Boo Recipes Security & Risk Analysis

The "boo-recipes" plugin version 2.4.1 exhibits a mixed security posture. While it demonstrates good practices such as 100% prepared SQL statements and a reasonable number of nonce and capability checks, there are significant areas of concern. The presence of three AJAX handlers without authentication checks represents a substantial attack surface. Furthermore, the static analysis indicates that only 47% of output is properly escaped, raising the risk of Cross-Site Scripting (XSS) vulnerabilities. The single taint flow with an unsanitized path, although not classified as critical or high, warrants attention as it suggests potential for path traversal or similar issues if exploited.

The plugin's vulnerability history, specifically a medium severity CVE related to XSS discovered in April 2025 and remaining unpatched, is a major red flag. This indicates a pattern of potential security weaknesses that may not be promptly addressed. The combination of unprotected entry points, imperfect output escaping, and an existing unpatched vulnerability suggests that users of this plugin are at a notable risk, particularly from XSS attacks and potentially unauthorized actions via unprotected AJAX endpoints.