Advanced Menu Manager Pro – Built for Content-heavy WordPress Sites to Add, Filter, Lock, and Edit Menus Easily Security & Risk Analysis

The "advance-menu-manager" plugin v3.1.3 presents a mixed security posture. On the positive side, the plugin demonstrates strong practices regarding SQL queries, with 100% using prepared statements, and a high percentage (90%) of output being properly escaped, indicating a focus on preventing common injection and XSS vulnerabilities. The absence of file operations and raw SQL queries is also commendable. However, a significant concern arises from the substantial attack surface, with all 12 identified AJAX handlers lacking authentication checks. This leaves the plugin highly susceptible to unauthorized actions if these handlers are discoverable or predictable by attackers. The vulnerability history, while currently showing no unpatched CVEs, reveals a pattern of past vulnerabilities, particularly missing authorization and CSRF, across various severity levels. This historical data suggests recurring issues with securing entry points, which is further corroborated by the static analysis revealing a lack of authorization checks on all AJAX endpoints.