CF7 Invisible reCAPTCHA Security & Risk Analysis

The plugin "cf7-invisible-recaptcha" v1.3.4 exhibits a mixed security posture. On the positive side, it boasts a small attack surface with only two AJAX entry points, neither of which are unprotected. The code also demonstrates good practices by exclusively using prepared statements for all SQL queries and includes nonce checks for its AJAX handlers. However, concerns arise from the output escaping, where only 52% of outputs are properly escaped, indicating a potential for Cross-Site Scripting (XSS) vulnerabilities. The plugin also makes two external HTTP requests, which could be a vector for various attacks if not handled securely.

The vulnerability history reveals two previously discovered medium-severity vulnerabilities, specifically Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS). While there are no currently unpatched CVEs, the recurring nature of these vulnerability types suggests potential weaknesses in how user input is handled and validated. The last reported vulnerability was in March 2023, which is relatively recent. The taint analysis shows no unsanitized paths or critical/high severity flows, which is a positive sign. Overall, the plugin has made progress in security, but the output escaping and past vulnerability trends warrant careful consideration.