Estatik Mortgage Calculator Security & Risk Analysis

The 'estatik-mortgage-calculator' plugin v2.0.12 exhibits a mixed security posture. While the static analysis reveals a good adherence to secure coding practices, such as the absence of dangerous functions, file operations, and external HTTP requests, and a high percentage of properly escaped output and prepared SQL statements, significant concerns arise from its vulnerability history. The plugin has a history of 5 known CVEs, with a concerning 4 of them remaining unpatched, including 3 high-severity vulnerabilities. The common vulnerability types, 'PHP Remote File Inclusion' and 'Cross-site Scripting', are particularly serious and can lead to significant compromise. The lack of capability checks on entry points and only one nonce check, despite having two shortcodes as entry points, is a potential weakness. The static analysis, while clean in terms of taint flows and direct vulnerabilities, does not mitigate the risks posed by past unpatched vulnerabilities, suggesting potential for undiscovered issues or a lack of effective patching by the developer.