Forms by Systemo Security & Risk Analysis

The "forms-by-systemo" plugin version v20150825 exhibits a mixed security posture. On the positive side, it demonstrates good practices by not performing raw SQL queries, utilizing prepared statements exclusively, and having no recorded vulnerability history, including CVEs. The plugin also avoids external HTTP requests and file operations, which are common vectors for exploitation. However, several concerns arise from the static analysis. A significant weakness is the low percentage of properly escaped output (5%), indicating a high risk of Cross-Site Scripting (XSS) vulnerabilities. Furthermore, the absence of nonce checks and capability checks on all entry points, despite the limited attack surface, leaves potential room for unauthorized actions if any of the entry points were to become exploitable through other means. The lack of taint analysis results is also a neutral observation, meaning we cannot confirm the absence of critical taint flows.