Contact Form Widget Security & Risk Analysis

The "new-contact-form-widget" plugin version 1.5.1 exhibits a mixed security posture. While the static analysis shows a generally good foundation with a low number of entry points and no immediately apparent critical vulnerabilities in taint flows, the vulnerability history is a significant concern. The plugin has a history of 5 known CVEs, with one still unpatched, which is a serious red flag. The types of past vulnerabilities (CSRF, Information Exposure, SQL Injection) suggest recurring issues in input validation and state management, even if not directly evident in the current static scan. The 63% usage of prepared statements for SQL queries is a positive step, but the remaining 37% and the 18% of unescaped outputs present potential attack vectors. The presence of file operations without explicit detail on their context also warrants caution. Overall, the plugin has made improvements, but the historical vulnerability record and the remaining code quality issues prevent it from being considered highly secure.