افزونه پیامک حرفه ای فراز اس ام اس Security & Risk Analysis

The "farazsms" v2.7.3 plugin presents a concerning security posture due to a significant number of unprotected entry points. With 8 out of 10 identified entry points lacking proper authentication checks, an attacker could potentially leverage these to execute unauthorized actions. Furthermore, the taint analysis revealing two flows with unsanitized paths indicates a risk of vulnerabilities, particularly given the plugin's history of Cross-Site Scripting (XSS) vulnerabilities. While the plugin shows some strengths like a high percentage of properly escaped output and a reasonable rate of prepared SQL statements, these are overshadowed by the critical issues of unprotected AJAX handlers and unsanitized data flows.

The vulnerability history, specifically the single medium severity CVE and the reported XSS type, reinforces the concern about input sanitization. The future date of the last vulnerability (2026-01-27) is likely a data entry error, but the pattern of past issues still warrants caution. The presence of bundled libraries like Select2, while not inherently a risk, could become one if not properly maintained and updated, though no specific vulnerability related to it is highlighted here. In conclusion, the plugin has areas of good practice, but the high number of unprotected entry points and identified unsanitized data flows, coupled with past XSS issues, make it a moderate to high risk without further security hardening.