Calendar.online / Kalender.digital – Plugin Security & Risk Analysis

The kalender-digital v1.0.14 plugin exhibits a mixed security posture. While it demonstrates good practices by utilizing prepared statements for all SQL queries and having no external HTTP requests, it raises significant concerns regarding output escaping and a lack of robust security checks. The static analysis reveals that only 21% of output is properly escaped, indicating a high risk of Cross-Site Scripting (XSS) vulnerabilities. Furthermore, the absence of nonce checks, capability checks, and any authentication checks on its entry points (AJAX handlers, REST API routes, shortcodes) is a critical oversight that leaves the plugin highly susceptible to various attacks. The vulnerability history, while showing no currently unpatched CVEs, reveals two medium-severity XSS vulnerabilities in the past, which aligns with the findings of insufficient output escaping. This pattern suggests a recurring weakness that, if not addressed, could lead to future exploitable flaws. In conclusion, despite a clean slate regarding SQL injection and external requests, the severe deficiency in output escaping and the lack of essential security controls on its entry points present a substantial risk. The plugin requires immediate attention to address these critical security gaps.