Embed Extended – Embed Maps, Videos, Websites, Source Codes, and more Security & Risk Analysis

The "embed-extended" v1.4.0 plugin presents a mixed security posture. While it avoids dangerous functions, uses prepared statements for SQL, and doesn't engage in risky file operations or external HTTP requests, significant concerns arise from its attack surface and vulnerability history. The static analysis reveals three AJAX handlers that lack any authentication or capability checks, directly exposing them to potential abuse. Furthermore, all analyzed taint flows exhibited unsanitized paths, although thankfully none reached critical or high severity. The plugin's history of a medium-severity Cross-Site Request Forgery (CSRF) vulnerability, which is currently unpatched, is a particularly worrying sign. This indicates a recurring pattern of security weaknesses that could be exploited by attackers. While the absence of certain common vulnerabilities is positive, the open AJAX endpoints and the unaddressed past vulnerability create a tangible risk, suggesting a need for urgent review and patching.