Posts Footer Manager Security & Risk Analysis

The "intelly-posts-footer-manager" v2.2.0 plugin presents a mixed security posture. While it demonstrates good practices by utilizing prepared statements for a high percentage of its SQL queries and performing a reasonable number of output escapes, several significant concerns emerge from the static analysis and vulnerability history. The presence of an unprotected AJAX handler significantly increases the attack surface, potentially allowing unauthenticated users to trigger malicious actions. The lack of comprehensive capability checks is also a notable weakness, leaving functionalities vulnerable to unauthorized access. Furthermore, the plugin's vulnerability history, with two known CVEs, one of which remains unpatched and is of medium severity, indicates a recurring pattern of security flaws. The common vulnerability type being Cross-site Scripting suggests that user-supplied input is not always adequately sanitized, creating opportunities for attackers to inject malicious scripts.