Intellacall – Instant One Click Live Video Calls Security & Risk Analysis

The "intellacall-video-audio-calls-and-text-chat" plugin v1.1 exhibits a mixed security posture. On the positive side, it demonstrates good practices by utilizing prepared statements for all SQL queries, having no recorded vulnerabilities or CVEs, and no identifiable taint flows suggesting a lack of critical exploitable paths in the analyzed code. The absence of dangerous functions, file operations, and external HTTP requests without clear context for their purpose is also a good sign. However, several areas raise concerns. The plugin has an unprotected entry point in the form of a shortcode, and it lacks nonce checks entirely. Furthermore, only a third of its output is properly escaped, indicating a potential for Cross-Site Scripting (XSS) vulnerabilities. The presence of external HTTP requests without clear sanitization or authorization checks also warrants further investigation.