AI Content Wizard Lite — SEO Content & Planner for OpenAI, Claude, DeepSeek & Gemini Security & Risk Analysis

The 'ai-content-wizard' plugin version 2.5 exhibits a mixed security posture. On the positive side, it has no recorded vulnerabilities (CVEs) and a generally good approach to output escaping and SQL prepared statements. However, significant concerns arise from the static analysis, particularly regarding its attack surface. With 10 AJAX handlers, 8 of which lack authentication checks, and 18 taint flows with unsanitized paths, there's a clear potential for unauthorized access and code execution. The high number of unsanitized path flows, even without critical severity, suggests that user-supplied input is not being properly validated or sanitized when interacting with file system operations or other potentially sensitive functions. This creates a risk for directory traversal or other path manipulation attacks if an attacker can influence these paths.