CubeWP Forms Security & Risk Analysis

The cubewp-forms plugin, version 1.1.10, presents a mixed security posture. While it exhibits several good security practices such as a lack of unprotected entry points and a high percentage of SQL queries using prepared statements, significant concerns remain. The presence of the `unserialize` function is a notable risk, especially when combined with identified taint flows that have unsanitized paths. The vulnerability history reveals a pattern of past issues, including a currently unpatched high-severity vulnerability and common types like missing authorization and Cross-Site Scripting, suggesting a recurring need for robust security development practices. The plugin has a moderate attack surface, but the total number of entry points and the high percentage of properly escaped outputs are positive indicators. However, the presence of a known, unpatched high-severity vulnerability and the potential risks associated with unserialize functionality and unsanitized taint flows create a situation that requires immediate attention.