HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce Security & Risk Analysis

The Hurrytimer plugin version 2.14.3 exhibits a mixed security posture. On the positive side, it has a robust entry point management with all 13 identified entry points (AJAX handlers and shortcodes) appearing to have authentication checks, and there are no REST API routes without permission callbacks. The plugin also demonstrates good practices in SQL query handling, with a high percentage using prepared statements, and a significant number of nonce and capability checks, indicating awareness of common WordPress security mechanisms. Furthermore, there are no external HTTP requests, mitigating risks associated with external service dependencies.

However, several concerning signals emerge from the static analysis and historical data. The presence of the `unserialize` function is a significant risk factor, as it can lead to Remote Code Execution if not handled with extreme care and validated input. While taint analysis shows no critical or high severity flows, the single flow with unsanitized paths warrants attention, suggesting potential for XSS or other injection vulnerabilities if input isn't rigorously validated before use. The output escaping rate of 59% is also a concern, with over 40% of outputs potentially vulnerable to Cross-Site Scripting.

The plugin's vulnerability history, with 5 medium severity CVEs, although currently all patched, indicates a pattern of past security weaknesses, primarily related to Missing Authorization and Cross-site Scripting. The fact that the last vulnerability was recorded in early 2026, suggesting it might be a future date, is unusual and requires verification of the data source, but if accurate, it points to recent issues. The reliance on the Select2 library, if outdated, could also introduce vulnerabilities.

In conclusion, while Hurrytimer v2.14.3 has improved in some areas like entry point protection and SQL preparedness, the presence of `unserialize`, insufficient output escaping, and a history of vulnerabilities necessitate caution. Prioritizing the secure handling of unserialized data, improving output escaping, and ensuring all bundled libraries are up-to-date are crucial for strengthening its security posture.