WEB-T – eTranslation Multilingual Security & Risk Analysis

The "etranslation-multilingual" v2.0.6 plugin exhibits a mixed security posture. On the positive side, it demonstrates strong practices in output escaping and the use of prepared statements for SQL queries, with a low history of reported vulnerabilities. However, a significant concern arises from its attack surface. A large number of AJAX handlers (15 out of 15) are exposed without authentication checks, presenting a substantial risk of unauthorized access or manipulation. Furthermore, the taint analysis reveals 8 flows with unsanitized paths, all classified as high severity. This indicates potential for remote code execution or data leakage, especially when combined with the unprotected AJAX endpoints. The absence of recorded CVEs is encouraging, but the findings from the static and taint analyses suggest that unaddressed vulnerabilities may exist within the current version, particularly concerning the handling of user-supplied data in unprotected entry points.