Contacts BMLT Security & Risk Analysis

The "contacts-bmlt" plugin v1.3.2 demonstrates a generally positive security posture based on the provided static analysis and vulnerability history. It shows a commitment to secure coding practices by avoiding dangerous functions, all SQL queries utilizing prepared statements, and a single external HTTP request which is a common and often necessary feature. The presence of a nonce check is also a good sign. The lack of any recorded vulnerabilities or CVEs in its history further suggests a stable and secure offering.

However, there are areas for improvement. While the number of output escapes is relatively high, 28% of them are not properly escaped, introducing a potential risk of cross-site scripting (XSS) vulnerabilities if the unescaped output is user-controllable. The plugin also lacks capability checks on its single shortcode entry point, meaning any user, regardless of their role, could potentially execute the shortcode's functionality. This could lead to unintended behavior or information disclosure depending on what the shortcode does.

In conclusion, "contacts-bmlt" v1.3.2 is a relatively secure plugin with a clean vulnerability history and good use of prepared statements. The primary concerns lie in the unescaped output and the absence of capability checks on its shortcode. Addressing these specific issues would significantly enhance its overall security.