What the CF7 – Which Contact Form Used In Page/Post Security & Risk Analysis

The plugin "what-the-cf7-which-contact-form-used-in-pagepost" v1.0.0 exhibits a generally positive security posture based on the provided static analysis. The absence of identified dangerous functions, raw SQL queries, file operations, external HTTP requests, nonce checks, capability checks, and bundled libraries is commendable. Furthermore, the complete lack of known CVEs and any historical vulnerability data suggests a well-maintained or very niche plugin.

However, a significant concern arises from the output escaping analysis. With one total output and 0% properly escaped, this indicates a high likelihood of Cross-Site Scripting (XSS) vulnerabilities. Any user-supplied data that is displayed back to users without proper sanitization can be exploited by attackers to inject malicious scripts, leading to session hijacking, defacement, or redirection to malicious sites. The plugin also has zero attack surface entry points identified, which is unusual and might suggest the analysis might not have fully captured all potential interaction points or that the plugin's functionality is extremely limited.