WP Immo Security & Risk Analysis

The "wp-immo" v1.1.4 plugin exhibits a mixed security posture. While it has no recorded historical vulnerabilities, indicating a potentially stable development history, the static analysis reveals significant areas of concern. The plugin has a small but concerning attack surface, with 2 AJAX handlers, both of which lack authentication checks. This immediately exposes them to unauthorized execution, a critical weakness. Furthermore, the taint analysis indicates 5 out of 6 flows have unsanitized paths, though none reached critical or high severity. This suggests a potential for input validation issues that could be exploited if they were to lead to more severe consequences. The low percentage of properly escaped output (19%) is also a worrying sign, increasing the risk of cross-site scripting (XSS) vulnerabilities, especially when combined with unsanitized input paths. While the plugin avoids dangerous functions and has no bundled libraries, the lack of robust authentication on AJAX endpoints and the prevalence of unsanitized paths present immediate risks that outweigh the absence of known CVEs.