Chat Support for Viber – Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode Security & Risk Analysis

The 'chat-viber' plugin version 1.7.10 demonstrates a generally good security posture with robust implementation of access controls and output sanitization. The static analysis reveals a significant number of capability checks and nonce checks, indicating a proactive approach to securing entry points. The high percentage of properly escaped outputs further mitigates the risk of Cross-Site Scripting (XSS) vulnerabilities. Taint analysis shows no identified flows with unsanitized paths, which is a very positive sign regarding the handling of potentially malicious input.

However, the presence of the `unserialize` function is a notable concern. While not directly flagged as vulnerable in the static or taint analysis, `unserialize` is inherently risky when processing untrusted data, as it can lead to object injection vulnerabilities if not handled with extreme care. The plugin's history includes one medium-severity CVE related to XSS, which, although currently patched, highlights a past weakness in input sanitization or output encoding. The fact that the last vulnerability was in early 2025 suggests it's a relatively recent issue and might indicate a pattern of previously overlooked vulnerabilities.

Overall, the plugin has a strong foundation in security best practices. The primary area of caution lies in the `unserialize` function, which should be carefully reviewed for potential misuse. The historical CVE, while patched, serves as a reminder to maintain vigilance, especially concerning input handling and output escaping.