Track Everything Security & Risk Analysis

The 'track-everything' plugin version 2.0.1 presents a mixed security posture. On one hand, the static analysis shows a commendable absence of dangerous functions, raw SQL queries, file operations, and external HTTP requests. Furthermore, it boasts a small attack surface with no apparent AJAX handlers, REST API routes, shortcodes, or cron events exposed without proper checks.

However, significant concerns arise from the lack of output escaping, with 0% of outputs being properly sanitized. This is a critical weakness that can lead to Cross-Site Scripting (XSS) vulnerabilities. The taint analysis also reveals "flows with unsanitized paths," indicating potential avenues for malicious data injection, even if no critical or high severity issues were immediately flagged in this specific analysis. The vulnerability history is particularly alarming, with a known medium severity CVE that is currently unpatched. The pattern of past vulnerabilities, specifically CSRF, suggests a history of security oversights that need to be addressed.

In conclusion, while the plugin has strengths in limiting its attack surface and avoiding certain dangerous coding practices, the lack of output escaping and the presence of an unpatched vulnerability are serious risks. The plugin's security is significantly undermined by these weaknesses. Users should exercise extreme caution and prioritize patching the existing vulnerability and addressing the output sanitization issues.