Starbox – the Author Box for Humans Security & Risk Analysis

The static analysis of starbox v3.5.4 indicates a generally good security posture with no identified critical vulnerabilities in the code itself. The absence of any AJAX handlers, REST API routes, shortcodes, or cron events without authentication checks is a significant strength, minimizing the plugin's attack surface. The code also demonstrates good practices by using prepared statements for all SQL queries and incorporating both nonce and capability checks. However, a notable concern arises from the output escaping, where 44% of outputs are not properly escaped. This could lead to Cross-Site Scripting (XSS) vulnerabilities if user-supplied data is not sanitized before being displayed to the user. The plugin's vulnerability history reveals a significant number of past medium-severity CVEs, primarily related to XSS and improper access control. While there are currently no unpatched vulnerabilities, this history suggests a recurring pattern of issues that require careful monitoring and prompt patching. The most recent vulnerability was reported in September 2024, indicating ongoing security challenges.