Scrollsequence – Cinematic Scroll Image Animation Plugin Security & Risk Analysis

The Scrollsequence plugin v1.6.2 presents a mixed security posture. While it demonstrates some good practices, such as a relatively low number of total SQL queries and a reasonable percentage of those using prepared statements, and a good rate of output escaping, there are significant concerns. A notable weakness is the presence of four unprotected AJAX handlers, forming a substantial portion of its attack surface. Furthermore, the taint analysis revealed a flow with unsanitized paths of high severity, indicating a potential for vulnerabilities if user input is not handled carefully. The plugin's vulnerability history, while currently showing no unpatched CVEs, includes a past medium severity vulnerability for Cross-Site Scripting, suggesting a prior area of weakness that warrants ongoing vigilance. The bundled Freemius library, though at version 1.0, is a potential concern if it has known vulnerabilities that are not addressed by the plugin itself. Overall, the plugin has strengths in its SQL query practices and output escaping, but the high number of unprotected entry points and the critical taint flow are significant risk factors.