FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration Security & Risk Analysis

The 'fluent-boards' v1.91.2 plugin exhibits a mixed security posture. While it demonstrates good practices in SQL query sanitization (98% prepared) and output escaping (96%), significant concerns arise from its attack surface and vulnerability history. The presence of an unprotected AJAX handler represents a direct entry point for potential malicious activity without proper authentication, a critical oversight. Furthermore, the plugin's history includes two known CVEs, one of which was critical and related to missing authorization, a pattern that aligns with the unprotected AJAX handler identified in the static analysis. The fact that both CVEs are now patched is positive, but the previous critical vulnerability and the ongoing lack of nonce checks on AJAX requests suggest a recurring pattern of overlooking authorization and input validation on sensitive entry points. The taint analysis, while showing no critical or high severity flows, did reveal unsanitized paths, which could be exacerbated by the unprotected AJAX endpoint.