Digioh Forms, Popups, Quizzes, Surveys, Abandon Cart Security & Risk Analysis

The Digioh plugin v1.1.2 presents a mixed security posture. On the positive side, the plugin demonstrates excellent output escaping practices and avoids making external HTTP requests, which are common vectors for vulnerabilities. The absence of any recorded vulnerabilities or CVEs in its history is a strong indicator of a well-maintained and secure codebase.

However, the static analysis reveals significant concerns. The presence of SQL queries without prepared statements is a notable risk, as it can lead to SQL injection vulnerabilities if the data used in the query is not properly sanitized. Furthermore, the taint analysis indicates flows with unsanitized paths, although they are not classified as critical or high severity. The complete lack of nonce and capability checks across all entry points (AJAX, REST API, shortcodes, cron) is a major security weakness, leaving these potential entry points vulnerable to unauthorized access and manipulation.

In conclusion, while the plugin's history and output escaping are commendable, the identified SQL query and taint flow issues, coupled with the alarming absence of any authorization or security checks on its entry points, indicate a substantial risk. These oversights could be exploited to perform unauthorized actions or manipulate data, despite the lack of historical vulnerability data.