eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams Security & Risk Analysis

The eRoom Zoom Meetings Webinar plugin v1.6.5 presents a mixed security posture. While it demonstrates good practices in output escaping (97%) and uses prepared statements for a majority of its SQL queries (60%), several concerning areas exist. The static analysis reveals a significant attack surface with 15 AJAX handlers, 5 of which lack proper authentication checks. This directly exposes functionality to unauthorized users. Furthermore, the presence of the `unserialize` function is a known risk vector, especially if user-controlled data is passed to it without careful sanitization, though the taint analysis currently shows no critical or high severity flows. The vulnerability history is a significant concern, with 7 known CVEs, including one high severity and six medium severity vulnerabilities. While there are currently no unpatched CVEs, the recurring pattern of 'Exposure of Sensitive Information to an Unauthorized Actor', 'Missing Authorization', and 'Cross-Site Request Forgery' suggests systemic weaknesses in authorization and input validation, even if recent versions have addressed these. The last vulnerability being as recent as November 2025 (assuming a typo and it refers to the past) further underscores the need for vigilance. The plugin has strengths in its output sanitization, but the unprotected AJAX endpoints and the historical vulnerability patterns warrant a cautious approach.