fitness calculators Security & Risk Analysis

The "fitness-calculators" plugin v2.1.10 presents a mixed security posture. On the positive side, the plugin demonstrates good practices by not utilizing dangerous functions, performing all SQL queries using prepared statements, and implementing nonce checks on all its entry points. It also has no file operations or external HTTP requests, which are generally good security indicators.

However, a significant concern arises from the low percentage of properly escaped output (28%), indicating a potential for Cross-Site Scripting (XSS) vulnerabilities. While taint analysis shows no identified flows with unsanitized paths in this specific static analysis, the history of two medium-severity XSS vulnerabilities, with the last one being relatively recent (August 2023), strongly suggests that the identified output escaping issues could indeed be exploited. The absence of capability checks on its five shortcodes, while protected by nonces, could also be a concern depending on the functionality of these shortcodes.

Overall, the plugin has strengths in its handling of SQL and basic security checks. Nonetheless, the prevalent lack of output escaping combined with its vulnerability history points to a substantial risk of XSS. It is crucial to address the output escaping issues to mitigate this risk, especially given the plugin's past vulnerability patterns.