Rating by BestWebSoft Security & Risk Analysis

The "rating-bws" plugin version 1.7 exhibits a mixed security posture. On the positive side, the static analysis reveals a strong adherence to secure coding practices, with a high percentage of SQL queries using prepared statements and properly escaped output. The plugin also incorporates a substantial number of nonce and capability checks, indicating an effort to protect against common web vulnerabilities. However, the plugin's vulnerability history is a significant concern. With three known CVEs, including one currently unpatched high-severity vulnerability, the plugin has a history of introducing serious security flaws. The types of past vulnerabilities (Deserialization, Resource Consumption, XSS) suggest potential for complex attacks if the unpatched vulnerability is exploitable. While the static analysis doesn't immediately reveal critical flaws in this specific version, the historical pattern necessitates caution. The unpatched high-severity vulnerability from April 17, 2025, is the most pressing issue and suggests that users are at immediate risk from known exploits. Therefore, despite some good development practices, the ongoing unpatched vulnerability overshadows these strengths, making the plugin a moderate to high-risk component.