Lana Downloads Manager Security & Risk Analysis

The "lana-downloads-manager" plugin, in version 1.12.0, exhibits a mixed security posture. While it demonstrates good practices by implementing nonce and capability checks on a significant portion of its entry points and using prepared statements for most SQL queries, there are areas for concern. The static analysis reveals a single flow with an unsanitized path, which is a potential risk for path traversal vulnerabilities. Additionally, 27% of output escaping is not properly handled, increasing the risk of Cross-Site Scripting (XSS) vulnerabilities. The plugin's historical vulnerability data is particularly concerning, with three known medium-severity CVEs related to XSS, Path Traversal, and sensitive information exposure. The fact that the last vulnerability was very recent (July 2025) and that there are currently no unpatched vulnerabilities suggests a history of security issues, although the developers have addressed them in the past. The absence of unpatched vulnerabilities in this specific version is a positive sign, but the recurring vulnerability types and the presence of unsanitized paths in the static analysis warrant caution.