Info Cards – Add Text and Media in Card Layouts Security & Risk Analysis

The "info-cards" plugin v2.0.8 exhibits a generally good security posture, with a robust implementation of security best practices. The static analysis reveals a small attack surface with all identified entry points (AJAX handlers, REST API routes, shortcodes) appearing to have proper authentication and permission checks. The code also demonstrates strong adherence to secure coding principles, with 100% of SQL queries using prepared statements, and an exceptionally high percentage (98%) of output properly escaped, significantly mitigating cross-site scripting risks. Nonce and capability checks are also present, further enhancing security. However, a notable concern is the presence of known vulnerabilities in its history, specifically two medium-severity CVEs related to Missing Authorization and Cross-Site Scripting. While currently unpatched CVEs are zero, the historical pattern indicates past weaknesses in these critical areas. The plugin also bundles the Freemius library, which, depending on its version and known vulnerabilities, could introduce additional risk if not actively managed. The single external HTTP request warrants attention to ensure it is secure and does not introduce vulnerabilities.