Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress Security & Risk Analysis

The "campus-directory" plugin v1.9.3 exhibits a mixed security posture. On the positive side, the plugin demonstrates good practices by consistently using prepared statements for all SQL queries, performing a high percentage of output escaping (82%), and implementing a substantial number of nonce and capability checks (25 and 23 respectively). The absence of currently unpatched CVEs and no critical or high severity vulnerabilities in its history are also encouraging signs.

However, several areas raise concerns. The presence of 7 AJAX handlers without authentication checks represents a significant attack surface, especially when combined with 2 flows identified as high severity in the taint analysis. The use of the `preg_replace` function with the `/e` modifier is a known risk for introducing code execution vulnerabilities, and although no critical issues were found related to it, its presence warrants caution. The plugin also bundles an outdated version of Select2 (v3.2), which may itself contain unpatched vulnerabilities.

Overall, while the plugin has strengths in core security practices like SQL handling and output sanitization, the unprotected AJAX endpoints, identified high-severity taint flows, and the presence of the dangerous `preg_replace` function are notable weaknesses. The historical pattern of medium severity Cross-site Scripting (XSS) vulnerabilities, although currently patched, suggests a potential for such issues if input validation and sanitization aren't meticulously maintained.