Quill Forms | Conversational Multi Step Forms, Surveys & quizzes Security & Risk Analysis

The Quillforms plugin v5.6.1 exhibits a mixed security posture. While it demonstrates strong adherence to secure coding practices such as extensive output escaping (96%) and a high percentage of prepared statements for SQL queries (86%), significant concerns arise from its attack surface. A substantial number of AJAX handlers (14 out of 17) lack proper authorization checks, presenting a considerable risk of unauthorized actions if these endpoints are exploitable. The single identified taint flow with unsanitized paths, rated as high severity, further exacerbates this risk, suggesting a potential for code injection or other harmful operations.

Historically, the plugin has had three medium-severity vulnerabilities, with common types including Cross-site Scripting and Missing Authorization. Although there are currently no unpatched CVEs, the recurring pattern of missing authorization and XSS vulnerabilities in its history, coupled with the current findings of unprotected AJAX handlers and a high-severity taint flow, indicates a persistent challenge in fully securing all entry points. The plugin has strengths in its coding practices for SQL and output handling, but the high number of unprotected AJAX endpoints and the critical taint flow are significant weaknesses that require immediate attention.