WP Booking Security & Risk Analysis

The "wp-easy-booking" v2.4.6 plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices by exclusively using prepared statements for all its SQL queries and having no file operations or external HTTP requests, which are significant security strengths. It also includes some nonce and capability checks. However, there are notable concerns. The static analysis reveals that a significant portion (51%) of output is not properly escaped, posing a risk of Cross-Site Scripting (XSS) vulnerabilities. Furthermore, the taint analysis indicates 4 high-severity flows with unsanitized paths, which could be exploited to compromise the system if these paths are reachable by untrusted input. The plugin has a history of known vulnerabilities, including a medium-severity XSS vulnerability discovered very recently, suggesting a pattern of input sanitization issues that require ongoing vigilance. While the current version has no unpatched CVEs, the recent history and the findings in the taint analysis point to potential risks that need to be addressed by users.