Jobbnorge Block Security & Risk Analysis

The 'jobbnorge-block' plugin v2.2.7 exhibits a mixed security posture. On the positive side, it demonstrates good practices regarding SQL queries, utilizing prepared statements exclusively, and has no recorded vulnerabilities or CVEs. This suggests a generally well-maintained codebase in terms of past security issues. However, significant concerns arise from the static analysis. The plugin exposes two AJAX handlers, and alarmingly, both lack authentication checks, creating a direct attack vector for unauthorized actions. Furthermore, only 50% of output is properly escaped, indicating a potential for cross-site scripting (XSS) vulnerabilities if user-supplied data is not handled carefully. The absence of capability checks on entry points is also a notable weakness, allowing any authenticated user to potentially trigger sensitive actions. While the lack of known vulnerabilities is a strength, the presence of unprotected AJAX endpoints and insufficient output escaping presents immediate risks that require attention.