CRM Perks Forms – WordPress Form Builder Security & Risk Analysis

The "crm-perks-forms" plugin exhibits a concerning security posture, largely due to its historical vulnerability patterns and several weaknesses identified in the static analysis. While the absence of critical taint flows and dangerous functions is positive, the plugin has a history of 8 known CVEs, including 2 critical and 1 high severity. The recurrence of vulnerability types such as Unrestricted Upload, Missing Authorization, Cross-Site Scripting, and SQL Injection strongly suggests systemic issues in how user input is handled and access is controlled. The static analysis reveals a notable attack surface with 3 out of 9 AJAX handlers lacking authentication checks, presenting an immediate risk. Furthermore, only 7% of output is properly escaped, indicating a high likelihood of Cross-Site Scripting vulnerabilities. The SQL query situation is mixed, with 56% using prepared statements, but the remaining 44% may still be susceptible to injection if not properly sanitized. The presence of bundled libraries like Select2, if outdated, could also introduce further risks, though their specific version and vulnerability status are not provided. In conclusion, while the plugin has no currently unpatched critical CVEs, its past record and the static analysis findings point to significant ongoing risks that require immediate attention and robust remediation.