Broken Links Repair By Hexometer Security & Risk Analysis

The "broken-link-repair" plugin, version 1.0.4, exhibits a generally good security posture based on the static analysis. The plugin has a notably small attack surface, with no exposed AJAX handlers, REST API routes, shortcodes, or cron events that appear to lack authentication or permission checks. The absence of dangerous functions and critical taint flows further strengthens this assessment. Furthermore, the plugin has no recorded vulnerability history, indicating a stable and secure track record.

However, there are specific areas for concern. The significant proportion of SQL queries (100%) not using prepared statements presents a potential risk for SQL injection vulnerabilities, especially as the plugin has no documented history of addressing such issues. Additionally, the low percentage of properly escaped output (8%) leaves the plugin susceptible to cross-site scripting (XSS) attacks. The presence of file operations without explicit mention of sanitization or permission checks also warrants caution. While the plugin's clean history is a positive sign, the identified code-level weaknesses require attention to maintain its security.