Simple Link Directory Security & Risk Analysis

The plugin 'simple-link-directory' v8.8.7 exhibits a mixed security posture. While it demonstrates good practices such as a high percentage of SQL prepared statements and properly escaped output, there are significant concerns that temper its overall safety.

The static analysis reveals an attack surface of 14 entry points, with one AJAX handler notably lacking authentication checks. This unsupervised entry point is a direct pathway for potential exploitation. Furthermore, the taint analysis identified one high-severity flow with unsanitized paths, suggesting a potential for code injection or similar vulnerabilities that could compromise the application.

The plugin's vulnerability history is a major red flag. With 6 known CVEs, including one critical and one high severity, even though none are currently unpatched, the pattern of past vulnerabilities points to recurring security weaknesses. The types of past vulnerabilities (CSRF, Missing Authorization, Code Injection, SQL Injection, XSS, Deserialization) indicate a history of mishandling user input and authorization. While the plugin has a recent vulnerability date of 2025-12-15, this could indicate ongoing research or that the data is from a future perspective. The overall picture is one of a plugin that has had significant security issues in the past, and while current analysis shows some improvements, the history warrants caution. The presence of the unauthenticated AJAX handler and the high-severity taint flow are immediate risks that need addressing.