CM Custom Reports – Flexible reporting to track what matters most Security & Risk Analysis

The "cm-custom-reports" v1.2.8 plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices regarding SQL queries, utilizing prepared statements exclusively, and implements a significant number of nonce checks. However, a substantial concern arises from the attack surface, with 4 out of 9 entry points lacking authentication checks, specifically within its AJAX handlers. Furthermore, the output escaping mechanism is only 46% effective, indicating a potential for cross-site scripting (XSS) vulnerabilities, especially given the plugin's past history of a medium severity XSS vulnerability. While there are no currently unpatched CVEs and no critical taint flows, the combination of unprotected entry points and insufficient output sanitization presents a notable risk. The plugin's historical vulnerability, though resolved, combined with the identified weaknesses, suggests that careful monitoring and potential mitigation efforts for the exposed AJAX handlers are warranted.