Chartify – WordPress Chart Plugin Security & Risk Analysis

The Chart Builder plugin v3.7.1 presents a mixed security posture. While it exhibits good practices in SQL query preparation and output escaping, with 89% of both properly handled, a significant concern arises from its large attack surface. A total of 8 entry points are identified, with a concerning 7 of them lacking authentication checks. This is further exacerbated by 5 high-severity taint flows indicating unsanitized paths, suggesting potential for malicious input to be processed without proper validation. The plugin's vulnerability history is also a red flag, with 8 known CVEs including one critical unpatched vulnerability from 2025-12-03, and common types like CSRF, missing authentication, RFI, and XSS. This pattern of past vulnerabilities, coupled with the current code analysis findings, points to a history of security weaknesses that may still be present despite apparent improvements in some areas.

While the plugin demonstrates some strengths in secure coding practices like prepared statements and output escaping, the substantial number of unprotected entry points and high-severity taint flows are critical risks. The presence of past vulnerabilities, especially critical ones and those related to authentication and input handling, strongly suggests that users should exercise extreme caution. The plugin's recent critical vulnerability in 2025 indicates that even recent versions can harbor severe security flaws. It is crucial to address the unprotected AJAX handlers and the identified taint flows to mitigate the significant risks associated with this plugin. The vulnerability history, particularly the critical unpatched CVE, warrants immediate attention and mitigation strategies.