Icegram Collect – Easy Form, Lead Collection and Subscription plugin Security & Risk Analysis

The "icegram-rainmaker" plugin, version 1.3.20, exhibits a mixed security posture. While it demonstrates good practices such as using prepared statements for all SQL queries and implementing nonce checks for all AJAX handlers, significant concerns remain. The presence of 3 AJAX handlers without authentication checks represents a considerable attack surface, potentially allowing unauthorized actions. Furthermore, a substantial 39% of output escaping indicates a risk of Cross-Site Scripting (XSS) vulnerabilities, as user-supplied data might not be properly sanitized before being displayed to users. The vulnerability history reveals a pattern of medium severity issues, specifically Missing Authorization and Cross-Site Scripting, suggesting a recurring need for more robust input validation and authorization enforcement. While there are no currently unpatched CVEs, the past prevalence of these vulnerability types warrants careful attention.