WP Contact Slider – Contact Form Slider Widget Security & Risk Analysis

The wp-contact-slider plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices in its handling of SQL queries, exclusively using prepared statements, and boasts a high percentage of properly escaped output. The plugin also incorporates nonce and capability checks, suggesting an awareness of common WordPress security mechanisms. However, the presence of two AJAX handlers without authentication checks presents a significant concern, creating a direct attack surface that could be exploited by unauthenticated users. The vulnerability history reveals two medium-severity CVEs, both related to Cross-site Scripting, with the last one occurring in late 2022. While no currently unpatched vulnerabilities are reported, this history indicates a recurring pattern of input validation or output sanitization issues that attackers have successfully exploited in the past. The lack of taint analysis results makes it difficult to assess the sanitization of dynamic paths, but the identified AJAX vulnerabilities are concrete points of concern.