Helpie FAQ — Accordion, Docs & Knowledge Base Security & Risk Analysis

The 'helpie-faq' plugin version 1.48 exhibits a mixed security posture. On the positive side, the plugin demonstrates good practices with 100% of its SQL queries using prepared statements and a very high percentage (98%) of output being properly escaped. It also incorporates nonce checks in 10 instances and capability checks in 6, indicating an awareness of basic WordPress security mechanisms. However, a significant concern arises from the static analysis revealing one unprotected AJAX handler, representing a direct entry point into the application that could be exploited by an unauthenticated attacker. The plugin's vulnerability history is also a notable weakness, with a total of four known CVEs, including one high-severity and three medium-severity vulnerabilities. While there are currently no unpatched vulnerabilities, this history suggests a recurring pattern of security flaws, particularly in areas like missing authorization and cross-site scripting, which could resurface if not adequately addressed in future development. The presence of the Freemius bundled library also warrants attention, as outdated bundled libraries can introduce vulnerabilities.