Omnisend for Gravity Forms Add-On Security & Risk Analysis

The Omnisend for Gravity Forms Add-On v1.2.8 presents a mixed security profile. On the positive side, the plugin demonstrates good practices regarding database interactions, with 100% of SQL queries utilizing prepared statements, and it reports no known vulnerabilities (CVEs) or past security incidents, suggesting a generally stable and secure history. The attack surface appears to be minimal, with no identified AJAX handlers, REST API routes, shortcodes, or cron events, and importantly, no unprotected entry points.

However, several areas raise concerns. The output escaping is notably weak, with only 22% of outputs being properly escaped. This could lead to cross-site scripting (XSS) vulnerabilities if user-supplied data is not adequately sanitized before being displayed. Furthermore, the complete absence of nonce checks and capability checks, despite the presence of file operations, indicates potential privilege escalation or unauthorized file manipulation risks. The lack of taint analysis data is not necessarily a positive sign; it could imply that the analysis tools were not configured correctly or that the analysis itself was limited, rather than a true absence of potential taint flows.

Overall, while the plugin boasts a clean vulnerability history and a small attack surface, the significant issues with output escaping and the lack of authentication and authorization checks on sensitive operations like file handling are critical weaknesses. These factors necessitate careful review and potential remediation to ensure robust security.