UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds Security & Risk Analysis

The userfeedback-lite plugin version 1.11.1 exhibits a mixed security posture. While it demonstrates good practices such as a high percentage of prepared statements for SQL queries and properly escaped output, the presence of unprotected entry points in both AJAX handlers and REST API routes is a significant concern. The static analysis reveals 5 unprotected entry points out of a total of 48, which could be exploited by unauthenticated users. The vulnerability history, with 7 known CVEs including high-severity SQL Injection, Cross-site Scripting, and Missing Authorization, further raises red flags. Although there are currently no unpatched CVEs, the recurring nature of these critical vulnerability types suggests a historical pattern of insecure coding practices that require careful attention. Despite the positive aspects of code sanitization and prepared statements, the unprotected entry points and the past vulnerability record necessitate caution.