Clearout Email Validator – Real-Time Email Verification on WordPress Forms Security & Risk Analysis

The "clearout-email-validator" v3.3.1 plugin presents a mixed security posture. On the positive side, it demonstrates good practices by exclusively using prepared statements for SQL queries and not performing file operations or bundling external libraries. The absence of critical or high-severity taint flows and the fact that all known vulnerabilities are patched are encouraging signs.

However, there are significant concerns. The plugin exposes one AJAX handler without any authentication checks, creating a direct attack vector. While the static analysis shows a low number of total entry points, this single unprotected entry point is a critical weakness. Furthermore, only 70% of output is properly escaped, indicating a potential for cross-site scripting (XSS) vulnerabilities, especially given the plugin's history of XSS-related CVEs.

The historical vulnerability data, while currently unpatched, shows a past medium-severity XSS vulnerability. This pattern suggests that input sanitization and output escaping should be a primary focus for this plugin. The current version addresses past vulnerabilities, but the lingering concern around unescaped output in the static analysis warrants attention. Overall, the plugin has strengths in its SQL handling and vulnerability patching but is weakened by an unprotected AJAX endpoint and a concerning rate of unescaped output.