Foliopress WYSIWYG Security & Risk Analysis

The foliopress-wysiwyg plugin v2.6.18 presents a mixed security posture. While it demonstrates some good practices like using prepared statements for all SQL queries and a moderate number of nonce and capability checks, significant concerns arise from its attack surface and vulnerability history. One AJAX handler is not protected by authentication checks, creating an immediate potential entry point for unauthorized actions. Furthermore, the taint analysis indicates a concerning number of flows with unsanitized paths, suggesting potential vulnerabilities even if no critical or high severity issues were immediately flagged in this scan. The plugin's history of three known medium-severity vulnerabilities, including Cross-Site Request Forgery and Cross-site Scripting, and notably, one unpatched vulnerability, strongly indicates a recurring pattern of insecure coding practices that have historically exposed users to risk. The prevalence of Cross-site Scripting vulnerabilities in the past is particularly worrying given the static analysis showing only 39% of outputs are properly escaped.