Hopewiser Address Lookup Security & Risk Analysis

The hopewiser-address-lookup v2.0.4 plugin presents a mixed security posture. On the positive side, it demonstrates good practices by not having any known vulnerabilities (CVEs) and utilizes prepared statements for all its SQL queries. The absence of file operations and external HTTP requests also reduces potential attack vectors. However, several significant concerns arise from the static analysis. The low percentage of properly escaped output (39%) is a major red flag, indicating a high risk of Cross-Site Scripting (XSS) vulnerabilities, especially given the 38 total outputs analyzed.

The taint analysis reveals two flows with unsanitized paths, which, while not categorized as critical or high severity in this analysis, represent potential avenues for attackers to inject malicious code or manipulate application behavior. The lack of nonce checks and capability checks on its entry points (shortcodes) is another serious oversight. Even though there are no unprotected AJAX or REST API routes, shortcodes can still be triggered by users and, without proper authorization or nonce verification, could lead to unintended actions or information disclosure. The plugin's vulnerability history is clean, which is encouraging, but this does not negate the identified risks within the current codebase.