Hubbub Lite – Fast, free social sharing and follow buttons Security & Risk Analysis

The social-pug plugin, version 1.36.3, presents a mixed security posture. While it demonstrates good practices in certain areas, such as using prepared statements for all SQL queries and a significant number of nonce and capability checks, several concerning aspects warrant attention. The presence of 4 unprotected AJAX handlers significantly widens the attack surface, potentially allowing unauthorized users to trigger plugin functionalities. Furthermore, the use of the `unserialize` function twice raises concerns about deserialization vulnerabilities, especially if external input is being unserialized without proper validation. The plugin's vulnerability history is a notable weakness, with a history of 9 CVEs, including 1 high-severity vulnerability and 8 medium-severity ones. The common types of past vulnerabilities, such as Exposure of Sensitive Information, Deserialization of Untrusted Data, Cross-site Scripting, and Missing Authorization, directly correlate with the static analysis findings of unprotected AJAX handlers and the use of `unserialize`. While there are currently no unpatched CVEs and the last reported vulnerability was in the future (2025-11-05, likely a typo and should be in the past), the recurring pattern of these vulnerability types suggests a persistent need for more robust security controls. The 67% proper output escaping is also a moderate concern, leaving room for potential XSS vulnerabilities, although no critical or high taint flows were detected.