StockPack – Stock photos from Unsplash, Adobe Stock and more Security & Risk Analysis

The stockpack v3.5.0 plugin demonstrates a generally good security posture with several positive indicators. It has a complete absence of known CVEs and no historical vulnerabilities, which suggests a history of responsible development and maintenance. The plugin also utilizes prepared statements for all SQL queries and implements nonce checks on all identified AJAX handlers. Furthermore, the taint analysis shows no critical or high-severity flows with unsanitized paths, and there are no dangerous functions or file operations detected.

However, there are areas for improvement. A significant concern is the output escaping, where only 54% of outputs are properly escaped. This indicates a potential risk of cross-site scripting (XSS) vulnerabilities if user-supplied data is reflected in these unescaped outputs. Additionally, the plugin makes two external HTTP requests, which could be a vector for various attacks if the target endpoints are compromised or if the requests are not properly validated and sanitized. While the attack surface is entirely protected by authentication, the presence of unescaped outputs and external HTTP requests warrants attention.