CM Tooltip Glossary Security & Risk Analysis

The "enhanced-tooltipglossary" plugin version 4.5.3 presents a mixed security posture. On the positive side, it demonstrates good practices by utilizing prepared statements for all SQL queries and implementing nonce checks and capability checks for most entry points. The absence of any currently unpatched CVEs is also a significant strength, indicating the developers are responsive to security issues. However, the static analysis reveals several areas of concern. A notable weakness is the presence of 3 unprotected AJAX handlers, representing a significant attack surface that could be exploited by unauthenticated users. While taint analysis shows no critical or high severity flows, one flow with an unsanitized path indicates a potential for unexpected behavior or vulnerabilities if not carefully handled. The high number of total outputs with only 31% properly escaped suggests a risk of Cross-Site Scripting (XSS) vulnerabilities, especially in conjunction with past vulnerabilities of this type. The plugin's history of 7 medium severity CVEs, primarily related to XSS and CSRF, further reinforces the concern about input sanitization and output escaping, suggesting these have been recurring issues. The plugin also makes external HTTP requests, which, without proper validation, could lead to SSRF or other vulnerabilities. The bundled Select2 library, while common, should also be kept updated to avoid known vulnerabilities within it. Overall, while the plugin has improved in certain areas like SQL practices and has no active critical issues, the presence of unprotected AJAX handlers, poor output escaping, and a history of XSS/CSRF vulnerabilities warrant caution.