Recently Security & Risk Analysis

The 'recently' plugin v4.2.0 presents a mixed security posture. On the positive side, the static analysis reveals a very small attack surface with only one AJAX handler, and importantly, no unprotected entry points. The taint analysis also shows no critical or high-severity flows with unsanitized paths, which is a strong indicator of secure input handling for common web vulnerabilities. However, the plugin's vulnerability history is a significant concern, with two known CVEs, including a high and a medium severity vulnerability. The common vulnerability types (XSS and unrestricted uploads) suggest a pattern of input validation and sanitization issues in past versions. While there are currently no unpatched CVEs, this history implies a recurring weakness that could resurface.

The code signals indicate areas for improvement. While a good portion of SQL queries use prepared statements (44%), the remaining 56% do not, posing a risk of SQL injection. Similarly, only 42% of outputs are properly escaped, leaving a significant portion vulnerable to Cross-Site Scripting (XSS). The presence of file operations (8) and external HTTP requests (1) also warrants careful review to ensure these are handled securely. The nonce checks and capability checks are present, which is good, but their distribution and effectiveness would require deeper code inspection.