Calculator Builder – Create an Online Calculator Security & Risk Analysis

The "calculator-builder" plugin v1.6.3 presents a mixed security posture. While it demonstrates some good practices, such as a high percentage of properly escaped outputs and the use of prepared statements for most SQL queries, significant concerns remain. The presence of an unprotected AJAX handler creates a direct attack vector, and the use of `unserialize` is a notorious function for introducing deserialization vulnerabilities if not handled with extreme care and sanitization. The taint analysis revealing flows with unsanitized paths, particularly three classified as high severity, further exacerbates these risks. The plugin's vulnerability history, which includes a past high-severity "PHP Remote File Inclusion" vulnerability, suggests a pattern of potential security weaknesses that have required significant fixes in the past. While there are no currently unpatched CVEs, the historical pattern and the findings in the static analysis indicate that this plugin warrants careful monitoring and potentially more rigorous security auditing before widespread deployment.