Advanced Classifieds & Directory Pro Security & Risk Analysis

The advanced-classifieds-and-directory-pro plugin v3.3.0 presents a mixed security posture. While it demonstrates good practices in areas like output escaping and the use of prepared statements for SQL queries, significant concerns arise from its attack surface and past vulnerability history. The plugin has 24 unprotected AJAX handlers, which is a considerable entry point for attackers. Despite the absence of critical taint flows in the static analysis, the high number of flows with unsanitized paths (19 out of 28) suggests potential weaknesses in input validation. This, combined with the presence of dangerous functions like unserialize, could lead to security issues if not handled with extreme care.

The plugin's vulnerability history is a significant red flag. With 4 known CVEs, including two high and two medium severity vulnerabilities, it indicates a pattern of exploitable flaws. The common types of vulnerabilities (CSRF, RFI, Missing Authorization) are particularly worrying as they can lead to serious compromises. Although there are currently no unpatched vulnerabilities, the history suggests that the plugin may be prone to developing new ones. The most recent vulnerability was in late 2025, which might indicate a recurring issue or a recent discovery that has since been addressed. Overall, while some security measures are in place, the substantial unprotected attack surface and a history of impactful vulnerabilities necessitate caution.