POEditor Security & Risk Analysis

The 'poeditor' plugin version 0.9.12 presents a mixed security posture. While it demonstrates good practices in using prepared statements for SQL queries and a significant percentage of properly escaped outputs, there are notable concerns. The presence of two unprotected AJAX handlers is a significant risk, creating a direct attack surface that could be exploited. The use of the `unserialize` function, a known dangerous function, without further context on its usage and sanitization, raises red flags. The vulnerability history is also a concern, with a total of four known CVEs, including one high and three medium severity vulnerabilities. The common vulnerability types, Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS), are often linked to insufficient input validation and improper handling of user-supplied data, which aligns with the observed issues in the static analysis. The most recent vulnerability being in 2025 suggests that vulnerabilities have been discovered and patched, but the pattern of past issues cannot be ignored.