Click to top Security & Risk Analysis

The 'click-to-top' plugin v1.3.0 demonstrates a generally good security posture in its static analysis, with no dangerous functions, no unescaped SQL queries, and a high percentage of output escaping. The presence of nonce and capability checks on its AJAX handlers is also a positive sign, indicating an effort to secure these entry points.

However, the plugin's vulnerability history is a significant concern. With two known medium-severity vulnerabilities in the past, specifically related to Missing Authorization and Cross-site Scripting, there's a pattern of past security weaknesses. While there are currently no unpatched vulnerabilities, the historical prevalence of these common and impactful vulnerability types suggests potential underlying issues in how user input is handled or how authorization is managed.

While the current code analysis doesn't reveal immediate exploitable flaws, the historical context warrants caution. The plugin has a history of exploitable vulnerabilities that were addressed, but the recurring nature of certain vulnerability types suggests a need for ongoing scrutiny and potentially more robust security practices in future development to prevent similar issues from resurfacing.