Formsite | Embed online forms to collect orders, registrations, leads, and surveys Security & Risk Analysis

The Forms site plugin v1.7 exhibits a generally good security posture based on the static analysis, with no identified dangerous functions, proper SQL prepared statements, and 100% output escaping. The attack surface is minimal, consisting of a single shortcode with no apparent authentication checks, which presents a low immediate risk. Taint analysis also shows no concerning unsanitized flows.

However, the plugin's history of one medium-severity Cross-Site Scripting (XSS) vulnerability, though currently patched, is a significant concern. The fact that an XSS vulnerability was present indicates a potential weakness in input sanitization or output encoding that could be reintroduced in future updates if not carefully managed. The last vulnerability was recorded as recent as April 2024, suggesting ongoing security attention might be needed.

While the current static analysis results are positive, the past vulnerability history necessitates a degree of caution. The plugin's strength lies in its limited attack surface and well-implemented prepared statements and output escaping. The weakness lies in the recurring possibility of XSS, highlighting the importance of thorough security testing for any input handled by the shortcode.