WP Tabular – HTML Table Generator for WordPress Security & Risk Analysis

The plugin wp-tabular v1.1.8 presents a mixed security posture. On the positive side, it demonstrates good practices by avoiding dangerous functions, making all SQL queries using prepared statements, and not performing file operations or external HTTP requests. The absence of known vulnerabilities in its history is also a strong indicator of a generally stable codebase. However, significant concerns arise from the static analysis. The plugin exposes one AJAX handler without proper authentication checks, creating a direct attack vector. Furthermore, 50% of its output is not properly escaped, which could lead to cross-site scripting (XSS) vulnerabilities if unsanitized data is displayed. The taint analysis also reveals two flows with unsanitized paths, suggesting potential injection vulnerabilities, although the severity was not classified as critical or high in this report.