Widget Logic Visual Security & Risk Analysis

The plugin 'widget-logic-visual' v1.52 presents a significant security risk due to its extensive unprotected attack surface and a history of vulnerabilities. While the plugin utilizes prepared statements for SQL queries, this is overshadowed by the fact that none of its 10 AJAX handlers have authentication checks. This creates a wide entry point for attackers to potentially exploit other weaknesses within the plugin.

The static analysis reveals a concerning lack of proper output escaping, with 0% of 60 outputs being escaped. This, coupled with the 11 unsanitized path taint flows, strongly suggests a high probability of Cross-Site Scripting (XSS) vulnerabilities. The vulnerability history confirms this, indicating a past medium-severity XSS vulnerability that is currently unpatched and was recently discovered, raising concerns about the plugin's ongoing maintenance and security practices.

In conclusion, despite the use of prepared statements for SQL, the plugin's security posture is weak. The combination of unprotected AJAX endpoints, widespread unescaped output, unsanitized taint flows, and an unpatched historical vulnerability makes this plugin a considerable risk. Users should exercise extreme caution and consider disabling or replacing it until these critical issues are addressed.