wpCAS Security & Risk Analysis

The wpcas plugin v1.07 exhibits a mixed security posture. While the static analysis shows no direct attack surface (AJAX handlers, REST API routes, shortcodes, cron events) and all SQL queries utilize prepared statements, significant concerns arise from the output escaping and vulnerability history. The low percentage of properly escaped output (18%) indicates a strong potential for Cross-Site Scripting (XSS) vulnerabilities, even if not directly flagged by the taint analysis. The presence of a known medium severity Cross-Site Scripting (XSS) vulnerability, which remains unpatched and was discovered in 2026, is a critical indicator of ongoing risk. The fact that this is the only known CVE also suggests a potential for undiscovered vulnerabilities. The absence of nonce and capability checks across the board, coupled with a low output escaping rate, amplifies the risk associated with any potential input vectors that might exist but were not identified by the static analysis.