Bangla Date Display Security & Risk Analysis

The "bangla-date-display" v9.4.2 plugin exhibits several concerning security practices, despite a clean vulnerability history. The static analysis reveals a significant attack surface with 2 out of 8 total entry points lacking authentication checks. This is a primary concern as it exposes these functions to potential unauthorized access and manipulation.

Furthermore, the plugin's handling of SQL queries is a major weakness. All 2 SQL queries are executed without prepared statements, introducing a high risk of SQL injection vulnerabilities. The taint analysis also flagged 2 flows with unsanitized paths, indicating potential issues with how external data is handled, although no critical or high severity vulnerabilities were identified in this specific analysis.

While the plugin has no recorded CVEs, this does not negate the inherent risks present in the code. The lack of capability checks and nonce checks on entry points, coupled with the significant portion of improperly escaped output (55%), further amplifies the potential for cross-site scripting (XSS) and other injection attacks. The plugin's security posture is therefore considered weak due to these critical coding flaws.