Save as PDF Plugin by PDFCrowd Security & Risk Analysis

The save-as-pdf-by-pdfcrowd plugin, version 4.5.6, presents a mixed security posture. While it demonstrates good practices in its SQL query handling, with 100% using prepared statements and a high percentage of output escaping, several significant concerns exist. The plugin has a notable attack surface with 6 entry points, 4 of which lack any authentication checks. This is exacerbated by the presence of 2 flows with unsanitized paths, although these did not reach a critical or high severity in the taint analysis. The plugin's vulnerability history is a major red flag, with 10 known CVEs, including 1 high and 9 medium severity vulnerabilities. The fact that the last vulnerability was in 2026, while concerning for a current analysis, suggests a pattern of past security weaknesses. This history, combined with the unprotected entry points, indicates a plugin that has historically been a target and may require careful scrutiny and timely updates.

Despite the positive aspects like proper SQL handling and mostly escaped output, the plugin's past indicates a susceptibility to significant vulnerabilities like deserialization, missing authorization, and cross-site scripting. The unprotected AJAX handlers are a direct pathway for potential exploitation if vulnerabilities are present. The presence of unsanitized paths, even if not leading to critical issues in this version, warrants caution. The overall risk is elevated due to the historical pattern of vulnerabilities and the exposed attack surface. Users should be particularly vigilant about updates and consider the plugin's past record when assessing its trustworthiness.