IDonate – Blood Donation, Request And Donor Management System Security & Risk Analysis

The "idonate" plugin v2.1.18 exhibits a concerning security posture, despite some positive indicators. While the plugin demonstrates good practices in SQL query sanitization (80% prepared statements) and output escaping (91% properly escaped), these strengths are overshadowed by significant weaknesses. The presence of 15 unprotected AJAX handlers represents a substantial attack surface, creating numerous potential entry points for unauthorized actions. Furthermore, the vulnerability history is alarming, with a total of 8 known CVEs, including one critical and two high-severity issues. The fact that one critical vulnerability remains unpatched is a severe immediate risk. The common vulnerability types found, such as Improper Authorization, Missing Authorization, and Cross-site Scripting, suggest a pattern of insecure handling of user input and access control. The plugin's last known vulnerability was as recent as February 2026, indicating ongoing security flaws or slow patching practices. While the absence of critical taint flows is a positive sign, the combination of a large unprotected attack surface and a history of critical and high-severity vulnerabilities, including an unpatched one, points to a high-risk plugin.