Name Directory Security & Risk Analysis

The "name-directory" v1.33.0 plugin exhibits a mixed security posture. While it demonstrates good practices like using prepared statements for a majority of its SQL queries and implementing nonce and capability checks on its entry points, several concerning areas require attention. The static analysis reveals a significant number of taint flows with unsanitized paths, with 7 high-severity flows, suggesting potential for injection vulnerabilities that could be exploited if these paths are exposed to user input. Furthermore, a concerning 69% of output escaping is not properly performed, which opens the door to Cross-Site Scripting (XSS) vulnerabilities.

The vulnerability history is particularly troubling, with 10 known CVEs, including 5 high-severity and 5 medium-severity ones. The common vulnerability types (Missing Authorization, CSRF, XSS) align with the static analysis findings regarding unsanitized paths and output escaping. While there are currently no unpatched CVEs, the sheer volume and nature of past vulnerabilities indicate a recurring pattern of security weaknesses within the plugin. The most recent vulnerability reported in 2026 suggests a potential for outdated security patches if not diligently managed.

In conclusion, while the plugin has adopted some secure coding practices, the high number of unsanitized taint flows and insufficient output escaping, coupled with a history of significant past vulnerabilities, present a considerable risk. The current lack of unpatched CVEs is a positive sign, but the underlying code issues and historical patterns suggest ongoing vigilance and potential for future vulnerabilities if not addressed.