Automatic pages for Privacy Policy, Terms, About, Contact us Security & Risk Analysis

The plugin "automatic-pages-for-privacy-policy-terms-about-and-contact" v1.46 exhibits a mixed security posture. While it boasts a seemingly small attack surface with zero unprotected entry points, several concerning code signals and taint analysis findings warrant attention. The presence of a dangerous `unserialize` function, a high-severity taint flow with unsanitized paths, and only 50% of output being properly escaped indicate potential vulnerabilities in how the plugin handles and processes data. The vulnerability history, while showing no currently unpatched CVEs, does reveal a past medium-severity Cross-site Scripting (XSS) vulnerability, suggesting that improper input neutralization has been an issue in the past. Although the plugin demonstrates good practices in using prepared statements for SQL queries and incorporating some nonce and capability checks, the identified risks, particularly the `unserialize` function and unsanitized path flows, are significant enough to warrant caution.