Author: António Andrade Security & Risk Analysis

The "wp-tag-this" v1.3 plugin exhibits a seemingly strong security posture at first glance, with no reported CVEs and a clean vulnerability history. Static analysis shows no direct attack surface like AJAX handlers, REST API routes, or shortcodes, and no dangerous functions or raw SQL queries. Taint analysis also found no critical or high-severity flows. This suggests the plugin developers have implemented basic security measures like using prepared statements for SQL and including nonce and capability checks in some areas. However, a significant concern arises from the output escaping. With 100% of the 14 detected output points being unescaped, this plugin is highly vulnerable to Cross-Site Scripting (XSS) attacks. Any data displayed by the plugin that originates from user input or external sources could be rendered directly in the browser without sanitization, allowing attackers to inject malicious scripts. While the lack of attack vectors is positive, the unescaped output represents a critical weakness that could be easily exploited if any user-controllable data is rendered by the plugin.