SALESmanago & Leadoo Security & Risk Analysis

The Salesmanago plugin v3.10.0 exhibits a mixed security posture. On the positive side, it demonstrates good practices in several areas, including the exclusive use of prepared statements for all SQL queries, indicating a strong defense against SQL injection. The presence of nonce and capability checks on its entry points further suggests an effort to protect against unauthorized access and actions.

However, the static analysis reveals significant concerns. A notable issue is the low percentage of properly escaped output (20%), which presents a substantial risk of Cross-Site Scripting (XSS) vulnerabilities. While the taint analysis shows no critical or high-severity unsanitized paths, the fact that all 4 analyzed flows have unsanitized paths, even if flagged as not critical, warrants attention. The presence of file operations without explicit mention of sanitization also introduces potential risks.

The vulnerability history of this plugin is a major red flag. With 4 known CVEs, all classified as medium severity, and a history of 'Missing Authorization', 'Cross-Site Request Forgery (CSRF)', and 'Authentication Bypass by Primary Weakness', it indicates a pattern of recurring security weaknesses. While there are currently no unpatched CVEs, the historical prevalence of these specific vulnerability types suggests a fundamental architectural or implementation flaw that could resurface. The plugin's last vulnerability being in the future (2025-12-24) is an anomaly and may be a data entry error, but the historical pattern of medium vulnerabilities remains a strong indicator of ongoing risk.