Home Affordability Calculator Security & Risk Analysis

The "home-affordability-calculator" plugin version 1.3 exhibits a mixed security posture. On the positive side, it has no known vulnerabilities (CVEs) and a clean vulnerability history, suggesting a generally well-maintained codebase. The absence of external HTTP requests and the use of prepared statements for all SQL queries are excellent security practices. However, the static analysis reveals significant areas of concern that detract from its overall security. The most critical issue is the presence of two taint flows with unsanitized paths, indicating potential for attackers to inject malicious data that could be executed or lead to unintended behavior, even though no critical or high severity issues were flagged in the taint analysis itself. Furthermore, a very low percentage of output (13%) is properly escaped, exposing the plugin to cross-site scripting (XSS) vulnerabilities. The complete lack of nonce and capability checks on what appears to be a zero-width attack surface is also concerning, as it implies that even if entry points were added, they might not be secured. While the plugin has no direct known exploits, these identified code-level weaknesses present a tangible risk.