ShoutOut Security & Risk Analysis

The "shoutout" plugin v4.0.2 exhibits a concerning security posture, despite some positive indicators. While the plugin avoids dangerous functions, raw SQL queries, and file operations, it suffers from significant vulnerabilities in its attack surface and input handling. The presence of a REST API route without permission callbacks presents a direct entry point for unauthorized actions or information disclosure. Furthermore, the taint analysis revealing a flow with unsanitized paths, even if not critical, highlights potential for injection vulnerabilities that were not properly mitigated.

The vulnerability history is a major red flag. The plugin has a known medium-severity CVE, which is currently unpatched, and the common vulnerability type being Cross-site Scripting suggests a recurring issue with how user input is handled. The fact that the last vulnerability was in 2026 is highly unusual and likely an error in the provided data, but it emphasizes the historical presence of security flaws. The combination of an unprotected REST API endpoint and a known, unpatched XSS vulnerability points to a plugin that requires immediate attention and updates.

In conclusion, "shoutout" v4.0.2 is a high-risk plugin. While it demonstrates some good coding practices by using prepared statements for SQL and having few external requests, the critical weaknesses in its attack surface and historical vulnerability record, particularly the unpatched XSS flaw, outweigh these positives. Users should be strongly advised to disable or remove this plugin until these security issues are addressed and verified.