Essential Content Types Security & Risk Analysis

The "essential-content-types" plugin v2.3 exhibits a mixed security posture. On the positive side, it has a clean vulnerability history with no recorded CVEs and demonstrates good practices in areas like output escaping (80% properly escaped) and nonce checks (11 instances). The absence of file operations and external HTTP requests further strengthens its security. However, the static analysis reveals a notable concern: one of its four AJAX handlers lacks authentication checks. While taint analysis did not uncover critical or high-severity issues, the presence of two flows with unsanitized paths, though not rated critical, warrants attention. The single SQL query found is not using prepared statements, which is a general risk. The overall attack surface is relatively small (13 entry points), with only one identified as unprotected.