Search Exclude Security & Risk Analysis

The 'search-exclude' plugin version 2.6.3 presents a mixed security posture. On one hand, the static analysis reveals a very small attack surface, with no identifiable AJAX handlers, REST API routes, shortcodes, or cron events that are exposed without authentication. The plugin also demonstrates good practices in output escaping, with 96% of outputs properly handled. Furthermore, there are no detected taint flows or dangerous functions within the analyzed code.

However, significant concerns arise from the plugin's vulnerability history. It has a history of 4 known CVEs, with a high severity vulnerability and three medium severity vulnerabilities in the past. The common types of these past vulnerabilities include Missing Authorization and Cross-site Scripting, indicating a pattern of introducing security flaws in these areas. The fact that the last vulnerability was recorded in late 2025 suggests potential for ongoing or recurring issues.

While the current code analysis shows no immediate, exploitable vulnerabilities like unsanitized taint flows or raw SQL queries, the historical pattern of past vulnerabilities, particularly the high and medium severity ones related to authorization and XSS, warrants caution. The presence of SQL queries without prepared statements, though not explicitly linked to a vulnerability in this version's analysis, is a practice that historically leads to SQL injection risks. The plugin's strength lies in its minimal attack surface and good output escaping in this version, but its past security record necessitates vigilance.