G Meta Keywords Security & Risk Analysis

The "g-meta-keywords" plugin v1.4 exhibits a mixed security posture. While static analysis reveals no exploitable entry points like AJAX handlers, REST API routes, shortcodes, or cron events without authentication or permission checks, and all SQL queries use prepared statements, significant concerns arise from the output escaping and vulnerability history. The low percentage of properly escaped output (25%) suggests a high risk of Cross-Site Scripting (XSS) vulnerabilities, allowing attackers to inject malicious scripts into the user interface.

Furthermore, the plugin has a known, currently unpatched medium severity CVE from October 15, 2024, identified as Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). This indicates a recurring problem with handling user input safely, despite the absence of critical or high severity taint flows identified in the static analysis. The presence of an unpatched vulnerability, coupled with the observed output escaping issues, points to a critical need for immediate remediation and ongoing security vigilance for this plugin. While the lack of direct entry points is a positive, the latent risk of XSS due to poor output sanitization and the existing unpatched vulnerability are substantial weaknesses.