Social Like Box and Page by WpDevArt Security & Risk Analysis

The "like-box" plugin version 0.8.45 exhibits a mixed security posture. While it demonstrates good practices such as using prepared statements for all SQL queries and performing nonce checks on its entry points, several significant concerns are present. The presence of 5 AJAX handlers, with 4 of them lacking authentication checks, represents a substantial attack surface that could be exploited by unauthenticated users. Furthermore, only 62% of output escaping is properly implemented, indicating a potential for cross-site scripting (XSS) vulnerabilities, a pattern supported by its vulnerability history which shows past XSS issues.

The plugin has a history of 2 known medium-severity vulnerabilities, both of which are currently patched. However, the recurring nature of XSS vulnerabilities in its past suggests a potential weakness in how user-supplied data is handled. Despite the absence of critical or high-severity taint flows in the current static analysis and the use of prepared statements for SQL, the unprotected AJAX handlers and the incomplete output escaping are immediate risks that require attention. Overall, while some security best practices are followed, the unprotected entry points and output sanitization issues present a notable risk.