HTML5 Video Player – Embed and Play Videos in Custom Player Security & Risk Analysis

The "html5-video-player" plugin v2.9.1 presents a mixed security posture. On the positive side, the code demonstrates strong adherence to secure coding practices, with an overwhelming majority of SQL queries utilizing prepared statements and output being properly escaped. The plugin also implements a good number of nonce and capability checks, indicating an awareness of common WordPress security vulnerabilities. Furthermore, the absence of critical or high severity taint flows in the static analysis is a positive sign.

However, significant concerns arise from the plugin's historical vulnerability record and certain aspects of its attack surface. The presence of 8 known CVEs, including one critical and seven medium severity issues, is a major red flag. This history suggests a recurring pattern of security weaknesses that have previously led to serious vulnerabilities like missing authorization, information exposure, SQL injection, and cross-site scripting. The most recent vulnerability being in early 2025, despite the current version being 2.9.1, suggests these past issues might not be fully mitigated in this specific version or were discovered very recently. The static analysis also reveals 2 AJAX handlers that lack authentication checks, creating potential entry points for unauthorized actions, even if the taint analysis didn't find immediate critical flows originating from them.