Hive Support | AI-Powered Help Desk, Live Chat and Chatbot Security & Risk Analysis

The "hive-support" plugin v1.2.11 presents a significant security risk due to a large number of unprotected AJAX handlers and a history of numerous vulnerabilities, including a currently unpatched high-severity issue. While the plugin demonstrates good practices in using prepared statements for SQL queries and proper output escaping, the extensive attack surface without authorization checks is a major concern. The taint analysis shows flows with unsanitized paths, though no critical or high severity issues were found in this analysis, this pattern, coupled with past vulnerabilities like SQL injection and cross-site scripting, suggests a high likelihood of exploitable weaknesses. The presence of 11 known CVEs, with one still unpatched, and common vulnerability types like missing authorization and exposure of sensitive information, strongly indicates recurring security flaws in the plugin's development. Overall, while some code quality aspects are positive, the plugin's vulnerability history and the substantial number of unprotected entry points make it a high-risk component for any WordPress installation.