CMB2 Security & Risk Analysis

CMB2 v2.11.0 exhibits a generally good security posture with several strengths, including a lack of identified REST API routes, shortcodes, and cron events, resulting in a very small attack surface. The plugin also demonstrates strong practices in SQL query handling, with 100% using prepared statements. Furthermore, it incorporates nonce and capability checks, and importantly, no external HTTP requests or file operations are present, mitigating common attack vectors. However, the presence of a `unserialize` function, even if not directly flagged in taint analysis for this version, remains a potential concern as it's a known vector for deserialization vulnerabilities. While the plugin has had a historical CVE related to deserialization of untrusted data, it's currently patched, which is a positive sign. The moderate output escaping percentage (73%) is a weakness that could lead to XSS vulnerabilities if user-supplied data is not properly sanitized before output. Overall, CMB2 v2.11.0 is a relatively secure plugin, but attention should be paid to the `unserialize` function and ensuring all output is properly escaped.