Library Bookshelves Security & Risk Analysis

The 'library-bookshelves' plugin version 5.11 exhibits a mixed security posture. On the positive side, it demonstrates good practices by using prepared statements for all SQL queries and maintaining a relatively small attack surface with only one shortcode entry point, none of which are unprotected. The output escaping is also largely effective, with 88% of outputs properly escaped. However, several concerns warrant attention. The presence of two flows with unsanitized paths in the taint analysis, even without a critical or high severity, indicates a potential for vulnerabilities that could be exploited if proper sanitization is not consistently applied. The plugin's vulnerability history is particularly concerning, with a total of four known CVEs, one of which remains unpatched. The recurring pattern of 'Cross-site Scripting' vulnerabilities suggests a persistent issue with input validation and output encoding, which has not been fully remediated over time. The last recorded vulnerability in late 2025 is also concerning, indicating recent issues that may not have been addressed by this version. While the plugin has strengths in its SQL handling and limited attack surface, the history of multiple medium-severity XSS vulnerabilities and an unpatched CVE points to a need for significant security review and remediation to ensure user data and site integrity.