BMI Adult & Kid Calculator Security & Risk Analysis

The "bmi-adultkid-calculator" plugin v1.2.2 exhibits a mixed security posture. On the positive side, the static analysis reveals strong adherence to secure coding practices, with no dangerous functions, all SQL queries using prepared statements, and an exceptionally high rate of output escaping. The plugin also correctly implements nonce and capability checks on its AJAX handlers, and there are no identified critical or high severity taint flows. However, the plugin's vulnerability history is a significant concern. With three known CVEs, two of which remain unpatched, and common vulnerability types including Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF), this indicates a recurring pattern of security weaknesses. The most recent vulnerability being in late 2025 further suggests ongoing issues.

While the current version's code appears to be cleaner than in the past, the history of exploitable vulnerabilities, particularly XSS and CSRF, suggests that developers may struggle with thoroughly sanitizing user inputs or correctly implementing security measures across all code paths. The presence of unpatched vulnerabilities, even if medium severity, represents a direct and actionable risk to WordPress sites running this plugin. Therefore, despite the improvements in static analysis findings for this specific version, the historical context strongly advises caution.