CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout Security & Risk Analysis

The 'support-x' plugin version 1.1.8 exhibits a mixed security posture. While it demonstrates good practices like using prepared statements for all SQL queries and having no currently unpatched CVEs, significant concerns arise from its attack surface and output escaping. The presence of three AJAX handlers without authentication checks presents a direct entry point for potential attackers to exploit. Furthermore, the low percentage of properly escaped output (14%) indicates a high risk of Cross-Site Scripting (XSS) vulnerabilities, which is corroborated by its vulnerability history containing three medium severity XSS issues. Although the taint analysis shows no critical or high severity unsanitized flows, the combination of unprotected entry points and poor output sanitization warrants caution. The plugin's history of XSS vulnerabilities and the static analysis findings suggest a recurring weakness in input validation and output sanitization, which attackers could potentially leverage, especially given the unprotected AJAX endpoints. Therefore, while some secure coding practices are in place, the identified weaknesses, particularly the unprotected AJAX handlers and widespread unescaped output, significantly elevate the risk.