Falang multilanguage for WordPress Security & Risk Analysis

The Falang plugin version 1.4.0 presents a moderate security risk due to a significant number of unprotected entry points and a history of critical vulnerabilities. While it employs prepared statements for a majority of its SQL queries and has a good number of nonce and capability checks, the presence of 24 unprotected AJAX handlers is a major concern. This wide attack surface increases the likelihood of unauthorized access and potential exploitation. The static analysis also highlights critical taint flows with unsanitized paths, indicating potential for code injection or other severe attacks. Furthermore, the plugin's vulnerability history, with 8 known CVEs including high and medium severity issues like deserialization, missing authorization, and XSS, demonstrates a recurring pattern of exploitable weaknesses. The fact that the last vulnerability was relatively recent (September 2025) suggests that security flaws continue to be discovered and addressed, but the underlying issues may not be fully mitigated. While the plugin has strengths in its SQL query preparation and some security checks, the combination of a large unprotected attack surface and a concerning vulnerability history warrants caution.