LinkedInclude Security & Risk Analysis

The "linkedinclude" v3.0.4 plugin presents a mixed security posture. While it exhibits some good practices, like a low number of overall entry points and a low number of SQL queries using prepared statements, several significant concerns emerge from the static analysis. The most critical finding is the presence of an AJAX handler that lacks authentication checks, creating a direct, unprotected entry point into the plugin's functionality. This, combined with a concerningly low percentage of properly escaped outputs (45%), suggests potential vulnerabilities related to data handling and exposure.

The vulnerability history further amplifies these concerns. The plugin has a known CVE, which is currently unpatched and classified as medium severity. The recurring pattern of Cross-Site Request Forgery (CSRF) vulnerabilities in its history indicates a potential weakness in how user actions are validated and secured, especially when coupled with unprotected entry points. The lack of nonce checks in the static analysis directly supports this historical trend.

In conclusion, while the plugin doesn't exhibit critical severity taint flows or a large attack surface, the unprotected AJAX handler, insufficient output escaping, and a history of CSRF vulnerabilities are significant weaknesses. The unpatched CVE is a direct and immediate risk. Efforts should focus on implementing authentication and authorization for all entry points, improving output sanitization, and addressing the known CVE.