Easy Social Feed – Social Photos Gallery and Post Feed for WordPress Security & Risk Analysis

The plugin 'easy-facebook-likebox' v6.7.5 presents a mixed security posture. While it demonstrates good practices with a high percentage of prepared SQL statements and properly escaped outputs, significant concerns arise from its attack surface. The presence of 10 unprotected entry points, specifically AJAX handlers and REST API routes without proper authentication or permission checks, creates a substantial risk for unauthorized access and manipulation.

The static analysis also reveals 9 out of 11 analyzed taint flows with unsanitized paths, which is concerning despite no critical or high severity issues being flagged directly. This suggests potential for vulnerabilities that might not have been caught by the current analysis depth or that are present in the underlying logic. The vulnerability history, with 10 known medium severity CVEs, including Cross-Site Scripting, CSRF, and Missing Authorization, reinforces the potential for these types of attacks. The recurrence of these vulnerability types over time indicates a persistent weakness in how user input is handled and access is controlled.

In conclusion, while the plugin has some strengths like its use of prepared statements and output escaping, the unprotected entry points and a history of medium severity vulnerabilities, coupled with unsanitized taint flows, indicate a moderate to high risk. Addressing the unprotected entry points and rectifying the underlying causes of past vulnerabilities should be a priority.