InPost Gallery Security & Risk Analysis

The "inpost-gallery" v2.1.5 plugin exhibits a concerning security posture despite some positive indicators. While it demonstrates good practices in SQL query preparation and output escaping, the significant number of unprotected AJAX handlers presents a substantial attack surface. The presence of 4 out of 5 AJAX handlers lacking authentication checks means that unauthenticated users could potentially trigger sensitive actions or access data within the plugin. Furthermore, the plugin's history of 7 known CVEs, including critical and high-severity vulnerabilities like Code Injection, PHP Remote File Inclusion, and Cross-Site Scripting, is a major red flag. The fact that the last vulnerability was reported in 2025 suggests a recurring pattern of insecure coding practices that have led to serious security flaws in the past, even if none are currently unpatched. This history strongly indicates a need for thorough auditing and remediation of past issues before relying on this plugin.