Taskbuilder – Project Management & Task Management Tool With Kanban Board Security & Risk Analysis

The 'taskbuilder' plugin v5.0.5 exhibits a concerning security posture, primarily due to a massive attack surface composed of 153 unprotected AJAX handlers. This represents a significant risk, as any of these entry points could potentially be exploited without proper authorization checks. While the code demonstrates some good practices, such as the high percentage of prepared SQL statements and properly escaped output, the sheer number of unauthenticated AJAX endpoints overshadows these strengths. The taint analysis reveals 14 high-severity flows with unsanitized paths, directly contributing to the plugin's vulnerability history of missing authorization, SQL injection, and XSS. Although there are currently no unpatched CVEs, the historical prevalence of these common vulnerability types strongly suggests a recurring pattern of insecure input handling and authorization flaws. The presence of the `unserialize` function also poses a risk, especially if user-controlled data is passed to it without proper validation.