Easy Support Videos – Embed videos in the admin Security & Risk Analysis

The "easy-support-videos" v2.0.0 plugin presents a mixed security posture. On the positive side, the plugin demonstrates good practices by exclusively using prepared statements for all its SQL queries and avoiding dangerous functions, file operations, and external HTTP requests. The absence of known CVEs and a clean vulnerability history are also significant strengths, suggesting a history of relatively secure development. However, a considerable concern lies within its attack surface. With 15 AJAX handlers, a substantial 10 of these lack any authentication checks, creating a significant entry point for potential unauthorized actions. While taint analysis shows no vulnerabilities, the large number of unprotected AJAX endpoints means that if any input sanitization or permission checks were to be mishandled within these endpoints, sensitive operations could be performed by unauthenticated users. The plugin also has a moderate number of output operations with a concerning 32% that are not properly escaped, increasing the risk of cross-site scripting (XSS) vulnerabilities.