Knights of Columbus – State Security & Risk Analysis

The kofc-state plugin version 2.5.2 presents a generally good security posture based on the provided static analysis. A significant strength is the extensive use of prepared statements for SQL queries, with 92% of them utilizing this security best practice. Furthermore, the plugin incorporates a substantial number of nonce and capability checks, demonstrating an effort to validate user actions and permissions. The absence of known CVEs and recorded vulnerabilities further contributes to its positive security standing. However, a notable area of concern is the very low percentage of properly escaped output (1%). With 192 total outputs, only 1% being properly escaped indicates a high risk of cross-site scripting (XSS) vulnerabilities, which could be exploited by an attacker to inject malicious scripts into the website. While the attack surface, consisting of 8 shortcodes, is not inherently large and has no unprotected entry points, the lack of output escaping overshadows these positive aspects.