Query Wrangler Security & Risk Analysis

The plugin "query-wrangler" v1.5.57 exhibits a mixed security posture. While it demonstrates good practices in its use of prepared statements for SQL queries (97%) and has no currently unpatched known vulnerabilities, several areas raise significant concern. The presence of 3 unprotected AJAX handlers represents a substantial attack surface. Furthermore, the taint analysis reveals 6 high-severity flows with unsanitized paths, indicating a direct risk of input manipulation leading to security issues. The low percentage of properly escaped output (8%) is particularly worrying, suggesting a high likelihood of cross-site scripting vulnerabilities. The historical data shows past vulnerabilities related to CSRF and XSS, reinforcing the risks identified in the static analysis. The recent vulnerability in April 2025, even if patched, highlights a recurring pattern of exploitable input handling. Overall, the plugin has strengths in its SQL handling but weaknesses in input sanitization and output escaping, combined with a concerning number of unprotected entry points, necessitate careful attention to mitigate potential risks.