APPExperts – Mobile App Builder for WordPress | WooCommerce to iOS and Android Apps Security & Risk Analysis

The "appexperts" plugin v1.4.5 presents a mixed security posture. While it boasts a zero attack surface of unprotected entry points and a high percentage of SQL queries using prepared statements, significant concerns arise from its code signals and vulnerability history. The presence of the `unserialize` function, a known vulnerability vector, coupled with 13 unsanitized paths identified in taint analysis, indicates potential for critical vulnerabilities if these flows involve user-controlled input without proper sanitization. Furthermore, the plugin has a history of 3 known CVEs, with 2 remaining unpatched, and has suffered from SQL injection and information exposure vulnerabilities in the past. This history, along with the medium severity of past vulnerabilities, suggests a recurring pattern of security weaknesses that require diligent attention and patching. The low percentage of properly escaped output (35%) is also a significant concern, increasing the risk of Cross-Site Scripting (XSS) vulnerabilities.