Hitsteps Web Analytics Security & Risk Analysis

The hitsteps-visitor-manager plugin version 5.91 presents a mixed security posture. While it demonstrates good practices by utilizing prepared statements for all SQL queries and incorporating a reasonable number of capability checks (11) and nonce checks (3), there are significant areas of concern. The presence of two 'dangerous functions' (create_function) is a red flag, as this function is deprecated and known to be a source of vulnerabilities if not handled with extreme care. Furthermore, the static analysis reveals that a substantial percentage of output is not properly escaped (82%), indicating a high risk of Cross-Site Scripting (XSS) vulnerabilities. Taint analysis shows four flows with unsanitized paths, which, although not classified as critical or high, still represent potential avenues for malicious input to be processed without adequate sanitization.

The vulnerability history of this plugin is also a notable concern. With two known CVEs, both of medium severity, and previously involving Cross-Site Request Forgery (CSRF) and Cross-site Scripting (XSS), it suggests a pattern of susceptibility to common web application attacks. The fact that these vulnerabilities have existed in the past, even if currently patched, indicates a historical tendency for insecure coding practices. While there are no currently unpatched CVEs, the combination of historical vulnerabilities and high rates of unescaped output and unsanitized taint flows warrants caution.

In conclusion, the plugin has some strengths in SQL handling and authorization checks. However, the identified dangerous functions, the significant proportion of unescaped output, and the history of XSS and CSRF vulnerabilities point to a plugin that requires careful monitoring and potential remediation. The risk is moderate, primarily due to the potential for XSS and the historical context of past security flaws.