LIQUID BLOCKS – Slider, Carousel, Accordion Security & Risk Analysis

The plugin 'liquid-blocks' v1.3.3 exhibits a mixed security posture. On the positive side, the static analysis reveals no identified SQL queries executed without prepared statements, no dangerous functions, and no file operations, indicating good practices in these areas. Furthermore, the absence of known critical or high severity vulnerabilities in its history is encouraging, suggesting a generally stable security profile. The plugin also shows a good number of properly escaped outputs, which is crucial for preventing cross-site scripting vulnerabilities. However, there are significant concerns that temper this positive outlook. The most striking is the low percentage of properly escaped outputs (46%), which represents a considerable risk for cross-site scripting (XSS) vulnerabilities. The lack of any nonce checks or capability checks on its entry points, while the attack surface is currently reported as zero, means that any future expansion or modification of these entry points without implementing proper checks would immediately expose the plugin to security risks. The presence of two external HTTP requests also warrants caution, as these can be vectors for various attacks if not handled securely. The plugin's history of one medium vulnerability, specifically XSS, reinforces the concern about output escaping. While currently unpatched vulnerabilities are zero, the past incident highlights a recurring weakness. The plugin's developers should prioritize addressing the output escaping issue comprehensively to mitigate the risk of XSS, and ensure any future additions to its entry points include robust authentication and authorization checks.