API info for Plugins & Themes from WP.ORG Security & Risk Analysis

The plugin "api-info-themes-plugins-wp-org" v1.13 exhibits a mixed security posture. On the positive side, the plugin has a zero attack surface exposed via AJAX handlers, REST API routes, shortcodes, or cron events, which is excellent for limiting direct entry points. Furthermore, a high percentage of SQL queries utilize prepared statements, and nonce and capability checks are present. However, several concerns arise from the static analysis. The presence of 15 dangerous functions, including `ini_set` and `unserialize`, raises red flags, especially when combined with a concerning taint analysis result of one high-severity flow with unsanitized paths. The fact that 53% of output is not properly escaped presents a significant risk of Cross-Site Scripting (XSS) vulnerabilities. The vulnerability history indicates a past medium-severity XSS issue, which aligns with the unescaped output finding and suggests a pattern of potential input sanitization weaknesses. While there are no currently unpatched CVEs, the historical vulnerability and the static analysis findings warrant careful attention.

Overall, while the plugin demonstrates good practices in limiting its attack surface and using prepared statements, the identified dangerous functions, the high-severity taint flow with unsanitized paths, and the substantial proportion of unescaped output introduce significant risks. The past XSS vulnerability reinforces these concerns. The plugin's strengths in attack surface reduction are overshadowed by potential vulnerabilities in input handling and output sanitization. Continued vigilance and remediation of these identified issues are crucial for maintaining a secure environment.