Slider a SlidersPack – Image Slider, Post Slider, ACF Gallery Slider Security & Risk Analysis

The static analysis of sliderspack-all-in-one-image-sliders v2.5 reveals generally good security practices. The plugin has a small attack surface with all entry points protected by authorization checks, and it utilizes prepared statements for SQL queries and a high percentage of properly escaped output. The absence of dangerous functions, file operations, and external HTTP requests further strengthens its security posture. Taint analysis also shows no critical or high severity flows, indicating a lack of immediate code-level vulnerabilities related to data sanitization and injection.

However, the plugin's vulnerability history presents a significant concern. It has a total of two known CVEs, with one high and one medium severity vulnerability in its past. While there are currently no unpatched vulnerabilities, the presence of historical issues, particularly 'Improper Control of Filename for Include/Require Statement' and 'Missing Authorization', suggests a recurring pattern of security weaknesses that could resurface. The most recent vulnerability was recorded on 2025-04-04, indicating that the issue of authorization or file inclusion might have been present in more recent versions, even if patched in this specific version.

Overall, while the current version v2.5 demonstrates improved coding standards and a secure entry point, the historical vulnerability data points to a need for continued vigilance. The plugin has a tendency to introduce vulnerabilities related to file inclusion and authorization. Users should be aware of this historical pattern and ensure they are always running the latest patched version, as past issues may indicate underlying architectural weaknesses that could be exploited if not fully addressed.