LearnPress – Course Review Security & Risk Analysis

The static analysis of learnpress-course-review v4.2.0 indicates a generally positive security posture with no identified critical or high severity taint flows and all SQL queries utilizing prepared statements. However, a significant concern is the low percentage of properly escaped output (44%), suggesting a risk of Cross-Site Scripting (XSS) vulnerabilities where user-supplied data might not be adequately sanitized before being displayed. Furthermore, the absence of nonce checks and capability checks on entry points is a major weakness. While the static analysis found no direct vulnerabilities in the current version, the vulnerability history reveals a past medium-severity XSS vulnerability. This, coupled with the high percentage of unescaped output, suggests a potential for recurring XSS issues if not addressed proactively.