Trackserver Security & Risk Analysis

The "trackserver" v5.1.1 plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices such as a high percentage of prepared SQL statements and properly escaped output. The plugin also implements a significant number of nonce and capability checks, indicating an awareness of common WordPress security vulnerabilities.

However, there are notable concerns. The presence of one unprotected AJAX handler represents a significant attack vector. The taint analysis reveals four high-severity flows with unsanitized paths, suggesting potential vulnerabilities that could be exploited if these paths are reachable by user input. Furthermore, the plugin has a history of two medium-severity Cross-Site Scripting (XSS) vulnerabilities, with the most recent one being in 2025. While currently unpatched CVEs are zero, this historical pattern of XSS, coupled with unsanitized taint flows, indicates a recurrent risk of input validation and output sanitization issues.

In conclusion, while "trackserver" has strengths in its use of prepared statements and output escaping, the unprotected AJAX handler and high-severity unsanitized taint flows are critical points of concern. The past XSS vulnerabilities, even if addressed in this version, suggest a need for vigilant review of input handling and sanitization throughout the plugin's codebase.