TableOn – WordPress Posts Table Filterable  Security & Risk Analysis

The "posts-table-filterable" plugin version 1.0.4.4 presents a significant security risk due to a large attack surface with a high proportion of unprotected entry points, specifically 30 out of 39. The lack of authorization checks on numerous AJAX handlers is a major concern, as it could allow unauthenticated users to trigger potentially sensitive actions. While the plugin demonstrates some good practices like a high percentage of properly escaped output and a moderate use of prepared statements for SQL queries, these are overshadowed by the critical vulnerabilities.

The vulnerability history is alarming, with a total of 7 known CVEs, including one critical and six medium severity issues. The fact that two vulnerabilities remain unpatched, with the last one reported as recently as 2026-01-20, indicates a pattern of persistent security flaws and potentially slow or inadequate patching by the developers. The common vulnerability types listed (XSS, Code Injection, Deserialization, Missing Authorization) are all serious and can lead to complete site compromise. The taint analysis, while limited in scope, did reveal flows with unsanitized paths, hinting at potential injection vulnerabilities that might not have been fully captured by the analysis or are yet to be discovered.

In conclusion, despite some positive code signals regarding output escaping, the plugin's overall security posture is weak. The combination of a large, unprotected attack surface and a history of serious, unpatched vulnerabilities makes this plugin a high-risk component. Users should exercise extreme caution and consider deactivating or replacing it until all known vulnerabilities are addressed and the plugin's security practices are demonstrably improved.