Jock On Air Now (JOAN) Security & Risk Analysis

The "joan" plugin v6.1.2 presents a mixed security posture. While it demonstrates some good practices, such as a relatively low number of external HTTP requests and file operations, significant concerns arise from its attack surface and historical vulnerability patterns.

The static analysis reveals a substantial attack surface with 21 entry points, of which 8 lack authentication checks. This is a critical weakness, as it leaves these entry points open to unauthorized access and potential exploitation. Furthermore, 59% of SQL queries use prepared statements, which is a positive, but the remaining 41% do not, potentially exposing the database to SQL injection vulnerabilities. Similarly, only 63% of output is properly escaped, indicating a risk of Cross-Site Scripting (XSS) vulnerabilities.

The vulnerability history is particularly concerning, with a total of 4 known CVEs, including one high-severity vulnerability. The common vulnerability types (Missing Authorization, CSRF, XSS) align with the weaknesses identified in the static analysis, suggesting recurring issues. The fact that the last vulnerability was in October 2025 and there are no currently unpatched vulnerabilities is a positive sign, but the past record indicates a need for continuous vigilance and robust security practices. Overall, while the plugin has some strengths, the significant number of unprotected entry points and the historical vulnerability profile warrant caution.