Link Whisper Free Security & Risk Analysis

The "link-whisper" plugin, version 0.9.2, presents a mixed security posture. While it demonstrates some good practices like a significant number of capability checks and a moderate adoption of prepared statements for SQL queries, there are substantial concerns.

The static analysis reveals a very large attack surface, with 93 AJAX handlers, a concerning 79 of which lack authentication checks. This opens the door to numerous potential unauthorized actions. The presence of the `unserialize` function, a known risky operation, coupled with 8 high-severity taint flows with unsanitized paths, indicates a risk of deserialization vulnerabilities and potential for code execution or data manipulation if improperly handled inputs are processed. Furthermore, the output escaping rate of 64% is insufficient, suggesting potential Cross-Site Scripting (XSS) vulnerabilities.

The plugin's vulnerability history is a significant red flag. With 10 known CVEs, including 2 currently unpatched high-severity vulnerabilities, and a history of common types like XSS, Missing Authorization, and SQL Injection, the plugin has a documented pattern of security weaknesses. The last recorded vulnerability in February 2026, while in the future, indicates a recent history of issues. The combination of an exposed attack surface, risky code functions, and a history of critical and high-severity vulnerabilities points to a plugin that requires immediate attention to mitigate significant security risks.