WP Family Tree Security & Risk Analysis

The wp-family-tree plugin version 1.0.6 exhibits a mixed security posture. On the positive side, the plugin has no known vulnerabilities (CVEs) and a very small attack surface with no unprotected entry points identified in the static analysis. There are no external HTTP requests or file operations, which reduces potential attack vectors.

However, there are significant concerns within the code analysis. Notably, 100% of SQL queries are not using prepared statements, indicating a high risk of SQL injection vulnerabilities. Furthermore, a substantial number of output operations (23 total) are not properly escaped, which could lead to Cross-Site Scripting (XSS) issues. The absence of capability checks on its entry points is also a concern, as it means any authenticated user could potentially trigger these functions without proper authorization.

Given the lack of historical vulnerabilities, it's difficult to infer long-term development practices. However, the current static analysis reveals critical weaknesses in secure coding practices concerning SQL queries and output sanitization, which significantly outweigh the benefits of a small attack surface and no known CVEs. The plugin's security would be greatly improved by addressing the unescaped output and raw SQL queries.