WP All Export – User Export Add-On Security & Risk Analysis

The plugin "export-wp-users-xml-csv" v1.0.2 exhibits a generally good security posture based on the provided static analysis. The absence of known CVEs and a clean vulnerability history are positive indicators. Furthermore, the plugin demonstrates strong practices in output escaping, with all outputs being properly escaped, and it avoids external HTTP requests and file operations. The lack of shortcodes, cron events, and a protected REST API and AJAX handlers also contribute to a reduced attack surface. However, the presence of two "unserialize" calls is a significant concern. While no specific taint flows were identified, the unchecked use of unserialize can lead to Remote Code Execution vulnerabilities if malicious data is passed to it, especially in conjunction with other weaknesses. The plugin also lacks nonce and capability checks on its entry points, which, combined with the potential for unserialize vulnerabilities, could be exploited.