RioVizual — Table Blocks for Comparison, Pricing and Pros & Cons Security & Risk Analysis

The riovizual plugin v3.0.0 exhibits a mixed security posture. While the static analysis reveals a relatively small attack surface with no directly unprotected entry points and a good percentage of properly escaped outputs, there are significant concerns. The fact that 100% of its single SQL query is not using prepared statements is a major red flag, leaving it vulnerable to SQL injection attacks. Furthermore, the taint analysis indicates two flows with unsanitized paths, which could potentially lead to various code execution or data manipulation vulnerabilities if exploited. The plugin's vulnerability history, with two known medium-severity CVEs, one of which remains unpatched, further amplifies these concerns. The prevalence of Missing Authorization and Cross-Site Request Forgery (CSRF) in its past vulnerabilities suggests a pattern of insecure handling of user input and permissions. While the presence of nonce and capability checks is positive, the unpatched CVE and raw SQL query are critical weaknesses that require immediate attention.