Contact Form by ContactMetrics Security & Risk Analysis

The plugin 'contact-form-by-contactmetrics' v1.5 exhibits a mixed security posture. On the positive side, it has a very small attack surface, with no known vulnerabilities in its history and no dangerous functions or external HTTP requests. It also demonstrates good practice by utilizing prepared statements for all its SQL queries. However, there are significant concerns regarding output escaping. The analysis indicates that 100% of the 20 identified output points are not properly escaped, which presents a high risk for cross-site scripting (XSS) vulnerabilities. Additionally, the taint analysis revealed two flows with unsanitized paths, although these were not classified as critical or high severity. The lack of nonce checks and capability checks also raises concerns about the integrity and authorization of operations, especially if the attack surface were to expand in future versions.