Likert Survey Master Security & Risk Analysis

The likert-survey-master plugin v0.8.0.1 exhibits a mixed security posture. While it demonstrates a strong adherence to secure SQL practices by utilizing prepared statements for 96% of its queries, and avoids file operations and external HTTP requests, significant concerns remain. The presence of two unprotected AJAX handlers exposes a considerable attack surface, making it susceptible to unauthorized actions. Furthermore, a high number of unsanitized tainted flows, all classified as high severity, indicate a substantial risk of Cross-Site Scripting (XSS) vulnerabilities. The plugin's history, marked by a known medium severity CVE related to XSS, further amplifies these concerns. The recent nature of this CVE (2025-09-20) suggests a recurring vulnerability pattern and a potential lack of robust input validation. While the plugin's strengths lie in its SQL handling and avoidance of other risky practices, the unprotected entry points and the prevalence of high-severity taint flows, coupled with past XSS issues, present a notable risk to WordPress installations.