Ultimate Push Notifications Security & Risk Analysis

The ultimate-push-notifications plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices with a total of 11 capability checks and 2 nonce checks, and a majority of SQL queries (79%) utilize prepared statements, reducing the risk of SQL injection. The attack surface is relatively small with only 2 AJAX handlers and no REST API routes or shortcodes, and crucially, no unprotected entry points were identified in the static analysis.

However, significant concerns arise from the code signals and vulnerability history. Only 20% of output escaping is properly implemented, indicating a high risk of Cross-Site Scripting (XSS) vulnerabilities. The taint analysis revealed 8 flows with unsanitized paths, even though no critical or high severity issues were flagged, this still represents a substantial risk of unexpected behavior or data compromise. The plugin's vulnerability history is particularly alarming, with 3 unpatched medium severity CVEs, common types including Missing Authorization, XSS, and SQL Injection. The most recent vulnerability was dated July 7, 2025, suggesting a pattern of security flaws and a lack of timely patching.

In conclusion, while the plugin has some strengths in its controlled attack surface and use of prepared statements for SQL, the high percentage of unsanitized paths and poor output escaping, coupled with a history of unpatched medium-severity vulnerabilities, present a considerable risk. The presence of 3 unpatched CVEs, even at medium severity, is a critical indicator of ongoing security weaknesses that require immediate attention.