Leadinfo Security & Risk Analysis

The "leadinfo" plugin v2.1.4 exhibits a mixed security posture. On the positive side, static analysis indicates a small attack surface with no unprotected entry points and a good use of prepared statements for SQL queries. The presence of nonce and capability checks also suggests an attempt to implement security measures. However, there are areas of concern, particularly the 50% rate of unescaped output, which could lead to Cross-Site Scripting (XSS) vulnerabilities. Additionally, the taint analysis revealed two flows with unsanitized paths, though they were not classified as critical or high severity, they still represent potential entry points for malicious data.

The plugin's vulnerability history is a significant red flag. With two known medium-severity CVEs, and a recent vulnerability recorded in May 2025, it indicates a recurring pattern of security weaknesses. The common types of vulnerabilities being Missing Authorization and CSRF further suggest issues with how user actions and data access are handled. While there are currently no unpatched CVEs, the history of past issues, especially those related to authorization, raises concerns about the overall robustness of the plugin's security controls. Therefore, while the plugin demonstrates some good security practices in its code, the historical vulnerability data and the presence of unsanitized paths warrant caution.