WP Scanner – Performance and Security Security & Risk Analysis

The wp-scanner v1.0.2 plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices by using prepared statements for all its SQL queries and has no recorded vulnerability history, indicating a potentially well-maintained codebase. It also correctly implements nonce and capability checks for one of its entry points. However, there are significant concerns stemming from the static analysis. The plugin exposes one AJAX handler without any authentication or permission checks. This creates a direct pathway for unauthenticated attackers to interact with the plugin's functionality, potentially leading to unexpected behavior or exploitation if the handler performs sensitive operations. Furthermore, a concerning 100% of its output is not properly escaped. This makes it highly susceptible to Cross-Site Scripting (XSS) vulnerabilities, where attackers could inject malicious scripts through these unescaped outputs, impacting users of the WordPress site.