claim This Plugin

Audit Your Plugin

Get a comprehensive security audit for your WordPress plugin or theme. Upload your zip and get results in minutes.

Start Free Audit

Readiness

Coding Standards

100/100

PHP Compatibility

Requires PHP 8.0Declared minimum: 8.1

Categories with Findings

Coding StandardsType SafetySecurityPerformancePlugin ConflictscompatibilityWordPress Compatibility

Positive Observations

Plugin correctly uses is_admin() to gate all admin-only code, preventing unnecessary loading on frontend requests.

Audit History

Date	Version	Rating	Findings	Standards
7/19/2026Latest	v1.8.6	HIGH	44	100/100
7/17/2026	v1.8.5	HIGH	45	100/100
7/6/2026	v1.8.4	MEDIUM	21	100/100
6/19/2026	v1.7.4

Assets class uses admin_enqueue_scripts hook with capability checks (current_user_can) before enqueuing anything.

Settings page assets are correctly scoped to options-media.php only using $pagenow check.

Uploader script is correctly gated behind wp_script_is('media-views', 'enqueued') to avoid loading on irrelevant admin pages.

SVG sanitizer uses DOMDocument with LIBXML_NONET to prevent server-side request forgery during XML parsing.

Option locks correctly use autoload=false to prevent lock rows from polluting the autoloaded options cache.

get_rules() implements a request-local static cache with proper cache invalidation based on option value comparison.

Duplicate lookup correctly uses LIMIT 1 to short-circuit the query as soon as a match is found.

Plugin uses wp_cache_delete() after direct DB operations on options to keep the object cache consistent.

All user input is properly sanitized and validated before use (nonces, capability checks, sanitize_text_field, etc.).

The plugin avoids registering any frontend hooks — all functionality is scoped to upload-time filters and admin hooks.

JavaScript uses debouncing for input event handlers to avoid excessive DOM queries during typing.

Dimension checks use a concurrency queue (DIMENSION_CHECK_CONCURRENCY=4) to avoid creating unbounded numbers of Image objects.

Duplicate checks are batched (DUPLICATE_CHECK_BATCH_SIZE=50) to limit the number of AJAX requests.

get_mime_type_suggestions() uses a static property cache to avoid re-reading the JSON file on repeated calls within a request.

Kodlo Media Manager

Security Findings

Executive Summary

Security Report Card

Readiness

PHP Compatibility

Categories with Findings

Positive Observations

Audit History

Plugin Info

Categories

Embed Audit Badge

Are you the developer?

Audit Your Plugin

Readiness

PHP Compatibility

Categories with Findings

Positive Observations

Audit History

Findings Over Time