ActiveDEMAND Security & Risk Analysis

The "activedemand" plugin v0.2.47 exhibits a concerning security posture, largely due to a significant number of unprotected AJAX handlers. While the plugin demonstrates good practices in using prepared statements for SQL queries (81%) and proper output escaping (88%), the presence of 5 unprotected AJAX entry points creates a substantial attack surface that could be exploited for unauthorized actions. Furthermore, the taint analysis revealed one high-severity flow with unsanitized paths, indicating a potential for attackers to manipulate data or execute unintended operations. The plugin's vulnerability history is also a major red flag, with 4 known CVEs, including 2 critical ones, and a recent vulnerability in April 2025. This historical pattern of critical vulnerabilities, particularly around Cross-Site Request Forgery, Unrestricted File Uploads, and Missing Authorization, suggests recurring security flaws that have not been fully addressed. While the current version has no unpatched CVEs and the static analysis shows some positive indicators like minimal file operations and external HTTP requests, the combination of unprotected entry points, a critical taint flow, and a history of severe vulnerabilities points to a plugin that requires immediate attention and rigorous security scrutiny before widespread deployment.