Organization chart Security & Risk Analysis

The organization-chart plugin v1.7.6 presents a mixed security posture. While it demonstrates good practices such as a high percentage of properly escaped output, a significant number of prepared SQL statements, and no file operations or external HTTP requests, there are several areas of concern. The presence of an unprotected AJAX handler significantly expands the attack surface and is a direct entry point for unauthenticated malicious input. Taint analysis, though limited, did reveal flows with unsanitized paths, which, combined with the unprotected AJAX handler, could potentially lead to vulnerabilities if exploited correctly. The plugin's history of 5 CVEs, including one high-severity vulnerability and four medium-severity, particularly those related to Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), and Missing Authorization, indicates a pattern of past security weaknesses. Although there are no currently unpatched vulnerabilities, this history warrants vigilance. The overall risk is moderate, leaning towards concerning due to the unprotected AJAX endpoint and past vulnerability trends.