PhotoShelter for Photographers Blog Feed Plugin Security & Risk Analysis

The Photoshelter Official Plugin, version 1.5.7, exhibits a mixed security posture. On the positive side, it demonstrates good practices by not using dangerous functions, all SQL queries are prepared, and there are no known critical or high severity vulnerabilities historically. The static analysis also shows a limited attack surface with no unprotected entry points, and a reasonable number of nonce checks are in place.

However, significant concerns arise from the code analysis. The plugin has a very low percentage of properly escaped output (12%), which is a major indicator of potential Cross-Site Scripting (XSS) vulnerabilities. This is further corroborated by the vulnerability history, which shows a past medium severity XSS vulnerability. The taint analysis indicates flows with unsanitized paths, although none reached critical or high severity in this analysis, the presence of unsanitized paths in conjunction with poor output escaping significantly elevates the risk.

Given the history of XSS and the current poor output escaping, the risk associated with this plugin is moderate to high. While the plugin has addressed some security aspects, the lack of robust output sanitization leaves it vulnerable to XSS attacks, especially considering the presence of unsanitized paths in the taint analysis. The unpatched medium severity CVE is also a direct risk.