Instant Images – One-click Image Uploads from Unsplash, Openverse, Pixabay, Pexels, and Giphy Security & Risk Analysis

The plugin 'instant-images' v7.1.0.1 exhibits a mixed security posture. On the positive side, the static analysis reveals no apparent direct attack vectors through common entry points like AJAX handlers, REST API routes, or shortcodes without authentication. The code also demonstrates good practices by using prepared statements for all SQL queries and a relatively high percentage of output escaping. However, several concerning signals exist. The absence of nonce checks across the board is a significant oversight, especially when combined with two capability checks that might be insufficient on their own if not properly implemented. The plugin also makes three external HTTP requests, which, without further analysis, could potentially be exploited for SSRF or other network-related attacks. The vulnerability history is a major red flag. With three known CVEs, including one high and two medium severity vulnerabilities, and a recent one in January 2024, it suggests a pattern of security weaknesses. These past vulnerabilities, including Missing Authorization, SSRF, and XSS, indicate recurring issues that may not be fully addressed or might point to fundamental flaws in the development process.