WP Test Email Security & Risk Analysis

The wp-test-email plugin, version 1.1.7, exhibits a mixed security posture. On the positive side, the static analysis reveals a commendable lack of dangerous functions, SQL injection vulnerabilities due to the exclusive use of prepared statements, and no file operations or external HTTP requests. The presence of nonce checks and a low number of total entry points (all reported as protected) are also good indicators. However, the plugin's vulnerability history is a significant concern, with three known CVEs, one of which remains unpatched and is of high severity. The common vulnerability type being Cross-site Scripting (XSS) suggests a recurring pattern of input sanitization issues in previous versions. The last recorded vulnerability being in 2026 is an anomaly and should be treated as a potential data error, but the existence of multiple past vulnerabilities, including an unpatched one, points to a need for ongoing security diligence.