Crelly Slider Security & Risk Analysis

The Crelly Slider plugin version 1.4.7 presents a mixed security posture. While it demonstrates good practices such as a majority of SQL queries using prepared statements and a reasonable number of capability checks and nonce checks for its entry points, several concerning signals emerge from the static analysis. Specifically, the presence of 5 flows with unsanitized paths and 4 high-severity taint flows indicate potential avenues for attackers to manipulate the application. This, coupled with a historical pattern of vulnerabilities including Cross-Site Scripting, SQL Injection, and Authorization Bypass, paints a picture of a plugin that, despite some security efforts, has previously been susceptible to significant risks. The fact that there is still one unpatched CVE as of January 2025 is a critical red flag, suggesting that known vulnerabilities may still be exploitable.