Plezi Security & Risk Analysis

The "plezi" plugin v1.0.8 exhibits a mixed security posture. On the positive side, the plugin demonstrates good practices in its handling of SQL queries, exclusively using prepared statements, and it has no recorded unpatched vulnerabilities despite a history of two known CVEs. The absence of critical or high-severity taint flows is also encouraging. However, several areas raise concerns. The plugin relies heavily on capability checks (6 in total) but shows a complete lack of nonce checks, which are crucial for preventing CSRF attacks on any interactive elements. Furthermore, a significant portion of its output (49%) is not properly escaped, creating a substantial risk of Cross-Site Scripting (XSS) vulnerabilities. The history of two CVEs, one high and one medium severity, both related to XSS, strongly suggests a recurring pattern of insecure output handling within the plugin's codebase that has not been fully addressed.