پارسی دیت – Parsi Date Security & Risk Analysis

The wp-parsidate plugin v5.1.8.2 presents a mixed security posture. While it demonstrates good practices by utilizing prepared statements for a majority of its SQL queries and has no known unpatched vulnerabilities, significant concerns arise from its attack surface and output sanitization. The presence of two AJAX handlers, both lacking authentication checks, creates a direct entry point for potential attackers. Furthermore, the taint analysis indicates that all analyzed flows contain unsanitized paths, which, though not currently classified as critical or high severity, represents a latent risk. The plugin's vulnerability history shows two past medium-severity Cross-site Scripting (XSS) vulnerabilities, suggesting a pattern of input sanitization issues. While the absence of critical or high severity issues and the secure handling of SQL are positive, the unprotected AJAX endpoints and the prevalence of unsanitized paths in taint flows warrant careful consideration and highlight areas for improvement.