Total WP Reviews Security & Risk Analysis

The "total-wp-reviews" v1.0.2 plugin presents a mixed security posture. While it has no recorded vulnerabilities or CVEs, indicating a potentially stable codebase over time, the static analysis reveals several significant security concerns. The presence of two unprotected AJAX handlers significantly increases the attack surface, as these can be exploited by unauthenticated users. Furthermore, the taint analysis highlights three flows with unsanitized paths, all classified as high severity. This suggests a strong possibility of critical vulnerabilities like SQL injection or cross-site scripting (XSS) if user-supplied data is not properly validated and sanitized before use, particularly within these unprotected entry points.

The plugin demonstrates some good practices, such as the use of prepared statements for a majority of its SQL queries and the inclusion of nonce and capability checks for some functions. However, the alarmingly low percentage of properly escaped output (4%) is a major red flag, making it highly susceptible to XSS attacks. The use of the `create_function` (deprecated and insecure) is also a concern. Overall, despite the lack of historical CVEs, the current static analysis indicates a plugin that requires immediate attention due to high-severity taint flows and a substantial unprotected attack surface, especially concerning the AJAX handlers and output escaping.