Novelist Security & Risk Analysis

The novelist plugin v1.3.0 presents a mixed security posture. On the positive side, the static analysis indicates a reasonable level of effort in implementing security controls, with a significant number of capability checks and nonce checks present. The absence of critical or high severity taint flows and dangerous functions is also encouraging. However, several areas warrant concern. The fact that 100% of SQL queries are not using prepared statements is a significant risk, potentially exposing the site to SQL injection vulnerabilities. While the total number of SQL queries is low, the lack of proper sanitization for all of them is a critical oversight.

The vulnerability history reveals a pattern of medium severity issues, specifically Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF). Although there are currently no unpatched vulnerabilities, the presence of 3 historical medium CVEs suggests a recurring tendency to introduce such flaws. The last reported vulnerability was in March 2025, which is in the future, indicating a potential data anomaly or an assumption about future vulnerability discovery.

In conclusion, while novelist v1.3.0 demonstrates some good security practices in its implementation, the lack of prepared statements for all SQL queries is a critical weakness. The historical vulnerability trend also indicates a need for more rigorous code review and security testing to prevent recurring XSS and CSRF issues. The plugin has a moderate risk profile, primarily due to the SQL query handling and past vulnerability types.