Link Library Security & Risk Analysis

The 'link-library' plugin v7.8.7 presents a mixed security posture. While it demonstrates some good practices, such as the high percentage of SQL queries using prepared statements and a substantial number of nonce and capability checks, several significant concerns remain. The presence of 7 unprotected entry points across AJAX handlers and REST API routes is a considerable risk, leaving the plugin vulnerable to unauthorized access and potential exploitation. Furthermore, the taint analysis revealing a high-severity flow with unsanitized paths indicates a potential for critical vulnerabilities like Cross-Site Scripting or even Remote Code Execution if this flow involves user-controlled input. The plugin's vulnerability history is a major red flag. With 19 known CVEs, including a currently unpatched high-severity vulnerability, and a recent vulnerability in late 2025, this suggests a pattern of recurring security flaws. The common vulnerability types, such as SSRF, XSS, Missing Authorization, CSRF, and SQL Injection, further reinforce the potential for severe damage to a WordPress site. In conclusion, despite some positive coding practices, the significant number of unprotected entry points, the high-severity taint flow, and the extensive and recent history of serious vulnerabilities strongly indicate a high-risk plugin that requires immediate attention and mitigation.