Tab Ultimate Security & Risk Analysis

The "tabs-pro" v2.0.0 plugin exhibits a mixed security posture. While it demonstrates good practices such as using prepared statements for all SQL queries and implementing nonce and capability checks on its entry points, concerns arise from the static analysis.

Specifically, the taint analysis revealed one flow with unsanitized paths, classified as high severity. This indicates a potential vulnerability where user-supplied input could be used in a dangerous way, potentially leading to exploits like Cross-Site Scripting (XSS) if the output is not properly handled. Although the code signals report a high percentage of properly escaped outputs (79%), this single unsanitized flow is a significant risk. The plugin also bundles an outdated version of Select2 (v3.4.5), which could harbor known vulnerabilities.

The vulnerability history shows two past medium-severity CVEs, both related to Cross-Site Scripting. The fact that the last vulnerability was in 2025 (likely a typo and intended to be in the past) and that there are no currently unpatched CVEs is positive. However, the recurring nature of XSS vulnerabilities in its history, combined with the identified unsanitized taint flow, suggests a consistent weakness in input validation and sanitization that needs careful attention. Overall, while the plugin has some strengths in its core security implementations, the identified high-severity taint flow and the bundled outdated library present immediate risks that should be addressed.