TS Poll – Survey, Versus Poll, Image Poll, Video Poll Security & Risk Analysis

The poll-wp plugin v2.5.5 presents a mixed security posture. While it demonstrates good practices like using prepared statements for all SQL queries and a high percentage of properly escaped output, several significant concerns exist. The presence of one unprotected AJAX handler is a critical vulnerability, creating an immediate attack vector. The plugin's history is particularly alarming, with a total of six known CVEs, one of which remains unpatched and is classified as critical. The historical prevalence of Missing Authorization, SQL Injection, and Cross-Site Scripting vulnerabilities suggests a recurring pattern of insecure coding practices, even with some improvements in later versions. The outdated bundled library also adds to the risk profile.

Despite some positive technical indicators like the absence of dangerous functions and taint analysis showing no critical or high severity issues, the historical vulnerability record and the single unprotected entry point overshadow these strengths. The critical unpatched CVE and the unprotected AJAX handler are immediate threats that require urgent attention. The overall risk is elevated due to the plugin's history of severe vulnerabilities and the presence of exploitable weaknesses.