sermon.net display Security & Risk Analysis

The plugin "display-sermonnet" v1.4.4 presents a mixed security posture. On the positive side, it demonstrates good practices by exclusively using prepared statements for SQL queries and has no recorded historical vulnerabilities. The absence of dangerous functions, file operations, and critical taint flows is also reassuring. However, significant concerns arise from its attack surface and output escaping practices. With a total of 3 entry points, one AJAX handler is left unprotected, posing a direct risk. Furthermore, a low proper output escaping rate of 26% indicates a high likelihood of cross-site scripting (XSS) vulnerabilities, especially when combined with the unprotected AJAX handler.