Sitemap by click5 Security & Risk Analysis

The 'sitemap-by-click5' plugin version 1.0.42 exhibits a concerning security posture, primarily due to a large number of unprotected REST API routes. While the plugin demonstrates good practices in output escaping and the use of prepared statements for SQL queries, the presence of 40 REST API routes without any permission callbacks creates a significant attack surface. The taint analysis reveals two high-severity flows, indicating potential vulnerabilities in how data is processed. Furthermore, the vulnerability history shows a past medium-severity CVE related to missing authorization, which aligns with the current findings of unprotected entry points. Although there are no currently unpatched CVEs and the plugin uses dangerous functions sparingly, the high number of unprotected REST API endpoints and the identified taint flows represent a tangible risk that could be exploited by attackers.