ApplyOnline – Application Form Builder and Manager Security & Risk Analysis

The 'apply-online' plugin v2.6.8.1 presents a mixed security posture. While it demonstrates some good practices, such as a relatively low number of critical and high severity vulnerabilities historically and a good percentage of SQL queries using prepared statements and properly escaped outputs, there are significant areas of concern. The presence of two AJAX handlers without authentication checks is a direct entry point for potential unauthorized actions. Furthermore, the historical vulnerability data, with six medium severity CVEs, particularly related to 'Files or Directories Accessible to External Parties', 'Missing Authorization', and 'Cross-site Scripting', indicates a recurring pattern of exploitable weaknesses. Although no critical or high vulnerabilities are currently unpatched, the history suggests a tendency for the plugin to be a target for security flaws. The use of the `unserialize` function, a known risky function, also adds to the potential attack surface, especially if user-controlled data is involved without proper sanitization. Overall, while not currently in a critical state, the plugin requires careful monitoring and proactive patching due to its past and ongoing exploitable characteristics.