CBX Bookmark & Favorite Security & Risk Analysis

The cbxwpbookmark v2.0.6 plugin exhibits a mixed security posture. While it demonstrates good practices in SQL query preparation and output escaping, a significant concern arises from its large attack surface, particularly the 15 unprotected AJAX handlers. This lack of authorization checks on numerous entry points is a major weakness.

The taint analysis reveals one flow with an unsanitized path, indicating a potential for vulnerabilities, though it's classified as critical/high severity. The plugin's history is concerning, with 6 known CVEs, including one critical and five medium-severity vulnerabilities, predominantly involving missing authorization, XSS, and SQL injection. The fact that the last vulnerability was in 2026 is alarming and suggests a pattern of past security issues that could be indicative of ongoing development challenges or a lack of robust security auditing.

In conclusion, the plugin's strengths lie in its secure handling of SQL and output, but these are overshadowed by critical weaknesses in authorization for its AJAX endpoints and a history of significant vulnerabilities. The presence of unprotected AJAX handlers combined with past critical vulnerabilities points to a moderate to high risk.