Under Construction Security & Risk Analysis

The plugin "under-construction-page" v4.04 exhibits a mixed security posture. On the positive side, the static analysis indicates good practices with all identified AJAX entry points having authorization checks. Furthermore, there are no detected dangerous functions, no raw SQL queries, and a strong emphasis on output escaping, with 73% of outputs being properly handled. The absence of taint analysis findings and the presence of nonce and capability checks are also reassuring signals.

However, the vulnerability history is a significant concern. The plugin has a documented history of 3 medium severity vulnerabilities, including Cross-Site Request Forgery (CSRF) and Cross-site Scripting (XSS). The last vulnerability was recorded on February 10, 2023, and although there are currently no unpatched vulnerabilities, this pattern suggests a recurring tendency for security flaws to emerge. The presence of bundled libraries, specifically Select2, also warrants attention, as outdated versions of bundled libraries can introduce vulnerabilities if not managed properly.

Overall, while the current version shows improvements in secure coding practices like authentication and escaping, the past vulnerability trend necessitates caution. The potential for XSS and CSRF, even if currently addressed, indicates areas that require ongoing vigilance. The plugin's strengths lie in its secure handling of AJAX and SQL, but its weakness is highlighted by its historical susceptibility to common web attack vectors.