CookieYes – Cookie Banner for Cookie Consent (Easy to setup GDPR/CCPA Compliant Cookie Notice) Security & Risk Analysis

The "cookie-law-info" plugin version 3.4.0 exhibits a mixed security posture. While it demonstrates good practices in SQL query sanitization (74% prepared statements) and a significant number of capability checks (36), there are notable areas of concern. The presence of 5 taint flows with unsanitized paths, all categorized as high severity, is a critical finding that warrants immediate attention as it suggests potential vulnerabilities like Cross-Site Scripting (XSS) or other forms of code injection.

Furthermore, the plugin has one REST API route without a permission callback, and a total of 20 entry points with one left unprotected. While the plugin has a low number of file operations (3) and external HTTP requests (9), the high number of unsanitized taint flows overshadows these strengths. The vulnerability history, while showing no currently unpatched CVEs, does list one medium severity vulnerability from 2020 related to Cross-Site Scripting, indicating a past susceptibility to this type of attack. The overall picture is that of a plugin with some solid security foundations but with critical flaws in input sanitization that could be exploited.