Contact Forms by Cimatti Security & Risk Analysis

The "contact-forms" plugin v1.9.13 presents a mixed security posture. While it demonstrates some good practices like a significant percentage of SQL queries using prepared statements and a good number of nonce and capability checks, several concerning areas exist. The static analysis highlights a notable attack surface with 12 entry points, of which 2 lack authentication checks, making them prime targets for unauthorized actions. The presence of dangerous functions like `unserialize` and `create_function`, coupled with a very low percentage (6%) of properly escaped output, strongly indicates a high risk of Cross-Site Scripting (XSS) vulnerabilities. Furthermore, the taint analysis reveals 6 high-severity flows with unsanitized paths, suggesting potential for data manipulation or execution vulnerabilities.

The plugin's vulnerability history is particularly worrying, with 11 known CVEs, all of which are currently patched. However, the prevalence of medium and high severity vulnerabilities, specifically CSRF, Missing Authorization, and XSS, in the past indicates a recurring pattern of weaknesses in its security implementation. The last reported vulnerability was recent (2025-06-02), which, despite being patched, underscores the ongoing need for vigilance. The combination of direct code vulnerabilities and historical patterns suggests that this plugin, while not currently exposing unpatched critical issues, carries inherent risks due to its codebase and past security record.