Widgets on Pages Security & Risk Analysis

The "widgets-on-pages" plugin version 1.9.0 exhibits a mixed security posture. On the positive side, it demonstrates good practices by utilizing prepared statements for all SQL queries and implementing nonce and capability checks on its entry points. There are no observed critical or high severity taint flows, nor are there any file operations or external HTTP requests, which generally reduce the risk of complex vulnerabilities. The absence of bundled outdated libraries, apart from Freemius which is a common licensing SDK, is also a positive indicator.

However, significant concerns remain due to the presence of an unprotected AJAX handler. This represents a direct entry point for potential attacks that can be executed without proper authentication, making it a prime target for malicious actors. Furthermore, the low percentage of properly escaped output (20%) suggests a high likelihood of cross-site scripting (XSS) vulnerabilities, which could allow attackers to inject malicious scripts into pages managed by the plugin. The plugin also has a history of medium-severity vulnerabilities, specifically related to XSS, indicating a recurring pattern that warrants attention.

In conclusion, while "widgets-on-pages" demonstrates some commendable security measures, the unprotected AJAX handler and widespread output escaping deficiencies create substantial risks. The plugin's past vulnerability history reinforces the need for careful security auditing and prompt patching. Addressing the unauthenticated AJAX endpoint and improving output escaping are critical steps to enhance the plugin's overall security.