CompressX — AVIF & WebP Converter, Media Replacement Security & Risk Analysis

The "compressx" v0.9.36 plugin presents a significant security risk primarily due to its extensive unprotected AJAX handlers. While the plugin demonstrates good practices in SQL query preparation and output escaping, the sheer number of AJAX entry points (67) that lack authentication checks creates a wide attack surface. This means an attacker could potentially trigger any of these AJAX actions without prior authorization, leading to unpredictable consequences depending on the specific functionality of each handler. The taint analysis shows a high number of flows with unsanitized paths (14 out of 16), but thankfully, these did not escalate to critical or high severity vulnerabilities in the static analysis. The absence of any known CVEs in its vulnerability history is a positive sign, suggesting a history of relatively stable code. However, the critical concern remains the lack of authorization on a vast majority of its entry points, which overshadows other positive aspects. Therefore, while the plugin doesn't exhibit critical code flaws like unescaped output or raw SQL, the unprotected AJAX handlers constitute a substantial security weakness that requires immediate attention.