GedShow Security & Risk Analysis

The 'gedshow' v2.1.0 plugin exhibits a concerning security posture primarily due to a significant number of unprotected AJAX handlers and a high number of unsanitized taint flows. While the plugin shows some positive security practices, such as a decent percentage of SQL queries using prepared statements and a moderate level of output escaping, these strengths are overshadowed by critical weaknesses in its attack surface management and data sanitization. The complete lack of recorded CVEs or past vulnerabilities might suggest a history of good security, but this is severely undermined by the current static analysis findings. The high proportion of unsanitized paths identified in the taint analysis, specifically nine critical flows, indicates a direct pathway for malicious data to be processed without proper validation. This, combined with the 14 unprotected AJAX endpoints, creates a substantial risk for common web vulnerabilities like cross-site scripting (XSS) or arbitrary data manipulation. Despite a small number of file operations and no external HTTP requests, which are generally good signs, the plugin's overall security is significantly compromised by the identified unauthenticated entry points and the critical taint flows. Users should exercise extreme caution and consider this plugin a high risk until these issues are addressed.