RDFa Breadcrumb Security & Risk Analysis

The "rdfa-breadcrumb" plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices by having no observed AJAX handlers, REST API routes, shortcodes, or cron events contributing to its attack surface. Furthermore, all SQL queries are properly prepared, and there are no indications of dangerous functions, file operations, or external HTTP requests, which are excellent security indicators. The presence of a nonce check is also a positive sign.

However, significant concerns arise from the output escaping results, where only 27% of outputs are properly escaped. This is a considerable weakness, as it leaves the plugin susceptible to cross-site scripting (XSS) vulnerabilities where user-supplied data could be injected into the output without proper sanitization. The vulnerability history further exacerbates this concern, with one unpatched medium severity CVE related to XSS, last documented in mid-2025. This indicates a recurring issue with input sanitization or output escaping, and the fact that it remains unpatched is a direct security risk.

In conclusion, while the plugin has a minimal attack surface and good practices regarding SQL and external requests, the poor output escaping and the presence of an unpatched XSS vulnerability represent critical security weaknesses. Users should be cautious and prioritize applying any available patches for this plugin.