IURNY by INDIGITALL – Instant Chat, Web Push Notifications Security & Risk Analysis

The indigitall-web-push-notifications plugin exhibits a mixed security posture. While it demonstrates strong practices in SQL query handling with 100% prepared statements and a high percentage of properly escaped outputs, significant concerns arise from its attack surface. A substantial 23 AJAX handlers are exposed without any authentication checks, representing a critical vulnerability point. The absence of taint analysis results, while potentially indicating a clean codebase in that regard, offers no reassurance for potential input validation issues.

The plugin's vulnerability history, specifically a past medium-severity Cross-Site Scripting (XSS) vulnerability, suggests a history of input sanitization weaknesses. Although this vulnerability is currently patched, the pattern of XSS issues combined with the large number of unprotected AJAX endpoints indicates a potential for attackers to exploit unvalidated user input for malicious purposes. The plugin's strengths lie in its SQL handling and output escaping, but these are overshadowed by the critical risk of numerous unauthenticated entry points.

In conclusion, the plugin has areas of good security practice, particularly in database interactions and output rendering. However, the large number of unprotected AJAX handlers is a glaring security flaw that significantly increases the risk profile. The past XSS vulnerability further reinforces the need for rigorous input validation and robust authentication mechanisms on all entry points. This plugin requires immediate attention to secure its exposed AJAX handlers to mitigate potential exploitation.