WP Subscribe Security & Risk Analysis

The "wp-subscribe" plugin exhibits a mixed security posture. While it demonstrates good practices in areas like SQL query sanitization and output escaping, significant concerns arise from its attack surface and vulnerability history. The presence of four unprotected AJAX handlers represents a substantial risk, as these can be directly exploited by unauthenticated users to perform unintended actions. The single critical taint flow also highlights a potential for serious vulnerabilities, even if it's not directly tied to a specific CVE in the provided history.

The plugin's vulnerability history, with two known CVEs and one currently unpatched, points to a recurring pattern of security weaknesses. The common vulnerability types listed (Missing Authorization, Cross-site Scripting) align with the concerns identified in the static analysis. The fact that the last vulnerability was dated 2026-01-26 suggests a potential for ongoing or recently discovered issues, making the unpatched CVE particularly alarming. Overall, while strengths exist, the unpatched CVE and the large number of unprotected entry points necessitate immediate attention.