SEO Booster Security & Risk Analysis

The "seo-booster" v6.1.8 plugin exhibits a mixed security posture. While it demonstrates good practices in utilizing prepared statements for SQL queries and proper output escaping, significant concerns arise from its attack surface and past vulnerability history. The presence of unprotected AJAX handlers and REST API routes presents direct entry points for attackers. The taint analysis revealing a high severity flow with unsanitized paths is a critical red flag, indicating potential for serious security breaches like command injection or path traversal if exploited.

The plugin's vulnerability history, including a currently unpatched high-severity CVE and past issues with missing authorization, CSRF, and SQL injection, suggests a recurring pattern of security weaknesses. The late 2025 vulnerability date for the unpatched CVE is concerning and highlights a lack of timely patching. While the plugin has strengths in its SQL and output handling, the unprotected entry points and historical vulnerabilities, coupled with the identified high-severity taint flow, elevate the overall risk profile.