Category Dropdown by GCS Design Security & Risk Analysis

The "wp-category-dropdown" v1.9 plugin presents a concerning security posture, largely due to a significant number of unprotected entry points. The static analysis reveals 8 out of 9 total entry points, specifically AJAX handlers, lack authentication checks. This creates a wide attack surface that could be exploited by unauthenticated users. While the plugin demonstrates good practices in its use of prepared statements for SQL queries and an absence of file operations or external HTTP requests, the output escaping is poor, with only 27% of outputs properly escaped. This, combined with taint analysis showing flows with unsanitized paths, strongly suggests a high risk of Cross-Site Scripting (XSS) vulnerabilities.

The vulnerability history further exacerbates these concerns. The plugin has two known CVEs, with one currently unpatched, both rated as medium severity and identified as Cross-Site Scripting issues. This pattern indicates a recurring problem with input sanitization and output escaping, reinforcing the risks identified in the static analysis. The recent nature of the last vulnerability (2025-09-22) is also a red flag. In conclusion, while the plugin has some strengths in its SQL handling, the numerous unprotected AJAX endpoints, poor output escaping, and a history of XSS vulnerabilities make it a high-risk plugin that requires immediate attention and patching.