MPL-Publisher — Ebook & Audiobook Creator Security & Risk Analysis

The "mpl-publisher" v2.22.0 plugin exhibits a mixed security posture. On the positive side, the plugin demonstrates good practices with 100% of its SQL queries using prepared statements and a relatively high percentage of output being properly escaped. It also incorporates nonce and capability checks, which are essential for WordPress security.

However, a significant concern arises from the presence of an unprotected AJAX handler, representing a direct attack surface without authentication. While no critical or high severity taint flows were identified in the static analysis, the existence of an unprotected entry point remains a risk. The vulnerability history, though currently showing no unpatched CVEs, reveals a past pattern of three medium severity vulnerabilities, predominantly Cross-site Scripting (XSS) issues. This suggests a potential for input validation and output sanitization weaknesses that have required attention in the past, even if seemingly resolved in this version. The last vulnerability being in April 2025 also indicates the analysis might be based on future data, which should be noted.

In conclusion, while the current version of "mpl-publisher" shows improvement in secure coding practices like prepared statements and escaping, the unprotected AJAX handler is a critical vulnerability that needs immediate attention. The historical pattern of XSS vulnerabilities also warrants continued vigilance and thorough testing to ensure these issues do not resurface. Overall, the plugin has strengths but harbors a notable weakness in its attack surface.