CM Header and Footer – Add custom scripts and styles to your header and footer with ease Security & Risk Analysis

The "cm-header-footer-script-loader" plugin v1.3.0 exhibits a mixed security posture. While it demonstrates some good practices such as the absence of critical or high-severity vulnerabilities in its history and a low number of SQL queries, several concerning areas warrant attention. The static analysis reveals a notable attack surface with 6 AJAX handlers, 3 of which lack authentication checks, posing a significant risk of unauthorized actions. Furthermore, a concerning taint analysis result indicates one flow with an unsanitized path, which could potentially lead to various injection vulnerabilities if not addressed. The plugin's vulnerability history, though currently showing no unpatched CVEs, does include one medium-severity vulnerability related to Cross-site Scripting, suggesting a past susceptibility to input manipulation. Overall, the plugin has strengths in its limited SQL usage and lack of dangerous functions, but the unprotected entry points and unsanitized data flow are critical weaknesses that require immediate remediation to improve its security.