WP Abstracts Security & Risk Analysis

The wp-abstracts-manuscripts-manager plugin exhibits several concerning security weaknesses. While it demonstrates good practices in using prepared statements for SQL queries and a moderate number of nonce checks, the presence of unprotected AJAX handlers and a significant number of unsanitized flows are major red flags. The high percentage of flows with unsanitized paths, particularly the 13 high-severity taint flows, directly indicates a risk of attackers being able to inject malicious input that is not properly handled, potentially leading to code execution or data manipulation.

The plugin's vulnerability history is also a significant concern, with 9 known CVEs, one of which remains unpatched. The prevalence of Remote File Inclusion, CSRF, and XSS vulnerabilities in its past indicates a pattern of insecure input handling and authentication deficiencies. The recent discovery of a high-severity vulnerability in late 2025 suggests that the plugin may not be actively maintained with the latest security patches.

Overall, the plugin has a mixed security posture. The strengths lie in its SQL query practices. However, the significant number of unprotected entry points, particularly AJAX handlers, the high number of unsanitized taint flows, and a history of critical vulnerability types, including an unpatched high-severity issue, suggest a high risk. Caution is advised, and immediate attention should be paid to addressing the unpatched CVE and improving input sanitization and authentication mechanisms for its entry points.