Ads Easy Security & Risk Analysis

The Adseasy v3.3 plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices by utilizing prepared statements for all SQL queries and appears to have a limited attack surface, with all identified entry points (shortcodes) likely to be covered by capability checks. The absence of known CVEs and a clean vulnerability history is also a strong positive indicator, suggesting a history of stable and relatively secure development.

However, several concerning code signals warrant attention. The presence of the `create_function` function is a significant risk, as it can be a vector for arbitrary code execution if not handled with extreme care, especially in contexts involving user-supplied input. Furthermore, the extremely low percentage of properly escaped output (6%) indicates a high likelihood of Cross-Site Scripting (XSS) vulnerabilities, where malicious scripts could be injected and executed in users' browsers. The taint analysis revealing unsanitized paths, even without critical or high severity, suggests that user input is not being adequately cleaned before being used in potentially sensitive operations. The lack of nonce checks on any of the entry points is another concern, as it leaves the plugin vulnerable to Cross-Site Request Forgery (CSRF) attacks.

In conclusion, while Adseasy v3.3 benefits from a clean vulnerability history and good SQL handling, the identified code signals related to `create_function`, poor output escaping, unsanitized paths, and missing nonce checks present significant security risks that require immediate attention to improve its overall security posture.