WP Social AutoConnect Security & Risk Analysis

The 'wp-fb-autoconnect' v4.6.4 plugin exhibits a mixed security posture. On one hand, the static analysis reveals a commendable lack of direct attack surface through AJAX, REST API, shortcodes, and cron events. The use of prepared statements for all SQL queries is also a strong positive. However, concerns arise from the low percentage of properly escaped output, indicating a significant risk of Cross-Site Scripting (XSS) vulnerabilities. The presence of several unsanitized paths in the taint analysis, while not classified as critical or high, still points to potential areas where user input might not be handled securely.

The plugin's vulnerability history is a significant red flag. With five known CVEs, including one that is currently unpatched, and a recent vulnerability discovered in June 2025, this plugin has a history of introducing security flaws. The common types of vulnerabilities (XSS and CSRF) align with the concerns raised by the static analysis regarding output escaping and unsanitized paths. The existence of an unpatched vulnerability of medium severity means a known exploit is available and not yet mitigated by the developer, posing an immediate risk to users of this plugin.

In conclusion, while the plugin demonstrates some good security practices like secure SQL handling and a limited direct attack surface, the high number of past vulnerabilities, particularly the unpatched one, and the significant output escaping issues present a considerable security risk. Users should exercise extreme caution and consider alternative plugins until all known vulnerabilities are addressed.