Recordbrowser Security & Risk Analysis

The "recordbrowser" plugin v1.1.7 exhibits a mixed security posture. While it boasts a clean vulnerability history with no known CVEs and a reasonable number of capability checks, several concerning aspects are highlighted by the static analysis. The presence of two AJAX handlers without authentication checks represents a significant attack vector. Furthermore, the taint analysis revealed seven flows with unsanitized paths, all classified as high severity, indicating potential for injection vulnerabilities if user input is not handled with extreme care. Although SQL queries do utilize prepared statements to some extent, the significant number of unsanitized taint flows alongside unprotected entry points suggests a heightened risk.