Grid Gallery – for Photo Gallery, Image Gallery & Portfolio Security & Risk Analysis

The 'new-grid-gallery' plugin v1.5.4 exhibits a mixed security posture. On the positive side, static analysis reveals good practices such as 100% of SQL queries using prepared statements and a high percentage (92%) of output escaping. The plugin also implements numerous nonce and capability checks, indicating an awareness of common WordPress security measures. However, the presence of two flows with unsanitized paths, even if not classified as critical or high severity in this analysis, warrants caution as they represent potential entry points for unexpected behavior or information leakage.

The plugin's vulnerability history is a more significant concern. With two known CVEs, including a past high and medium severity vulnerability related to deserialization and XSS, it suggests a pattern of past security weaknesses. While there are currently no unpatched vulnerabilities, the historical prevalence of such issues indicates that the plugin may have had exploitable flaws in the past, and future vulnerabilities could arise. The last vulnerability being recent (April 2024) further emphasizes the need for vigilance.

In conclusion, while 'new-grid-gallery' v1.5.4 demonstrates some strengths in its code's handling of SQL and output, the taint analysis identifying unsanitized paths and its history of significant vulnerabilities are notable weaknesses. Users should be aware of this history and ensure the plugin is always updated to the latest version to mitigate past and potential future risks.