AWeber Registration Integration Security & Risk Analysis

The AWeber Registration Integration plugin, version 1.2.8, presents a mixed security posture. On one hand, it demonstrates excellent practices by avoiding common attack vectors such as AJAX handlers, REST API routes, shortcodes, and cron events without proper authentication and capability checks. The complete absence of known CVEs further suggests a history of responsible development and maintenance. However, the static analysis reveals significant concerns, particularly regarding SQL query security and output sanitization. All SQL queries are executed without prepared statements, leaving the plugin vulnerable to SQL injection. Additionally, a very low percentage of output is properly escaped, increasing the risk of cross-site scripting (XSS) vulnerabilities. The single external HTTP request also warrants attention, as it could potentially be exploited if not handled securely. Despite the lack of known vulnerabilities, the identified code weaknesses in SQL handling and output escaping present a notable risk.