Shortcoder — Create Shortcodes for Anything Security & Risk Analysis

The plugin "shortcoder" v6.5.2 exhibits a mixed security posture. On the positive side, the plugin demonstrates strong adherence to secure coding practices by utilizing prepared statements for all SQL queries and implementing nonce and capability checks for its entry points, including AJAX handlers and shortcodes. The static analysis found no dangerous functions, file operations, or unsanitized taint flows, which are significant strengths.

However, a notable concern arises from the output escaping, where only 58% of outputs are properly escaped. This indicates a potential for Cross-Site Scripting (XSS) vulnerabilities, especially given that one of the past common vulnerability types was indeed XSS. The presence of external HTTP requests, while not inherently insecure, warrants careful review in a real-world scenario. The plugin also bundles the TinyMCE library, which, if outdated or itself vulnerable, could introduce risks. The vulnerability history, although showing no currently unpatched CVEs, reveals two past medium-severity vulnerabilities, one of which was related to XSS and another to missing authorization. This pattern suggests a tendency for vulnerabilities to emerge, even if they are eventually patched.