FAQ Builder AYS Security & Risk Analysis

The faq-builder-ays plugin exhibits a mixed security posture. While it demonstrates good practices in SQL query preparation and includes a reasonable number of nonce and capability checks, significant concerns arise from its attack surface and output sanitization.

The plugin exposes a large attack surface with 12 entry points, a concerning 10 of which lack authentication checks. This is further exacerbated by taint analysis revealing flows with unsanitized paths, including one of high severity. Furthermore, the code analysis indicates that only 47% of output is properly escaped, suggesting a susceptibility to Cross-Site Scripting vulnerabilities.

The plugin's vulnerability history, with 3 known CVEs including one high-severity issue, reinforces these concerns. The common vulnerability types (XSS and SQL Injection) align with the findings from the static analysis, particularly the unsanitized paths and insufficient output escaping. While there are currently no unpatched CVEs, the historical pattern of vulnerabilities and the identified weaknesses in the current version warrant careful consideration.