WP Review Slider Security & Risk Analysis

The "wp-facebook-reviews" plugin v14.0 presents a moderate security risk primarily due to a significant number of unprotected AJAX endpoints. While the static analysis shows no critical or high severity taint flows and a decent percentage of SQL queries using prepared statements, the high count of unprotected entry points (6 out of 7) is a major concern. This indicates that attackers could potentially trigger functionality within the plugin without proper authentication, opening the door to various exploits.

The plugin's vulnerability history, with 4 known CVEs including high and medium severity issues like Cross-Site Scripting and SQL Injection, further reinforces the need for caution. Although there are currently no unpatched vulnerabilities, the recurring nature of these vulnerability types suggests potential weaknesses in input sanitization and output escaping within the plugin's codebase that have been exploited in the past.

Overall, the plugin demonstrates some good practices such as the use of nonces and capability checks, and a lack of dangerous functions. However, the substantial attack surface without adequate authorization controls, combined with its past vulnerability record, necessitates vigilance. Users should ensure they are on the latest patch levels and be aware of the potential for new vulnerabilities to emerge if these fundamental security gaps are not addressed.