PWA By Intelvue Security & Risk Analysis

The "pwa-by-intelvue" v0.1.5 plugin exhibits a mixed security posture. On the positive side, the plugin uses prepared statements for all its SQL queries and has no recorded vulnerabilities or CVEs, suggesting a history of secure development or a lack of active exploitation. It also avoids external HTTP requests and does not bundle any third-party libraries, which can sometimes introduce vulnerabilities. However, significant concerns arise from the static analysis. The plugin has a small attack surface, but crucially, one of its AJAX handlers lacks any authentication or capability checks, exposing it to potential unauthorized actions. Furthermore, a large percentage of its output (74%) is not properly escaped, which could lead to cross-site scripting (XSS) vulnerabilities if user-supplied data is present in these unescaped outputs. The absence of nonce checks on the AJAX handler is another critical omission that facilitates CSRF attacks.