Donation Thermometer Security & Risk Analysis

The "donation-thermometer" plugin, version 2.2.7, exhibits a mixed security posture. On the positive side, static analysis indicates a generally secure implementation with no identified dangerous functions, raw SQL queries, file operations, or external HTTP requests. All observed SQL queries utilize prepared statements, which is a strong practice. However, a significant concern arises from the output escaping, where only 58% of outputs are properly escaped. This suggests a potential for Cross-Site Scripting (XSS) vulnerabilities, especially considering the plugin's vulnerability history which includes two past medium-severity XSS issues.

The plugin has a relatively small attack surface consisting solely of shortcodes, and importantly, all entry points appear to be protected from unauthorized access as there are no unprotected AJAX handlers or REST API routes. The absence of critical or high-severity taint flows further reinforces the idea that direct code execution or critical data leakage is unlikely from the analyzed code. However, the vulnerability history, particularly the prevalence of XSS and the fact that the last vulnerability was in the future (2025-11-26), warrants careful consideration. While there are no currently unpatched CVEs, the pattern of past XSS vulnerabilities combined with insufficient output escaping indicates a persistent risk that requires ongoing attention.

In conclusion, the plugin demonstrates good practices in areas like SQL query handling and avoiding common attack vectors. The lack of unprotected entry points is also a strength. Nevertheless, the substantial proportion of improperly escaped outputs and the history of XSS vulnerabilities are significant weaknesses that elevate the overall risk. Users should be aware of the potential for XSS, and developers should prioritize addressing the output escaping issues.