WP Star Reviews, Map, and Testimonials Security & Risk Analysis

The "contempo-reviews" v1.2 plugin exhibits a mixed security posture. While it demonstrates good practices by exclusively using prepared statements for SQL queries and largely avoiding file operations and external HTTP requests, significant security concerns are present. The plugin has a small but critical attack surface with two of its three AJAX handlers lacking authentication checks, presenting a direct pathway for unauthorized actions. Furthermore, the analysis indicates a concerning lack of output escaping, with only 11% of outputs being properly sanitized, increasing the risk of cross-site scripting (XSS) vulnerabilities. The presence of the `create_function` dangerous function also adds to the potential for code injection issues.

Despite a clean vulnerability history with no known CVEs, the static analysis reveals a significant number of potential weaknesses that could be exploited. The absence of capability checks on AJAX handlers and the limited output escaping are particularly worrying. The bundled outdated jQuery library, while not a direct exploit vector in itself, can become a liability if vulnerabilities are discovered in that specific version. Overall, the plugin has some strengths in its data handling but suffers from critical vulnerabilities in its input handling and output sanitization, requiring immediate attention.