Clearblue® Ovulation Calculator Security & Risk Analysis

The 'clearblue-ovulation-calculator' plugin exhibits a concerning security posture despite a seemingly clean static analysis report. The absence of any identified entry points or dangerous functions in the static analysis is positive, as is the exclusive use of prepared statements for SQL queries. However, the extremely low percentage of properly escaped output (18%) represents a significant risk for cross-site scripting (XSS) vulnerabilities, especially if user-supplied data is ever rendered without proper sanitization. Furthermore, the complete lack of nonce checks and capability checks across all potential handlers, if any existed, indicates a potential for privilege escalation or unauthorized actions if an attack vector is discovered.

The vulnerability history is a major red flag. The presence of a single, high-severity 'PHP Remote File Inclusion' (RFI) vulnerability, which is currently unpatched and occurred recently (July 2025), strongly suggests recurring insecure coding practices related to file handling. The fact that the last vulnerability was so recent and is unpatched implies that the developers have not addressed this critical flaw, leaving users highly exposed. This pattern of a high-severity RFI vulnerability in the past and the current unpatched state is the most significant concern.

In conclusion, while the plugin shows some good practices like using prepared statements, the critical issues of widespread output un-sanitization and a severe, unpatched RFI vulnerability overshadow these positives. The lack of any identified entry points in the static analysis might be misleading if the RFI vulnerability creates an indirect attack surface. Users of this plugin should be extremely cautious, and immediate patching of the RFI vulnerability is paramount.