Open Currency Converter Security & Risk Analysis

The plugin "artiss-currency-converter" v1.5.0 exhibits a mixed security posture. While it demonstrates good practices such as using prepared statements for all SQL queries and including nonce checks, there are notable areas of concern. The static analysis reveals a small attack surface with only one shortcode entry point, and importantly, no unprotected entry points were found. However, the taint analysis identified one flow with an unsanitized path, which, despite not being classified as critical or high, warrants attention as it suggests a potential for input-related vulnerabilities. The vulnerability history is a significant red flag. With one known medium severity CVE that is currently unpatched, and a history of Cross-site Scripting (XSS) vulnerabilities, it indicates a recurring issue with input handling or output escaping. Although the latest vulnerability was dated in the future (2025-10-10), this could be an anomaly in the data, but the pattern of past XSS issues remains relevant. Overall, the plugin has strengths in its structured approach to security but is weakened by a history of unpatched vulnerabilities and a detected unsanitized input flow.