Latest Post Shortcode Security & Risk Analysis

The "latest-post-shortcode" plugin exhibits a mixed security posture. While it demonstrates good practices such as exclusively using prepared statements for SQL queries and a high percentage of properly escaped output, significant concerns arise from its attack surface. The presence of three unprotected AJAX handlers presents a substantial risk, as these can be directly accessed by unauthenticated users, potentially leading to unauthorized actions or information disclosure. The lack of nonce checks on these AJAX endpoints further exacerbates this issue.

The vulnerability history is particularly noteworthy, with two past medium-severity CVEs related to Missing Authorization and Cross-Site Scripting. Although currently unpatched vulnerabilities are zero, the historical pattern of these specific vulnerability types suggests recurring issues with input validation and access control within the plugin. The fact that the last vulnerability was in 2026, while the current date is likely before that, could indicate a future unpatched vulnerability or an error in the provided data.