Slider by Soliloquy – Responsive Image Slider for WordPress Security & Risk Analysis

The Soliloquy Lite plugin v2.8.1 presents a mixed security posture. On the positive side, it demonstrates good practices regarding SQL queries, exclusively using prepared statements, and a high percentage of properly escaped output, minimizing risks of SQL injection and reflected/stored cross-site scripting. The presence of numerous nonce and capability checks also indicates an effort to protect against unauthorized actions. However, the plugin has a significant number of unprotected entry points, specifically 5 AJAX handlers that lack authentication checks. This creates a substantial attack surface that could be exploited by unauthenticated users.

The vulnerability history reveals a pattern of medium-severity issues, including Cross-site Scripting and Missing Authorization. While there are currently no unpatched CVEs, the existence of past vulnerabilities in these categories, particularly Missing Authorization, directly aligns with the static analysis findings of unprotected AJAX handlers. The recent last vulnerability date suggests ongoing security attention but also highlights the persistent nature of certain risk types.

Overall, Soliloquy Lite v2.8.1 has strengths in its data handling and output sanitization. However, the critical deficiency in securing a portion of its AJAX endpoints poses a notable risk. Users should be aware of this potential for unauthorized access and manipulation through these unprotected handlers, especially given the plugin's history of authorization-related vulnerabilities.