My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu) Security & Risk Analysis

The plugin "mystickymenu" v2.8.7 presents a mixed security posture. On the positive side, it demonstrates good practices with a high percentage of SQL queries using prepared statements and a substantial amount of output properly escaped. The absence of critical or high severity taint analysis findings and the fact that all known CVEs are currently patched are also strong indicators of a relatively secure codebase in its current state. The presence of numerous nonce and capability checks further reinforces this.

However, there are notable concerns. The plugin exposes a significant attack surface with 13 AJAX handlers, two of which lack any authentication checks. This is a direct entry point for potential unauthorized actions. While the vulnerability history shows no currently unpatched issues, the plugin has a history of six CVEs, including one high, four medium, and one low severity vulnerability. The types of past vulnerabilities (SQL Injection, CSRF, Missing Authorization, XSS) suggest a pattern of common web security weaknesses that, while addressed, indicate areas where the plugin has historically struggled. The presence of bundled libraries, like Select2, could also introduce risks if not maintained and updated independently.

In conclusion, while the immediate threat from unpatched vulnerabilities is low, the plugin's historical pattern and the presence of unprotected AJAX endpoints warrant caution. Developers should prioritize securing the remaining unauthenticated AJAX handlers and maintain vigilance regarding the security of bundled libraries. The past incidents highlight the need for ongoing security testing and code review.