History Log by click5 Security & Risk Analysis

The "history-log-by-click5" plugin v1.0.13 presents a significant security risk primarily due to its substantial unprotected attack surface. With 25 unprotected entry points, including 23 AJAX handlers and 2 REST API routes lacking permission callbacks, this plugin is highly vulnerable to unauthorized access and manipulation. While the code exhibits good practices in other areas like SQL prepared statements (97%) and output escaping (96%), these strengths are overshadowed by the critical flaw of exposing numerous functionalities without proper authentication or authorization checks. The taint analysis also indicates a concerning flow with an unsanitized path, which, combined with the unprotected entry points, heightens the risk of code injection vulnerabilities.

The plugin's vulnerability history, with 3 known CVEs and 2 currently unpatched (1 high, 2 medium), strongly suggests a recurring pattern of security weaknesses, particularly concerning Cross-Site Scripting (XSS) and SQL Injection. The recent vulnerability in May 2025 further emphasizes the ongoing need for diligent security patching. In conclusion, while the plugin demonstrates some positive coding practices, the extensive unprotected attack surface and a history of exploitable vulnerabilities create a precarious security posture. Immediate attention is required to address the authentication and authorization gaps to mitigate the risk of compromise.