WPZOOM Social Feed Widget & Block Security & Risk Analysis

The "instagram-widget-by-wpzoom" v2.3.4 plugin exhibits a mixed security posture. While it demonstrates good practices in areas like SQL query sanitization and output escaping, there are notable concerns. The presence of two AJAX handlers lacking authentication checks presents a significant attack surface that could be exploited. The taint analysis revealing one high-severity flow with unsanitized paths, although not explicitly detailed as a vulnerability, warrants caution. The vulnerability history, while currently clear of unpatched CVEs, includes a past medium-severity vulnerability primarily related to missing authorization, which aligns with the static analysis findings of unprotected AJAX endpoints. This suggests a recurring pattern of authorization weaknesses that need ongoing vigilance.