WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database Security & Risk Analysis

The contact sheets-lite plugin v1.7.0 exhibits a generally strong security posture based on the provided static analysis and vulnerability history. The plugin demonstrates good practices by implementing robust nonce and capability checks for its AJAX handlers, and a very high percentage of SQL queries utilize prepared statements, significantly reducing the risk of SQL injection. The absence of known CVEs and a clean vulnerability history further contributes to this positive assessment, suggesting a well-maintained and secure codebase.

However, there are a few areas that warrant attention. The presence of 4 flows with unsanitized paths in the taint analysis, one of which is flagged as high severity, is the most significant concern. While the static analysis reports no direct vulnerabilities from these, unsanitized paths can lead to directory traversal or other file system-related vulnerabilities if not handled carefully in the logic. Additionally, while the majority of output is properly escaped, a 22% rate of unescaped output, though not critical, still presents a potential cross-site scripting (XSS) vector if sensitive data is involved. The use of the Guzzle library, if not kept up-to-date, could also introduce risks.