Linkz.ai – Automatic link previews on hover Security & Risk Analysis

The "linkz-ai" v1.3.0 plugin exhibits a mixed security posture. On the positive side, the static analysis reveals a small attack surface with no unprotected entry points and a complete reliance on prepared statements for SQL queries. The plugin also demonstrates good practices with a healthy number of nonce and capability checks. Taint analysis shows no critical or high-severity unsanitized flows.

However, concerns arise from the output escaping, where only 57% of outputs are properly escaped, leaving potential for cross-site scripting (XSS) vulnerabilities. While there are no currently unpatched CVEs, the plugin has a history of two medium-severity vulnerabilities, both stemming from missing authorization issues. This historical pattern suggests a recurring oversight in securing sensitive operations, even though the current analysis shows no immediate auth bypasses in the entry points.

Overall, the plugin has made strides in secure coding practices, particularly with SQL handling and a protected attack surface. The primary remaining risk is the inconsistent output escaping and the historical precedent of authorization flaws. While no critical issues are immediately apparent in this version's static analysis, the past vulnerability types warrant continued vigilance regarding authorization and the identified output escaping weaknesses.