ImageLinks – Interactive Image Builder Security & Risk Analysis

The imagelinks-interactive-image-builder-lite plugin, version 1.6.1, exhibits a mixed security posture. While it demonstrates good practices such as using prepared statements for all SQL queries, a high percentage of properly escaped output, and a significant number of nonce and capability checks, several concerning signals are present. The presence of 10 instances of the `unserialize` function is a notable risk, as it can lead to Remote Code Execution if used with unsanitized input. Additionally, the taint analysis revealed one flow with an unsanitized path, indicating a potential weakness in input validation, although it was not classified as critical or high severity. The plugin's vulnerability history is a significant concern, with three known CVEs, including one high and two medium severity vulnerabilities. The common types of these past vulnerabilities, SQL Injection and Cross-site Scripting, suggest recurring issues with how user input is handled. The fact that the last vulnerability was recorded recently (October 2023) and is currently unpatched is particularly alarming. Although no unpatched vulnerabilities are currently listed, the historical pattern of exploitable flaws, coupled with the dangerous function `unserialize` and the taint flow, warrants caution. Overall, while some security fundamentals are in place, the plugin carries inherent risks due to its past vulnerability record and specific code signals like the extensive use of `unserialize` and the presence of unsanitized input flows.