tarteaucitron.io Security & Risk Analysis

The "tarteaucitronjs" v1.31.0 plugin exhibits a mixed security posture. On the positive side, the static analysis reveals a very small attack surface with no identified AJAX handlers, REST API routes, shortcodes, or cron events, and importantly, all identified SQL queries utilize prepared statements. The presence of nonce and capability checks, though limited, is also a good sign. However, a significant concern arises from the output escaping, with only 19% of outputs being properly escaped. This low rate indicates a high potential for Cross-Site Scripting (XSS) vulnerabilities, which aligns with the plugin's vulnerability history. Furthermore, the taint analysis shows one flow with unsanitized paths, which, while not classified as critical or high, still represents a potential security weakness that could be exploited. The plugin's vulnerability history, with 3 known CVEs including high and medium severity issues related to XSS and CSRF, reinforces the concerns about input sanitization and output escaping. The most recent vulnerability in 2025 suggests a continued pattern of such issues. While the current version has no unpatched vulnerabilities and a contained attack surface, the recurring nature of XSS and CSRF in its history, coupled with poor output escaping, warrants caution.