Stockdio Historical Chart Security & Risk Analysis

The "stockdio-historical-chart" v2.8.23 plugin exhibits a mixed security posture. While it demonstrates good practices in its handling of SQL queries by exclusively using prepared statements and possesses a relatively small attack surface, concerns arise from the output escaping and the plugin's vulnerability history.

The static analysis reveals a significant percentage of output (35%) is not properly escaped, indicating a potential risk of Cross-Site Scripting (XSS) vulnerabilities. Although no critical or high severity taint flows were detected in the provided analysis, the lack of proper output escaping creates an environment where such vulnerabilities could be introduced or exploited. Furthermore, the absence of nonce checks on the single shortcode, while not directly flagged as a risk in the static analysis, is a deviation from common WordPress security best practices for shortcodes that interact with user-provided data or perform actions.

The plugin's vulnerability history is a significant concern. Having two known medium severity CVEs, both related to Cross-Site Scripting, points to a recurring pattern of input sanitization and output escaping deficiencies within the plugin. The fact that these vulnerabilities were known and a recent one was recorded in early 2025 suggests ongoing issues or a history of incomplete patching. While there are currently no unpatched CVEs, the historical pattern suggests a higher likelihood of future vulnerabilities if coding practices are not improved.