Float menu – awesome floating side menu Security & Risk Analysis

The float-menu plugin v7.2.3 exhibits a mixed security posture. On the positive side, the plugin demonstrates good practices in several areas. The vast majority of output is properly escaped (98%), indicating a strong effort to prevent Cross-Site Scripting (XSS) vulnerabilities in rendered content. SQL queries largely utilize prepared statements (77%), which is crucial for preventing SQL injection. The presence of nonce checks and capability checks suggests some level of authorization and integrity protection is implemented.

However, several concerning aspects emerge from the analysis. The taint analysis reveals 8 flows with unsanitized paths, with 3 classified as high severity. This is a significant concern, as unsanitized paths can lead to various security issues, including directory traversal or arbitrary file read/write vulnerabilities, depending on how they are handled. The static analysis also highlights that 100% of the identified flows with unsanitized paths were not protected, directly correlating with the high severity taint findings. Furthermore, the plugin has a history of 4 known CVEs, all of which were medium severity and related to CSRF and XSS. While currently all are patched, this history suggests a pattern of vulnerabilities being introduced.

In conclusion, while float-menu v7.2.3 shows strengths in output escaping and prepared SQL statements, the presence of high-severity unsanitized path flows and a history of CSRF and XSS vulnerabilities necessitate caution. The unprotected nature of these flows is a critical weakness that needs immediate attention. The overall security is decent in general output handling but has specific, high-impact risks in its path handling.