Push Notifications For Web Security & Risk Analysis

The plugin "push-notifications-for-web" v2.0 exhibits a mixed security posture. While it has a clean vulnerability history with no known CVEs, the static analysis reveals significant areas of concern. The plugin has two AJAX entry points, both of which lack authentication checks, creating a substantial attack surface that could be exploited by unauthenticated users. Furthermore, all SQL queries are executed without prepared statements, posing a high risk of SQL injection vulnerabilities. The taint analysis indicates two high-severity flows with unsanitized paths, which, combined with the lack of proper SQL sanitization, suggests potential for malicious data manipulation. Although the plugin has a good number of output escaping checks, the presence of unsanitized paths and raw SQL queries overshadows this strength. The absence of critical or high vulnerabilities in its history is positive, but the static analysis findings point to potential weaknesses that could be exploited if not addressed.