Compact Archives Security & Risk Analysis

The "compact-archives" plugin v4.1.1 presents a mixed security posture. On the positive side, the static analysis reveals a very small attack surface with only one shortcode and no unprotected entry points. The plugin also demonstrates good practices in output escaping, with a high percentage of outputs properly escaped, and avoids dangerous functions, file operations, and external HTTP requests. However, several significant concerns emerge from the analysis.

The most critical issue is the presence of an unpatched medium severity CVE, indicating a known vulnerability that exposes users to potential Cross-site Scripting attacks. Furthermore, the plugin's single SQL query is not using prepared statements, which is a common vector for SQL injection vulnerabilities. The absence of nonce and capability checks on its entry points, though the attack surface is small, means that any potential vulnerability within those points could be exploited without proper authorization or protection against CSRF attacks.

Overall, while the plugin has a limited attack surface and good output escaping, the unpatched CVE and the raw SQL query are serious weaknesses that significantly increase the risk. The history of vulnerabilities, particularly the Cross-site Scripting type, suggests a recurring pattern of input sanitization issues or insufficient output encoding in the past that may have contributed to this current unpatched vulnerability. Users should be cautious and prioritize patching or finding an alternative until the reported CVE is addressed.