Publish Post Email Notification Security & Risk Analysis

The plugin "publish-post-email-notification" v1.0.2.4 exhibits a mixed security posture. On the positive side, the static analysis indicates a small attack surface with no apparent AJAX handlers, REST API routes, shortcodes, or cron events exposed without authentication. The code also demonstrates good practices regarding SQL queries, exclusively using prepared statements, and includes a nonce check. However, there are significant concerns regarding output escaping, with only 56% of outputs being properly escaped, leaving a substantial portion vulnerable to Cross-Site Scripting (XSS).

The vulnerability history reveals a concerning pattern. The plugin has two known medium-severity CVEs, one of which was recently discovered (2025-03-27). While currently unpatched vulnerabilities are zero, the existence of past CSRF and XSS vulnerabilities indicates a recurring weakness in input sanitization and output escaping, which aligns with the static analysis findings of imperfect output escaping.

In conclusion, while the plugin has strengths in its limited attack surface and secure SQL handling, the significant percentage of unescaped output and a history of XSS and CSRF vulnerabilities present a notable risk. Users should be aware of the potential for XSS attacks. The absence of capability checks on any identified entry points (though none are explicitly listed as unprotected) is also a potential area for further investigation if any entry points are discovered in deeper analysis.