BerqWP – All-In-One Optimization for Core Web Vitals, Cache, CDN, Images, CSS & JavaScript Security & Risk Analysis

The "searchpro" plugin v3.1.19 presents a mixed security posture. On the positive side, it utilizes prepared statements for all SQL queries, demonstrates a high percentage of properly escaped output, and implements a considerable number of nonce and capability checks. The absence of known unpatched CVEs is also a strength. However, significant concerns arise from the static analysis. The plugin exposes one AJAX handler without authentication checks, creating a direct entry point for potential attackers. Furthermore, the taint analysis reveals four flows with unsanitized paths, although none were classified as critical or high severity, they still indicate potential for input manipulation issues. The vulnerability history is particularly concerning, with a total of five known CVEs, including one critical, two high, and two medium severity. The common vulnerability types, such as Missing Authorization, Cross-site Scripting, Unrestricted Upload, and SSRF, suggest recurring weaknesses in how the plugin handles user input and access control. The most recent vulnerability being from 2025 indicates a pattern of past issues that, while currently patched, suggest a need for ongoing vigilance.