Adminimize Security & Risk Analysis

The "Adminimize" plugin v1.11.11 presents a mixed security posture. While the static analysis reveals a small attack surface with no identified unprotected entry points (AJAX, REST API, shortcodes, cron), and the taint analysis found no critical or high severity issues, there are areas of concern. The plugin utilizes only one SQL query and none of them are prepared statements, which represents a significant risk of SQL injection if the input for this query is not rigorously sanitized. Furthermore, a substantial portion of output (79%) is not properly escaped, indicating a high risk of Cross-Site Scripting (XSS) vulnerabilities. The vulnerability history shows two known medium severity CVEs, both related to XSS, with the last reported in 2014. While there are no currently unpatched vulnerabilities, the historical pattern of XSS issues, coupled with the static analysis findings of poor output escaping, suggests a recurring weakness in handling user-supplied data before rendering it in the browser. The plugin also bundles the Select2 library, which could be outdated and introduce vulnerabilities if not managed carefully.