Easy Photo Album Security & Risk Analysis

The "easy-photo-album" plugin v1.3.7 exhibits a mixed security posture. On the positive side, the plugin demonstrates good practices by not making external HTTP requests, using prepared statements for all SQL queries, and implementing nonce and capability checks on its entry points. The static analysis found no critical or high-severity taint flows, and there are no currently unpatched vulnerabilities recorded.

However, several areas raise concerns. A significant weakness is the low percentage (38%) of properly escaped output, indicating a high potential for Cross-Site Scripting (XSS) vulnerabilities. While the static analysis didn't directly identify exploitable XSS due to the lack of taint flows with unsanitized paths, the high number of unescaped outputs presents a substantial risk. The plugin also bundles the TinyMCE library, which could be an outdated or vulnerable component if not properly managed.

The vulnerability history shows one previously recorded high-severity CVE related to "Exposure of Sensitive Information to an Unauthorized Actor." Although this vulnerability is patched and the last one was in 2016, it highlights a past weakness in the plugin's security that warrants attention. Coupled with the unescaped output issue, the plugin requires careful scrutiny and potentially further updates to ensure its ongoing security.