Widgets for Expedia Reviews Security & Risk Analysis

The "widgets-for-expedia-reviews" plugin v13.2.7 exhibits a mixed security posture. On the positive side, it demonstrates strong practices in output escaping, with 100% of outputs properly escaped, and a high adherence to using prepared statements for SQL queries. The absence of known CVEs and a clean vulnerability history are also significant strengths, suggesting a generally well-maintained codebase. However, there are critical concerns regarding the plugin's attack surface. A significant portion of its entry points, specifically all 3 identified, lack proper authentication or permission checks. This includes 1 AJAX handler and 2 REST API routes that do not implement capability checks, making them prime targets for unauthorized access or manipulation if exploited. Additionally, the presence of the `unserialize` function, while not directly tied to a vulnerability in the provided data, introduces a potential risk if user-supplied data is ever passed to it without robust sanitization, which is highlighted by a flow with an unsanitized path in the taint analysis.