AnWP Football Leagues Security & Risk Analysis

The plugin 'football-leagues-by-anwppro' version 0.17.2 exhibits a mixed security posture. On the positive side, the static analysis reveals a robust implementation of security best practices, with all identified entry points (AJAX handlers and REST API routes) appearing to have proper authentication and permission checks. Furthermore, a high percentage of SQL queries are prepared, and output escaping is generally well-handled. The presence of nonce and capability checks also indicates a conscious effort towards secure coding.

However, there are areas of concern. The taint analysis identified one high-severity flow with unsanitized input, which could potentially lead to vulnerabilities if exploited. While the plugin has a history of two medium-severity CVEs, specifically related to CSV formula injection and XSS, the fact that none are currently unpatched is a positive sign. The last reported vulnerability was in August 2025, which is in the future, suggesting a potential data anomaly or a misunderstanding in the provided data's timeline. The existence of two flows with unsanitized paths warrants further investigation.

In conclusion, while the plugin demonstrates good fundamental security controls like authentication and output escaping, the identified high-severity taint flow and the history of XSS and CSV injection vulnerabilities necessitate caution. The presence of unsanitized paths in the taint analysis is a direct indicator of potential weaknesses that should be addressed promptly.