iMoney Security & Risk Analysis

The "imoney" plugin version 0.36, released in 2012, exhibits several concerning security weaknesses despite some positive attributes. While it features 100% prepared SQL statements and avoids common attack vectors like AJAX, REST API, and shortcodes without authorization, its static analysis reveals significant red flags. The presence of 12 dangerous "unserialize" functions is a major concern, as this function is notoriously susceptible to remote code execution if used with untrusted input. Furthermore, the plugin suffers from extremely poor output escaping, with only 14% of outputs properly escaped, indicating a high risk of Cross-Site Scripting (XSS) vulnerabilities. The taint analysis confirms this, highlighting a high severity flow with unsanitized paths.

The vulnerability history further reinforces these concerns. The plugin has a known CVE, which remains unpatched, specifically a medium severity Cross-Site Scripting vulnerability. The fact that the last vulnerability was recorded in 2026 suggests a lack of ongoing security maintenance and an outdated security posture. The absence of any nonce checks or capability checks on the identified entry points (though few exist) means that even minor vulnerabilities could be exploited more easily. While the plugin's minimal attack surface is a minor strength, the combination of dangerous function usage, poor output escaping, and unpatched historical vulnerabilities makes this plugin a significant security risk.