Theme Switcha – Easily Switch Themes for Development and Testing Security & Risk Analysis

The plugin "theme-switcha" v3.4.3 exhibits a mixed security posture. On the positive side, it demonstrates good practices by consistently using prepared statements for SQL queries and implementing nonce and capability checks for many entry points. The absence of file operations and external HTTP requests further reduces potential attack vectors. However, a significant concern arises from the taint analysis, which identified two flows with unsanitized paths. While these did not result in critical or high severity vulnerabilities in the static analysis, they represent potential weaknesses that could be exploited if input handling is not robust. The vulnerability history reveals two known medium-severity CVEs, both related to Cross-site Scripting (XSS). The fact that these are currently patched is a positive sign, but the recurring XSS nature of past vulnerabilities suggests a need for stricter input validation and output escaping, especially given that only 53% of outputs are properly escaped. The plugin has a small attack surface with only four shortcodes as entry points, and none of these are reported as unprotected.