Facebook Chat Plugin – Live Chat Plugin for WordPress Security & Risk Analysis

The facebook-messenger-customer-chat plugin, version 2.5, exhibits a generally strong security posture based on the static analysis. The plugin demonstrates good development practices with a small attack surface and all identified entry points appear to have authentication checks. The code shows no critical or high severity taint flows, indicating that unsanitized user input is not being processed in a way that would lead to immediate exploitation. Furthermore, the plugin utilizes prepared statements for all SQL queries and has a high percentage of properly escaped output, minimizing risks associated with SQL injection and cross-site scripting.

However, the plugin's vulnerability history raises some concerns. With two known CVEs, including one high and one medium severity vulnerability, it suggests a past susceptibility to specific attack types like improper access control and CSRF. While there are currently no unpatched CVEs, the historical pattern indicates that the plugin has been a target. The last vulnerability was in 2020, which might suggest a lack of recent security audits or active maintenance in that regard. The plugin's reliance on external HTTP requests, while not inherently insecure, warrants careful monitoring for any potential vulnerabilities that could arise from these integrations.