FT Calendar Security & Risk Analysis

The "ft-calendar" plugin version 1.6.1.1 exhibits a mixed security posture, with some positive indicators but notable areas of concern stemming from its attack surface and output handling. While the plugin boasts a clean vulnerability history with no recorded CVEs, this does not negate the risks identified in the static analysis. The presence of four AJAX handlers without authentication checks presents a significant attack vector, potentially allowing unauthorized actions if these handlers are exploitable. Furthermore, the low percentage of properly escaped output (21%) suggests a high likelihood of cross-site scripting (XSS) vulnerabilities across various functionalities. The taint analysis, while showing no critical or high-severity unsanitized paths, still identified three flows with unsanitized paths, which warrants further investigation.

Despite the lack of direct vulnerabilities in past CVEs, the static analysis reveals several practices that deviate from secure coding standards. The absence of capability checks, in particular, is a critical oversight when combined with unprotected AJAX endpoints. The static analysis also highlights a moderate number of SQL queries where prepared statements are not utilized, posing a risk of SQL injection. The plugin's strengths lie in its lack of dangerous functions and external HTTP requests, and the presence of nonce checks on all AJAX handlers. However, the substantial number of unprotected AJAX entry points and the poor output escaping practices are significant weaknesses that could be exploited by attackers.