Events Maker by dFactory Security & Risk Analysis

The Events Maker plugin v1.6.14 exhibits a mixed security posture. On the positive side, the plugin demonstrates good practices by implementing nonces and capability checks for its entry points, and all identified AJAX handlers and REST API routes appear to have authentication checks. There are no direct file operations or external HTTP requests, and no critical or high severity taint flows were identified. However, concerns arise from the moderate rate of improperly escaped output, with 40% of outputs lacking proper sanitization. This could potentially lead to Cross-Site Scripting vulnerabilities if user-supplied data is not handled carefully. The plugin also has a history of known vulnerabilities, with one medium severity Cross-Site Scripting (XSS) CVE from 2025 that remains unpatched, indicating a potential ongoing risk.

While the static analysis reveals some good security implementations, the presence of an unpatched medium severity XSS vulnerability and a significant proportion of unescaped output are notable weaknesses. The plugin's attack surface appears to be relatively well-protected at the entry point level, but the potential for XSS due to insufficient output escaping remains a concern. Users should be aware of the past vulnerability history and the current unpatched CVE, as this suggests a pattern that requires attention. The plugin's overall security is decent due to its auth checks, but the XSS risk and unpatched CVE detract from its robustness.