Image Source Control Lite – Show Image Credits and Captions Security & Risk Analysis

The 'image-source-control-isc' plugin v3.8.0 exhibits a mixed security posture. While it demonstrates good practices with a high percentage of SQL queries using prepared statements and a significant number of nonce and capability checks, several concerns warrant attention. The presence of a dangerous function like 'unserialize' without further context on its usage is a potential risk, as is the single identified file operation which could be a vector if not handled securely. The taint analysis shows no critical or high severity flows, which is positive, but the presence of two flows with unsanitized paths, even if classified lower, suggests potential for manipulation if inputs are not rigorously validated.

The plugin's vulnerability history is concerning, with four known medium severity CVEs, including authorization bypass and XSS. Although currently unpatched, the absence of active critical or high vulnerabilities is a slight positive, but the pattern of past issues, particularly authorization bypass, indicates a recurring area of weakness. The fact that all past vulnerabilities were medium severity, and none are currently unpatched, suggests that the developers are responsive to fixing issues, but the frequency and types of past vulnerabilities still represent a risk. Overall, while the plugin has strengths in its current security implementation, the past vulnerability record and the identified code signals necessitate careful consideration and monitoring.