GetReview Security & Risk Analysis

The "getreview" plugin version 2.0 exhibits a mixed security posture. On the positive side, it demonstrates good practices in handling SQL queries, utilizing prepared statements exclusively, and reports no known vulnerabilities (CVEs) or bundled libraries, which can often introduce risks. However, significant concerns arise from the static analysis. The plugin has one REST API route that lacks permission callbacks, creating an unprotected entry point into the application. Furthermore, the output escaping is insufficient, with only 40% of outputs properly escaped, increasing the risk of Cross-Site Scripting (XSS) vulnerabilities. The presence of a taint flow with unsanitized paths, although not flagged as critical or high severity, warrants attention as it could potentially lead to unintended behavior or security issues if exploited.