Reviews Plus Security & Risk Analysis

The "reviews-plus" v1.4.1 plugin exhibits a mixed security posture. On the positive side, the static analysis indicates a relatively small attack surface with no identified unprotected AJAX handlers or REST API routes. The code also shows a reasonable effort towards security with a good percentage of SQL queries using prepared statements and a decent number of capability checks. However, the presence of unsanitized paths in the taint analysis is a significant concern, suggesting potential vulnerabilities where user input might be used in file operations or other sensitive functions without proper validation. The vulnerability history is also a red flag, with two medium-severity CVEs historically, including one related to Missing Authorization and another to Uncontrolled Resource Consumption. While currently unpatched vulnerabilities are zero, the past patterns indicate that the plugin has had issues in these critical areas.