Contact Manager Security & Risk Analysis

The "contact-manager" plugin v9.1.1 exhibits several concerning security weaknesses despite a seemingly controlled attack surface. While the plugin has a limited number of entry points (3 shortcodes) and no directly unprotected AJAX or REST API routes, the static analysis reveals significant risks within its codebase. The presence of 6 "unserialize" calls is a major red flag, as deserialization of untrusted data is a common attack vector. Furthermore, only a minuscule 10% of outputs are properly escaped, suggesting a high likelihood of Cross-Site Scripting (XSS) vulnerabilities. The taint analysis also highlights 4 high-severity flows with unsanitized paths, indicating potential for malicious data to be processed without proper validation.

The vulnerability history is particularly worrying. With 3 known CVEs, 1 of which is currently unpatched and 2 being high severity, this plugin has a track record of significant security flaws. The types of past vulnerabilities (Deserialization, XSS, Unrestricted Upload) directly correlate with the risks identified in the static analysis. The recentness of the last vulnerability (2026-02-04) suggests ongoing or recently discovered issues. While the plugin demonstrates some strengths like a good number of capability checks (78) and a low percentage of uninitiated SQL queries (1% prepared), these are overshadowed by the critical risks associated with unserialization, XSS potential, and the history of exploitable vulnerabilities.