Rhino Support for WordPress Security & Risk Analysis

The "rhino-support" plugin version 1.0.62 demonstrates a mixed security posture. On the positive side, it has no known historical vulnerabilities and utilizes prepared statements for all its SQL queries. Furthermore, all entry points appear to have some form of authentication or capability check, which is a strong preventative measure against unauthorized access.

However, significant concerns arise from the static analysis. A striking 9 out of 9 analyzed taint flows involve unsanitized paths, indicating a high potential for path traversal or directory manipulation vulnerabilities. Compounding this, a very low rate of proper output escaping (4%) suggests a high risk of cross-site scripting (XSS) vulnerabilities across its 52 output points. The presence of a bundled, potentially outdated library (Select2 v3.3.1) also introduces a risk if this library has known security flaws not reflected in the plugin's CVE history.

While the absence of recorded CVEs is encouraging, the numerous unsanitized paths and the severely inadequate output escaping are critical red flags that cannot be ignored. The plugin has strengths in its SQL handling and entry point protection, but the identified code-level weaknesses present a substantial security risk that needs immediate attention.