Authorsy – Author Box, Multiple Authors, Guest Authors & Post Rating Security & Risk Analysis

The "authorsy" plugin v1.0.7 exhibits a generally good security posture, particularly in its handling of SQL queries and output escaping, with a very high percentage of outputs properly escaped and all SQL queries utilizing prepared statements. The presence of nonce and capability checks further bolsters its defense against common web vulnerabilities. The static analysis reveals a small attack surface with no directly unprotected entry points.

However, the use of the "preg_replace(/e)" dangerous function is a notable concern. While taint analysis did not reveal any immediate unsanitized paths, this function, if misused, can be a vector for code injection or unintended regular expression evaluation, potentially leading to security issues. The plugin's vulnerability history, with two known medium-severity CVEs related to Authorization Bypass and Cross-site Scripting, even though currently unpatched, indicates a past susceptibility to critical vulnerability types.

The plugin's strengths lie in its robust input sanitization and authorization mechanisms. Nevertheless, the historical presence of vulnerabilities and the identified dangerous function warrant caution. While the current version appears to have addressed past issues and has a small attack surface, vigilance regarding the "preg_replace(/e)" usage and awareness of past vulnerability types is recommended.