WP Plugin Info Card Security & Risk Analysis

The wp-plugin-info-card v6.3.0 plugin exhibits a mixed security posture. While it demonstrates good practices in output escaping and nonce checks, with a low number of dangerous functions and no critical taint flows, there are notable areas of concern. The significant attack surface, with 10 unprotected entry points across AJAX handlers and REST API routes, presents a considerable risk. Furthermore, the vulnerability history reveals a pattern of medium severity issues, specifically Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS), indicating a recurring tendency for input validation and access control weaknesses. Although there are no currently unpatched vulnerabilities, the historical prevalence of these specific types of issues suggests a need for ongoing vigilance and more robust security measures. The presence of external HTTP requests also warrants attention, as they can be vectors for further exploitation if not handled securely.

While the plugin scores well on several security metrics, such as a high percentage of properly escaped outputs and the absence of dangerous functions, the unprotected entry points are a significant concern. The 10 unprotected AJAX handlers and REST API routes, combined with the historical medium severity vulnerabilities in CSRF and XSS, highlight potential avenues for unauthorized actions and information disclosure. The plugin's strengths lie in its generally good output sanitization and the presence of nonce checks. However, the inherent risk associated with an unauthenticated attack surface, coupled with past vulnerability trends, means this plugin should be treated with caution and potentially undergo further manual security review. The relatively low percentage of prepared SQL statements is also a minor concern that could be improved.