Easy Table of Contents Security & Risk Analysis

The static analysis of easy-table-of-contents v2.0.81 reveals a generally strong security posture with good practices in place. Notably, all identified AJAX handlers and REST API routes appear to have authorization checks, and 100% of SQL queries utilize prepared statements. The plugin also demonstrates robust output escaping, with 94% of outputs properly handled, and a significant number of nonce and capability checks are present. File operations are absent, and external HTTP requests are limited to one, further reducing the attack surface.

However, the plugin's vulnerability history presents a significant concern. With a total of 5 known CVEs, all of which were medium severity, and a recent vulnerability dated 2026-02-18, this indicates a recurring pattern of security weaknesses. The common vulnerability types, 'Cross-site Scripting' and 'Missing Authorization,' suggest that input validation and access control might be areas that require consistent attention. While the current version appears to be free of unpatched vulnerabilities, the historical prevalence suggests potential for future undiscovered issues or regressions.

In conclusion, while the current code analysis shows positive security indicators and a well-structured approach to handling sensitive operations, the historical vulnerability data warrants caution. The plugin has a track record of security flaws, even if they were medium severity. Users should remain vigilant and ensure timely updates when new versions are released, as the past suggests a tendency for vulnerabilities to emerge.