HT Menu – WordPress Mega Menu Builder for Elementor Security & Risk Analysis

The ht-menu-lite v1.2.5 plugin exhibits a mixed security posture. While it demonstrates strengths in areas like exclusively using prepared statements for SQL queries and implementing nonce and capability checks on its entry points, several concerns warrant attention. The presence of a dangerous `create_function` function is a significant code signal risk, as this function is deprecated and can be exploited in various ways if not handled with extreme care. Furthermore, the taint analysis revealing two flows with unsanitized paths, although not classified as critical or high severity, indicates a potential for unexpected data handling and possible injection vectors if these paths involve user-supplied input. The vulnerability history, specifically the medium-severity CVE, although currently patched, suggests that the plugin has had past security weaknesses. The lack of unpatched CVEs is positive, but the pattern of past vulnerabilities, including CSRF, suggests a need for continued vigilance in code review and security best practices. Overall, while the plugin has good foundations, the identified code signals and taint analysis results present areas of potential risk that could be exploited.