Easy Digital Downloads – Coming Soon Security & Risk Analysis

The "edd-coming-soon" plugin version 1.3.3 demonstrates a generally positive security posture, with a limited attack surface and a lack of known critical vulnerabilities. The plugin adheres to some good security practices, such as using prepared statements for all SQL queries and performing a nonce check on its sole entry point. There are no recorded vulnerabilities or CVEs for this plugin, which is a strong indicator of past security diligence.

However, there are areas for improvement. The low percentage of properly escaped output (31%) is a significant concern, as it suggests a high risk of Cross-Site Scripting (XSS) vulnerabilities. While no specific XSS flows were identified in the limited taint analysis, the lack of proper output sanitization across a substantial portion of the code is a latent threat. Additionally, the absence of capability checks on the identified shortcode is a weakness, as it may allow unauthorized users to interact with plugin functionalities.

Overall, "edd-coming-soon" v1.3.3 is in a relatively secure state due to its limited attack surface and clean vulnerability history. The primary concern lies with the output escaping, which presents a tangible risk of XSS if not addressed. The lack of capability checks on the shortcode also warrants attention to ensure robust access control.