Metricool – Social media and site statistics Security & Risk Analysis

The static analysis of Metricool v1.26 reveals a generally positive security posture in several key areas. The plugin has a small attack surface with no identified AJAX handlers, REST API routes, shortcodes, or cron events that are not protected by authentication or permission checks. Furthermore, it avoids dangerous functions, performs file operations, and makes external HTTP requests, which are all positive signs. SQL queries are also 100% prepared, and there's a single nonce check present.

However, a significant concern arises from the complete lack of output escaping. With 6 total outputs and 0% properly escaped, this indicates a high risk of Cross-Site Scripting (XSS) vulnerabilities. The vulnerability history confirms this, with one medium severity CVE historically recorded for XSS, last patched in late 2022. While there are no currently unpatched CVEs or critical/high severity taint flows, the consistent pattern of output escaping issues and past XSS vulnerabilities warrants caution. The plugin's strengths lie in its limited attack surface and secure handling of database queries and external requests, but the unescaped output represents a critical weakness that could be exploited.