Enable SVG, WebP, and ICO Upload Security & Risk Analysis

The "enable-svg-webp-ico-upload" plugin version 1.1.4 presents a mixed security profile. While the code analysis shows good practices in terms of SQL query sanitization and output escaping, with 100% of both being handled correctly, there are significant concerns regarding its attack surface and historical vulnerability record. The plugin exposes two AJAX handlers, both of which lack authentication checks. This means any unauthenticated user could potentially interact with these handlers, posing a direct risk if they are not properly secured within the code itself.

The vulnerability history is particularly concerning, with a total of 5 known CVEs, including 2 high and 2 medium severity vulnerabilities. The common types of vulnerabilities, such as Unrestricted Upload of File with Dangerous Type and Cross-site Scripting, align with potential risks introduced by handling file uploads and user input, which this plugin likely does. The fact that the last vulnerability was recently discovered (2025-11-17) suggests ongoing security issues.

While the absence of critical taint flows and the use of prepared statements are positive indicators, the unprotected AJAX endpoints combined with the plugin's past security incidents create a notable risk. The plugin's strengths lie in its internal code handling of SQL and output, but the external attack vectors and historical issues warrant caution.