Jetly – Notify Security & Risk Analysis

The "jetly-notify" v2.0.0 plugin exhibits a mixed security posture. On one hand, the plugin demonstrates good practices in many areas, with a high percentage of SQL queries using prepared statements and nearly all output being properly escaped. It also has a clean vulnerability history with no recorded CVEs, suggesting a generally well-maintained codebase. However, significant concerns arise from the static analysis, particularly the presence of two AJAX handlers that lack authentication checks. Furthermore, two taint analysis flows identified with unsanitized paths, even without a critical severity rating, indicate potential weaknesses that could be exploited if combined with other vulnerabilities or specific attack vectors. The limited number of capability checks also contributes to the overall risk.