Themify Icons Security & Risk Analysis

The Themify Icons plugin v2.0.4 exhibits a mixed security posture. The static analysis indicates several positive security practices, including the absence of dangerous functions, 100% of SQL queries utilizing prepared statements, and a commendable three capability checks in place. The limited attack surface, with all identified entry points having some form of authorization, is also a positive indicator. However, there are notable concerns. A significant portion of output (54%) is not properly escaped, creating a potential for Cross-Site Scripting (XSS) vulnerabilities. The absence of nonce checks on AJAX handlers is a critical oversight, leaving these endpoints vulnerable to CSRF attacks.

The vulnerability history reveals a past of two medium-severity CVEs, both related to Cross-Site Scripting. While there are currently no unpatched vulnerabilities, the recurring nature of XSS issues suggests a potential weakness in the plugin's sanitization or output encoding practices. The last vulnerability being in 2025 is concerning as it implies the data might be from a future scan or there are unpatched vulnerabilities that haven't been publicly disclosed yet. Overall, while the plugin has strengths in its database interactions and some access control, the prevalent output escaping issues and the lack of nonce protection on AJAX handlers present significant security risks that require immediate attention.