Broadstreet Security & Risk Analysis

The "broadstreet" plugin version 1.52.2 presents a mixed security posture. While it demonstrates good practices like using prepared statements for all SQL queries and a high percentage of properly escaped output, significant concerns arise from its attack surface. A substantial number of entry points, specifically 16 out of 20, lack proper authentication or authorization checks, creating a large potential for unauthorized access and actions. The absence of any taint analysis results is positive, suggesting no critical flaws were detected in that specific area during the analysis. However, the plugin's history is marred by 6 known medium-severity CVEs, including past instances of missing authorization, CSRF, and XSS. The fact that there are currently no unpatched CVEs is a positive sign, but the recurring nature of these vulnerability types indicates a potential for similar weaknesses to be reintroduced or remain latent in the codebase. The most recent vulnerability was dated in the future (2026-01-19), which is an anomaly that warrants investigation and may indicate an error in the data itself or a projection that did not materialize. Overall, the plugin has strengths in secure database interactions and output handling, but its extensive unprotected entry points and past vulnerability patterns necessitate caution and vigilant monitoring.