Property Hive Security & Risk Analysis

The PropertyHive plugin v2.1.14 exhibits a mixed security posture. While it demonstrates good practices in output escaping (86%) and utilizes nonce checks and capability checks extensively, several areas raise concerns. The presence of a REST API route without permission callbacks, coupled with a significant number of flows with unsanitized paths (30), suggests potential vulnerabilities. The two high-severity taint flows are particularly worrying, indicating pathways for malicious data to be processed without proper sanitization, which could lead to code execution or sensitive data exposure.

The plugin's vulnerability history is a significant red flag. With a total of 18 known CVEs, including one critical, three high, and fourteen medium severity vulnerabilities, it suggests a pattern of recurring security flaws. The common types of past vulnerabilities (XSS, CSRF, Missing Authorization, Deserialization, Code Injection) are severe and directly align with potential risks identified in the static analysis. The fact that the last vulnerability was in the future (2025-11-24) is likely a data anomaly but the sheer volume and severity of past CVEs point to a need for substantial code review and remediation.

In conclusion, while PropertyHive has strengths in areas like output escaping and authorization checks, the critical identified taint flows, unprotected REST API endpoint, and a history of numerous severe vulnerabilities indicate a high-risk profile. These factors collectively suggest that the plugin requires urgent attention and thorough security auditing to mitigate potential exploitation.