Visitors Online by BestWebSoft Security & Risk Analysis

The 'visitors-online' plugin v1.1.6 presents a moderate security risk. While it demonstrates good practices like high output escaping (97%) and a significant percentage of prepared SQL statements (51%), there are notable areas of concern. The presence of 2 unprotected entry points, specifically AJAX handlers, is a significant vulnerability, as is a critical taint flow indicating unsanitized user input that could lead to severe security issues like Cross-Site Scripting or SQL Injection. The plugin's vulnerability history, with 2 known CVEs including one critical and one medium, further underscores these risks, even though they are currently patched. The historical pattern of XSS and SQLi vulnerabilities suggests a recurring need for robust input validation and output sanitization, which is further validated by the critical taint flow. Overall, the plugin has strengths in its output handling but weaknesses in its input sanitization and authentication for certain entry points.