flowplayer-wrapper Security & Risk Analysis

The "flowplayer-wrapper" plugin version 1.1.5 exhibits a mixed security posture. On the positive side, it demonstrates good practices by not having any known CVEs and avoiding dangerous functions, file operations, external HTTP requests, and raw SQL queries. The plugin also has a minimal attack surface with only one entry point (a shortcode) and no identified AJAX handlers or REST API routes that are unprotected.

However, several areas raise concerns. The most significant is the output escaping, where only 9% of the 22 outputs are properly escaped, indicating a high potential for Cross-Site Scripting (XSS) vulnerabilities. Additionally, while the taint analysis found no critical or high severity issues, there are two flows with unsanitized paths. Furthermore, the complete lack of nonce checks and capability checks on its single entry point means that any user, regardless of their role, can trigger the shortcode's functionality. This, coupled with the unescaped output, presents a tangible risk.

Given the absence of past vulnerabilities, it's difficult to definitively label the plugin as consistently insecure. However, the current code analysis reveals significant weaknesses in output sanitization and authorization for its shortcode. While the plugin hasn't historically suffered from known vulnerabilities, the identified issues in the current version necessitate attention to prevent potential exploitation.