CPM All in one Poll Security & Risk Analysis

The cpm-all-in-one-responsive-poll plugin version 1.0 presents a significant security concern due to its lack of proper input validation and authorization checks on its entry points. While the plugin demonstrates good practices by avoiding dangerous functions, performing SQL queries exclusively with prepared statements, and not making external HTTP requests, these strengths are overshadowed by critical weaknesses.

The static analysis reveals two unprotected AJAX handlers, which are direct pathways for attackers to interact with the plugin's functionality without any form of authentication or authorization. This creates a substantial risk of unauthorized actions being performed. Furthermore, none of the 62 output points are properly escaped, indicating a high probability of Cross-Site Scripting (XSS) vulnerabilities, allowing attackers to inject malicious scripts into the site.

Although the plugin has no recorded vulnerability history, this does not guarantee future safety. The absence of security audits and the presence of basic security oversights like unescaped output and unprotected AJAX handlers suggest that vulnerabilities are likely to exist and may not have been discovered or reported. The plugin's overall security posture is poor, with critical flaws that need immediate attention.