FormRank Lead Scoring Security & Risk Analysis

The "formrank-lead-scoring" v1.1.5 plugin exhibits a mixed security posture. While it demonstrates good practices with a high percentage of properly escaped outputs and a significant number of SQL queries using prepared statements, there are notable areas of concern. The presence of 10 unprotected AJAX handlers significantly increases the attack surface, as these can potentially be triggered by unauthenticated users. Furthermore, the taint analysis revealed 4 high-severity flows with unsanitized paths, indicating potential vulnerabilities that could be exploited by attackers to manipulate data or execute unintended actions. The plugin's vulnerability history is clean, with no recorded CVEs, which is a positive indicator. However, this positive history, coupled with the high-severity taint flows and numerous unprotected AJAX endpoints, suggests a potential for undiscovered vulnerabilities. The overall assessment is that while the plugin has some strong security foundations, the unprotected entry points and high-severity taint flows present tangible risks that require attention.