Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts Security & Risk Analysis

The post-carousel plugin version 3.0.12 presents a mixed security posture. While it demonstrates good practices such as using prepared statements for all SQL queries and a high percentage of properly escaped outputs, there are notable areas of concern. The presence of two AJAX handlers without authentication checks represents a direct attack vector that could be exploited by unauthenticated users. Furthermore, the static analysis flagged the use of the 'unserialize' function, which can be dangerous if used with untrusted input, though no critical or high severity taint flows were identified in the provided data. The plugin's vulnerability history, with a total of four known CVEs including one high-severity vulnerability in the past, indicates a pattern of past security weaknesses. This suggests that while the current version might have addressed previous issues, the historical trend warrants caution and diligent monitoring for future updates. Overall, the plugin has strengths in its handling of database queries and output sanitization but weaknesses in its access control for AJAX endpoints and past security incidents that require attention.