10WebSocial Security & Risk Analysis

The wd-instagram-feed plugin v1.4.35 exhibits a mixed security posture. While a significant majority of SQL queries are prepared (63%) and output escaping is generally well-implemented (97%), there are notable areas of concern. The presence of two AJAX handlers lacking authentication checks represents a direct attack vector. The two known medium severity vulnerabilities, both related to Cross-Site Scripting (XSS), and the fact that the last vulnerability was in late 2021, suggest a history of such issues, even if they are currently patched. The use of 'unserialize' is also a red flag, as it can be dangerous if not handled with extreme care and input validation. While the taint analysis did not reveal critical or high severity issues, the five flows with unsanitized paths warrant attention, as they indicate potential for unintended data manipulation or exposure. Overall, the plugin has some strong security practices in place, but the lack of authentication on certain entry points and the history of XSS vulnerabilities, coupled with the dangerous function usage, present tangible risks that require careful consideration.