MSTW Schedules & Scoreboards Security & Risk Analysis

The mstw-schedules-scoreboards plugin v1.5.1 exhibits a mixed security posture. On the positive side, there are no recorded vulnerabilities (CVEs), no dangerous functions used, no external HTTP requests, and a reasonable number of nonce and capability checks present on its entry points. The absence of AJAX handlers and REST API routes without authentication checks is also a good sign, significantly reducing the attack surface in those areas.

However, the static analysis reveals several areas of concern. The significant number of file operations (6) coupled with a high percentage of unsanitized paths in taint analysis (3 out of 4 flows) suggests a potential risk of directory traversal or other file-related vulnerabilities. Furthermore, the plugin uses a raw SQL query without prepared statements, which is a common vector for SQL injection attacks. The relatively low percentage of properly escaped output (32%) also raises concerns about cross-site scripting (XSS) vulnerabilities.

While the plugin has no historical CVEs, this doesn't guarantee future security. The identified code signals, particularly the unsanitized paths and unescaped output, represent active risks that should be addressed. The plugin demonstrates good intent with its checks but lacks robust data sanitization and secure SQL practices.