Custom Contact Forms Security & Risk Analysis

The plugin "custom-contact-forms" v7.8.5 presents a mixed security posture. On the positive side, it exhibits strong practices in output escaping, with 93% of outputs properly sanitized, and a good number of nonce and capability checks, suggesting an awareness of common WordPress security vulnerabilities. The attack surface appears small, with no unprotected entry points identified in the static analysis.

However, several concerns warrant attention. The presence of the `unserialize` function is a significant risk, as it can lead to Remote Code Execution if used with untrusted input. The taint analysis revealed four high-severity flows with unsanitized paths, indicating potential vulnerabilities where user input could be processed without proper validation. While there are no currently unpatched CVEs, the plugin has a history of two known vulnerabilities, including a past critical one related to missing authorization and XSS. This historical pattern, combined with the high-severity taint flows, suggests a recurring potential for input validation and authorization issues.

In conclusion, while the plugin demonstrates good output sanitization and has a contained attack surface, the use of `unserialize` and the identified high-severity taint flows are critical concerns. The historical vulnerability data further reinforces the need for vigilance. Prioritizing the remediation of these specific code signals and taint flows is crucial for improving the plugin's overall security.