Skysa Scroll-to-Top App Security & Risk Analysis

The skysa-scroll-to-top-app v1.4 plugin exhibits a concerning security posture primarily due to its unprotected entry points and lack of robust input sanitization and output escaping. The static analysis reveals two AJAX handlers with no authentication checks, creating a significant attack surface for unauthorized actions. Furthermore, all SQL queries are executed without prepared statements, increasing the risk of SQL injection vulnerabilities. The taint analysis highlights four flows with unsanitized paths, indicating potential for various injection attacks, although these did not reach critical or high severity in the provided analysis.

The plugin's vulnerability history is clean, with no recorded CVEs. While this is a positive sign, it does not negate the inherent risks identified in the code analysis. The absence of vulnerabilities could be due to a lack of rigorous security auditing of the plugin or the fact that discovered flaws were minor and not publicly disclosed. The overall security of this plugin is weakened by the presence of direct, unauthenticated access points and the insecure handling of data, despite its clean historical record.