WP Simple HTML Sitemap Security & Risk Analysis

The 'wp-simple-html-sitemap' plugin version 3.8 exhibits a mixed security posture. On the positive side, the static analysis reveals strong adherence to WordPress security best practices, with all identified entry points (AJAX handlers and shortcodes) incorporating nonce and capability checks. Furthermore, a high percentage of SQL queries utilize prepared statements, and output escaping is robust. There are no reported file operations or external HTTP requests, and the plugin does not bundle any external libraries, reducing potential attack vectors from outdated dependencies.

However, the taint analysis raises significant concerns. Two flows were identified with unsanitized paths, and both are classified as high severity. This suggests potential vulnerabilities where user-supplied input could be used to manipulate file paths or other sensitive operations, even with the otherwise strong sanitization and authorization checks in place. The plugin's vulnerability history is also a notable red flag. With a total of six known CVEs, including one critical and five medium-severity vulnerabilities, it indicates a pattern of security weaknesses being introduced and discovered. The fact that there are currently no unpatched CVEs is positive, but the recurring nature of vulnerabilities and the types of past issues (Missing Authorization, SQL Injection, XSS) point to underlying coding practices that may still introduce risks. The most recent vulnerability was dated April 1st, 2025, which is in the future, suggesting either a hypothetical scenario or a data anomaly; if this reflects a real-world recent vulnerability, it's a serious concern.

In conclusion, while version 3.8 shows improvements in implementing security checks and sanitization, the high-severity taint flows and the plugin's history of numerous vulnerabilities, particularly SQL Injection and XSS, necessitate caution. The presence of unsanitized paths in taint flows is the most immediate code-level concern. Users should monitor for future updates and be aware of the plugin's past security incidents.