Easy Accordion FAQ and Knowledge Base Software for WordPress Security & Risk Analysis

The "knowledge-center" plugin v3.0.1 presents a mixed security posture. While it demonstrates good practices such as using prepared statements for all SQL queries, a high percentage of properly escaped output, and robust nonce and capability checks, significant concerns remain. The presence of two AJAX handlers without authentication checks represents a direct and exploitable attack surface. Furthermore, taint analysis revealed two flows with unsanitized paths, which, although not classified as critical or high severity, indicate potential weaknesses in input validation that could lead to vulnerabilities if exploited in conjunction with other factors. The plugin's vulnerability history shows a single medium-severity Cross-Site Scripting (XSS) vulnerability in the past, which has since been patched, suggesting a capacity to address security issues. However, the ongoing unprotected AJAX endpoints are a more immediate and critical concern than past resolved vulnerabilities.