I Recommend This – Love/Like Button for WordPress Posts Security & Risk Analysis

The i-recommend-this plugin v4.0.1 demonstrates some good security practices, notably the complete absence of raw SQL queries and a high percentage of properly escaped output. The plugin also employs nonce and capability checks on some entry points. However, the analysis reveals significant concerns. The presence of unsanitized paths in taint analysis is particularly worrying, with three identified flows flagged as high severity. This indicates potential pathways for attackers to inject malicious code or data. Furthermore, the plugin has a history of 5 known CVEs, including one critical, two high, and two medium severity vulnerabilities. While none are currently unpatched, this pattern of past vulnerabilities, especially critical and high severity ones related to XSS, CSRF, and SQL Injection, suggests a recurring tendency for security flaws to be introduced. The lack of explicit permission callbacks on all REST API routes (though none exist currently) and the fact that not all AJAX handlers have authentication checks also represent potential future attack vectors if new endpoints are added without proper security considerations.