i-Search – Advanced Live Search Security & Risk Analysis

The i-search plugin v1.2.0 exhibits a mixed security posture. While it shows strengths in avoiding dangerous functions and file operations, and a good proportion of SQL queries utilize prepared statements, significant concerns exist regarding its entry points and output sanitization. The plugin has a notable number of AJAX handlers (19) with a substantial portion (8) lacking proper authentication checks. This directly creates a wider attack surface vulnerable to unauthorized access and manipulation. Furthermore, the taint analysis reveals critical flows with unsanitized paths, indicating potential for injection vulnerabilities. The output escaping is also a weakness, with only 39% of outputs being properly escaped, increasing the risk of cross-site scripting (XSS) attacks. The absence of any recorded CVEs is positive, suggesting a history of responsible development or a lack of targeted exploitation so far, but this should not be relied upon given the identified code-level weaknesses. The plugin would benefit from robust input validation and output escaping across all entry points, particularly the unprotected AJAX handlers, to mitigate identified risks.