Advanced FAQ Manager Security & Risk Analysis

The 'advanced-faq-manager' plugin v1.5.3 exhibits a mixed security posture. On the positive side, the plugin demonstrates strong practices regarding SQL queries, utilizing prepared statements exclusively, and has a very high rate of output escaping, minimizing the risk of cross-site scripting vulnerabilities stemming from its output. File operations and external HTTP requests are also absent, reducing potential attack vectors. However, the presence of three AJAX handlers without authentication checks represents a significant concern, as these entry points could be exploited by unauthenticated users. While the taint analysis shows no immediate critical or high severity vulnerabilities, the historical data reveals two medium-severity Cross-Site Scripting (XSS) vulnerabilities. The fact that the last vulnerability was in 2025 and is currently unpatched is a serious indicator of ongoing security maintenance issues. Despite good coding practices in certain areas, the unprotected AJAX endpoints and the history of XSS vulnerabilities, combined with a recent unpatched issue, point to a need for immediate attention to security patching and access control on its AJAX handlers.