Recipe Card Blocks Lite Security & Risk Analysis

The plugin "recipe-card-blocks-by-wpzoom" v3.4.14 exhibits a mixed security posture. While the static analysis reveals several good practices, such as 100% of SQL queries using prepared statements and a high percentage of properly escaped output, there are notable concerns. The presence of two AJAX handlers without authentication checks represents a direct attack vector. The use of the `unserialize` function, even if not exploited in the provided taint analysis, is inherently risky and can lead to deserialization vulnerabilities if not handled with extreme care.

The vulnerability history is a significant concern. With a total of six known CVEs, including one high and five medium severity vulnerabilities, this plugin has a track record of security flaws. The common vulnerability types listed, such as SQL Injection and Authorization issues, are serious and have historically impacted the plugin. While there are currently no unpatched vulnerabilities, the recurrence of these issues suggests potential systemic weaknesses that could be re-introduced in future updates or remain exploitable if older versions are used.

In conclusion, while the code exhibits some modern security practices, the high number of past vulnerabilities and the presence of unprotected entry points are significant red flags. The risk is elevated due to the historical pattern of critical security flaws. Users should be cautious and ensure they are always running the latest patched version, though the past history warrants a thorough review of its current security posture.