VoucherPress Security & Risk Analysis

The VoucherPress plugin version 1.5.7 exhibits a mixed security posture. While it has a relatively small attack surface with no identified unprotected entry points and a decent number of nonce checks, several concerning patterns emerge from the code analysis. A significant concern is the low percentage of properly escaped output (19%), coupled with a substantial number of taint flows with unsanitized paths (6 out of 9 analyzed), indicating a high risk of Cross-Site Scripting (XSS) vulnerabilities despite no critical or high severity taint flows being reported. The plugin also utilizes a bundled, outdated library, TCPDF v5.9.028, which could harbor known vulnerabilities. The vulnerability history further exacerbates these concerns, with a single known medium severity CVE that remains unpatched. This indicates a recurring pattern of input handling issues and a lack of timely patching, suggesting that users of this plugin should exercise caution.