SmoothGallery Security & Risk Analysis

The smoothgallery plugin, version 1.15.8, presents a mixed security posture. While the attack surface appears limited with no identified unprotected entry points and a lack of known CVEs, significant concerns arise from the static analysis. The presence of dangerous functions like `create_function` and `unserialize` is a red flag, as these can be exploited for code execution if not handled with extreme care. Furthermore, the alarmingly low percentage of properly escaped outputs (2%) strongly suggests a high risk of cross-site scripting (XSS) vulnerabilities, allowing attackers to inject malicious scripts into the website.

Despite the absence of known vulnerabilities in its history, the code itself exhibits several concerning practices. The taint analysis shows flows with unsanitized paths, though no critical or high severity issues were flagged in this specific analysis. The lack of nonce checks and capability checks on potentially sensitive operations, coupled with the high number of file operations, further amplifies the risk. The plugin's reliance on direct SQL queries, with a substantial portion not using prepared statements, also opens it up to SQL injection risks. In conclusion, while the plugin has no recorded public vulnerabilities, the internal code quality and practices present significant potential weaknesses that require immediate attention.