Draft Notify Security & Risk Analysis

The 'draft-notify' v1.5 plugin presents a mixed security posture. On the positive side, the static analysis reveals a very limited attack surface with no apparent AJAX handlers, REST API routes, shortcodes, or cron events. Furthermore, there are no critical or high severity taint flows identified, and no file operations or external HTTP requests, which are good indicators of secure coding practices in those areas. However, significant concerns arise from the SQL query handling and output escaping. All three SQL queries are executed without prepared statements, posing a risk of SQL injection vulnerabilities. Additionally, a large majority of output (87%) is not properly escaped, creating a high risk of Cross-Site Scripting (XSS) vulnerabilities.

The vulnerability history is a major red flag, with one medium severity CVE for Cross-Site Scripting that remains unpatched. This indicates a recurring issue with input sanitization and output escaping, mirroring the findings in the static code analysis. The fact that this vulnerability is recent (2025) and unpatched is particularly concerning. While the plugin has a small attack surface, the identified vulnerabilities in SQL handling and output escaping, combined with a known unpatched XSS vulnerability, significantly elevate the overall risk. Users should exercise caution and consider alternatives or ensure this specific vulnerability is addressed before deployment.