Custom Layouts – Post + Product grids made easy Security & Risk Analysis

The "custom-layouts" plugin version 1.5.1 demonstrates some good security practices, particularly with its use of prepared statements for SQL queries and a high percentage of properly escaped output. The static analysis shows no critical or high severity taint flows, which is a positive sign regarding potential injection vulnerabilities. Additionally, there are no unprotected REST API routes or AJAX handlers identified in the attack surface, indicating a conscious effort to secure entry points.

However, the plugin has a history of known vulnerabilities, specifically two medium severity CVEs. While currently unpatched vulnerabilities are zero, the recurrence of issues like Missing Authorization and Cross-site Scripting in the past warrants caution. The presence of only two nonce checks and seven capability checks across 23 REST API routes suggests that while some controls are in place, the overall security posture might be less robust than desired, especially if some of these routes handle sensitive operations or user-supplied data.

In conclusion, "custom-layouts" v1.5.1 is not without its strengths, particularly in its handling of SQL and output. Nonetheless, the past vulnerability history, coupled with a seemingly limited number of authorization and nonce checks relative to the attack surface, presents a moderate risk. Vigilance is advised, and users should stay updated on any future security advisories for this plugin.