Footer Contacts D Security & Risk Analysis

The "dn-footer-contacts" plugin v1.8.1 exhibits a mixed security posture. While it demonstrates good practices in areas like SQL query preparation and output escaping, significant concerns arise from its attack surface and vulnerability history. The presence of three AJAX handlers, all lacking authentication checks, presents a considerable risk for unauthorized actions. Taint analysis showing no flows is a positive sign, indicating no immediately obvious code injection vulnerabilities in this specific analysis. However, the plugin's history of two known CVEs, one of which is currently unpatched, is a major red flag. The common vulnerability types (CSRF and XSS) found in its history suggest a pattern of input validation and state management weaknesses. The existence of an unpatched medium severity vulnerability is particularly worrying, leaving users exposed to known exploits. While the plugin's handling of SQL and output escaping is commendable, the unprotected entry points and historical vulnerabilities significantly elevate the overall risk.