Issues Tracker Security & Risk Analysis

The "issues-tracker" plugin v1.16 exhibits significant security concerns primarily due to a large, unprotected attack surface and inadequate output escaping. With 20 AJAX handlers, all lacking authentication checks, any unauthenticated user could potentially interact with these endpoints. This is further exacerbated by the taint analysis, which reveals 7 flows with unsanitized paths, including 4 of high severity, indicating potential for code injection or manipulation. The limited proper output escaping (18%) suggests a high risk of Cross-Site Scripting (XSS) vulnerabilities across many output points.

While the plugin has no recorded CVEs or bundled outdated libraries aside from Freemius v1.0 which is generally well-maintained, this positive history should not overshadow the immediate risks identified in the static analysis. The absence of capability checks on AJAX handlers is a critical oversight. The plugin demonstrates some good practices by using prepared statements for most SQL queries and including a single nonce check, but these are insufficient to mitigate the overarching security gaps. The conclusion is that this plugin, in its current state, presents a substantial security risk that requires immediate attention, particularly regarding the unprotected AJAX endpoints and the identified taint flows.