UXsniff AI-powered Heatmaps and Session Recordings Security & Risk Analysis

The 'ux-sniff' plugin v1.3.3 exhibits a mixed security posture. On the positive side, the static analysis reveals a limited attack surface with no identified AJAX handlers, REST API routes, shortcodes, or cron events that are accessible without authentication. Furthermore, all SQL queries are properly prepared, indicating good database interaction practices. However, a significant concern arises from the taint analysis, which shows that all analyzed flows have unsanitized paths, although no critical or high severity issues were flagged. The plugin's vulnerability history is also a major red flag, with one currently unpatched medium severity CVE for Cross-Site Scripting, which last occurred on April 10, 2025. This historical pattern, combined with a low percentage of properly escaped output (15%), suggests a recurring weakness in handling user-provided data, making it susceptible to XSS attacks if the unpatched CVE is exploited or if similar vulnerabilities exist and are not yet publicly known.