ExpressTechSoftwares Addon for MemberPress and Discord Security & Risk Analysis

The expresstechsoftwares-memberpress-discord-add-on plugin exhibits a mixed security posture. While it shows strengths in areas like the high percentage of prepared SQL statements and proper output escaping, significant concerns arise from its attack surface and historical vulnerability patterns. The presence of five unprotected AJAX handlers represents a substantial entry point for potential attacks, especially given the total of six entry points with five being unprotected. This lack of authentication on a majority of its entry points is a critical weakness.

The code analysis also flags two instances of the dangerous `unserialize` function, which can lead to Remote Code Execution if not handled with extreme care, although no critical taint flows were identified. The taint analysis did reveal one high-severity flow, indicating a potential vulnerability that could be exploited for data leakage or other malicious actions. The vulnerability history is particularly concerning, with two known CVEs, one of which remains unpatched. The consistent pattern of 'Cross-site Scripting' vulnerabilities in the past suggests a recurring weakness in input sanitization or output escaping in user-provided data, despite overall good output escaping percentages in the current static analysis.