Dynaposty Dynamic Landing Pages Security & Risk Analysis

The dynaposty-dynamic-landing-pages plugin v0.2 exhibits a concerning security posture due to significant weaknesses in its handling of user-supplied data and entry points. While the plugin demonstrates good practice by exclusively using prepared statements for SQL queries and has no recorded vulnerability history, these strengths are overshadowed by critical security flaws. The static analysis reveals a small attack surface of two AJAX handlers, both of which lack authentication checks, presenting a direct avenue for unauthorized actions. Furthermore, the plugin fails to implement any nonce checks on these critical entry points. The taint analysis indicates two flows with unsanitized paths, although they are not flagged as critical or high severity, they highlight potential issues in how data is processed. A particularly worrying finding is that 0% of the 25 identified outputs are properly escaped, which strongly suggests a high risk of Cross-Site Scripting (XSS) vulnerabilities, allowing attackers to inject malicious scripts into the site.