Beds24 Online Booking Security & Risk Analysis

The "beds24-online-booking" plugin version 2.0.30 exhibits a mixed security posture. While the static analysis shows no direct vulnerabilities like SQL injection or untrusted paths, and all identified entry points appear to have authorization checks, several concerning signals are present. The plugin has a history of 7 known CVEs, with a significant number of medium-severity vulnerabilities related to Cross-site Scripting (XSS) and PHP Remote File Inclusion (RFI). The fact that the last vulnerability was reported very recently (May 2025) and there are currently no unpatched vulnerabilities is a positive sign, suggesting the vendor actively addresses security issues. However, the code analysis reveals potential weaknesses: 69% of output is properly escaped, leaving a substantial portion unescaped, which could lead to XSS if malicious input is not handled correctly. The absence of nonce checks across all entry points is a major concern, as it leaves the plugin vulnerable to Cross-Site Request Forgery (CSRF) attacks. Furthermore, the plugin performs file operations and external HTTP requests, which, without proper sanitization and validation, can introduce security risks.