Advanced Typekit Security & Risk Analysis

The 'advanced-typekit' plugin version 1.0.1 exhibits a concerning security posture due to several critical findings. While it doesn't appear to use dangerous functions or engage in raw SQL queries, a significant risk stems from its unprotected AJAX handler. This entry point lacks any authentication or capability checks, making it a prime target for unauthorized actions. Furthermore, the complete absence of output escaping across all identified outputs is a major weakness, strongly suggesting a high susceptibility to Cross-Site Scripting (XSS) vulnerabilities. The plugin's vulnerability history, specifically a known medium-severity XSS vulnerability that remains unpatched, amplifies these concerns. This pattern indicates a lack of proactive security maintenance. Despite the positive note on SQL practices, the combination of an unprotected attack surface, widespread output escaping failures, and an existing unpatched vulnerability paints a picture of a plugin that requires immediate attention and remediation.