PDF Poster – Display PDF Files with Custom Viewer Security & Risk Analysis

The 'pdf-poster' plugin v2.5.0 exhibits a mixed security posture. While it demonstrates good practices in output escaping and avoids dangerous functions and file operations, there are significant areas of concern. The presence of an unprotected AJAX handler represents a critical entry point that could be exploited by attackers if not properly secured. Additionally, all SQL queries lack prepared statements, which significantly increases the risk of SQL injection vulnerabilities. The plugin's vulnerability history shows a past medium-severity Cross-Site Scripting (XSS) vulnerability, indicating that input sanitization has been an issue, and the absence of any taint analysis data makes it difficult to assess the current risk of such flaws. Despite its strengths in output escaping, the unprotected AJAX handler and the complete lack of SQL preparedness are substantial weaknesses that warrant attention.