Genolve – Genolve AI Business Graphics, AI Images Security & Risk Analysis

The "genolve-toolkit" v5.0.6 plugin exhibits a mixed security posture. On the positive side, it shows no recorded vulnerabilities or CVEs, and all its SQL queries utilize prepared statements, indicating good practices in database interaction. The absence of critical or high severity taint flows suggests that internally, the code generally handles data safely.

However, significant concerns arise from the attack surface analysis. A substantial portion of the plugin's entry points, specifically 7 out of 8, are unprotected by authentication checks. This lack of authorization on AJAX handlers presents a considerable risk, as unauthenticated users could potentially trigger these functionalities, leading to unintended actions or information disclosure if further vulnerabilities exist within those handlers. While the code signals indicate some output escaping is performed, the 54% proper escaping rate suggests that a significant number of outputs might be vulnerable to cross-site scripting (XSS) attacks, especially when combined with the unprotected AJAX endpoints.

In conclusion, the plugin benefits from a clean vulnerability history and secure SQL handling. Nevertheless, the high number of unprotected AJAX handlers and the moderate output escaping rate represent critical security weaknesses that require immediate attention. The absence of critical taint flows is positive, but it does not mitigate the risks posed by the exposed attack surface.