CM FAQ – Simplify support with an intuitive FAQ management tool Security & Risk Analysis

The "cm-faq" plugin version 1.3.2 exhibits a mixed security posture. On the positive side, it demonstrates good practices in its handling of SQL queries, with all queries utilizing prepared statements, and it includes a decent number of nonce checks and capability checks. However, several concerns detract from its overall security. The presence of three AJAX handlers without authentication checks presents a significant attack surface, potentially allowing unauthorized users to trigger functionalities. The taint analysis also revealed one flow with an unsanitized path, which, while not classified as critical or high severity in this specific analysis, could indicate potential for vulnerabilities if not properly handled in context.

The vulnerability history shows a single medium-severity CVE related to Cross-Site Scripting (XSS), which was last disclosed in March 2025. While this vulnerability is currently patched, the pattern suggests that XSS remains a potential concern for this plugin. The static analysis also indicates a concerningly low rate of proper output escaping (49%), which directly correlates with XSS vulnerabilities, as it means a substantial portion of user-generated or dynamic content might be rendered without adequate sanitization, leaving the application vulnerable to malicious script injection.

In conclusion, while the plugin has some strong security fundamentals like prepared SQL statements, the unprotected AJAX endpoints, the identified unsanitized path flow, and the high proportion of improperly escaped output create notable risks. The past XSS vulnerability further underscores the need for vigilance in output sanitization. Users should be aware of these potential weaknesses and ensure the plugin is kept up-to-date.