Mesmerize Companion Security & Risk Analysis

The mesmerizing-companion plugin v1.6.168 presents a mixed security posture. While the majority of SQL queries are properly prepared and most output is escaped, several areas raise concern. Specifically, three AJAX handlers lack authentication checks, creating a significant entry point for potential abuse. The presence of the `unserialize` function, though only one instance, is a known risk that could be exploited if user-supplied data is unserialized without proper sanitization.

The plugin's vulnerability history, with three past medium-severity CVEs, including Missing Authorization and Cross-site Scripting, is a notable concern. Although there are no currently unpatched vulnerabilities, the types of past issues align with some of the risks identified in the static analysis, particularly the missing authorization. The last vulnerability being in 2026 suggests an outdated security practice or a historical issue that, while patched, highlights previous weaknesses.

Overall, the plugin demonstrates some good security practices, but the unprotected AJAX endpoints and the history of critical vulnerability types warrant careful attention. The lack of critical or high-severity taint flows is a positive sign, but the static analysis findings and past CVEs suggest a need for continued vigilance and potential remediation.