Free Contact Us Form plugin ( build in accordance to the GDPR ) Security & Risk Analysis

The "free-contact-us" plugin v1.2 exhibits a mixed security posture. On the positive side, it demonstrates good practices regarding SQL queries, exclusively using prepared statements, and has a clean vulnerability history with no recorded CVEs. This suggests a potentially stable and well-maintained codebase in terms of known exploits.

However, the static analysis reveals significant areas of concern. The presence of an unprotected AJAX handler is a critical weakness, creating a direct entry point for attackers that bypasses authentication. Furthermore, a high percentage (62%) of output escaping is not properly handled, leading to potential cross-site scripting (XSS) vulnerabilities. The taint analysis indicates that a substantial portion of data flows contain unsanitized paths, although no critical or high severity issues were explicitly flagged in this analysis. The limited capability checks and reliance on nonces for some security, but not all, also present potential gaps.

In conclusion, while the plugin benefits from a lack of known vulnerabilities and secure SQL practices, the identified unprotected AJAX endpoint and the prevalence of unescaped output represent immediate and serious security risks. The taint analysis, even without critical flags, points to potential underlying issues in how data is handled. Addressing the unprotected AJAX handler and improving output sanitization should be the top priorities for mitigating risk.