SVG Support Security & Risk Analysis

The svg-support v2.5.14 plugin exhibits a generally positive security posture with some notable exceptions. The static analysis reveals a small attack surface of only 2 AJAX handlers, both of which are protected by authentication checks, indicating good practice in limiting unauthorized access. The overwhelming majority of output is properly escaped, and nonce and capability checks are present on all identified entry points. File operations and external HTTP requests are also managed, suggesting careful handling of potentially sensitive actions. However, the plugin's history is a significant concern. It has a substantial number of known CVEs, all of which are medium severity and related to Cross-Site Scripting (XSS). While there are currently no unpatched vulnerabilities, the sheer volume of past XSS issues, including a recent one in 2025, suggests a recurring pattern of input sanitization weaknesses that the developers have struggled to fully resolve. Furthermore, the presence of SQL queries not utilizing prepared statements is a potential risk, although the low number of queries and the absence of taint flows are mitigating factors. The lack of any identified taint flows is a positive sign, implying that critical vulnerabilities are not being introduced in current development, but the historical pattern of XSS warrants caution.