Responsive Vertical Icon Menu Security & Risk Analysis

The wpdevart-vertical-menu plugin version 1.7.0 presents a mixed security posture. On one hand, it exhibits good practices by having no AJAX handlers, REST API routes, shortcodes, or cron events that are directly exposed or unprotected. The absence of file operations and external HTTP requests is also a positive sign. However, significant concerns arise from the code analysis. While the plugin utilizes nonces and some SQL prepared statements, the low percentage of properly escaped output (28%) is a major red flag, indicating a high likelihood of Cross-Site Scripting (XSS) vulnerabilities. The taint analysis further supports this, revealing flows with unsanitized paths, including one of high severity, which could lead to data leakage or further exploitation.

The plugin's vulnerability history is particularly worrying. With a total of three known CVEs, all of which were for medium severity and related to XSS and CSRF, it indicates a pattern of insecure input handling. Although there are currently no unpatched vulnerabilities, the historical prevalence of these specific vulnerability types suggests a recurring weakness in how user-supplied data is treated. The last vulnerability was reported in March 2023, meaning the plugin has not been updated to address past security flaws for a significant period, increasing the risk of undiscovered or re-emergent vulnerabilities.

In conclusion, while the plugin benefits from a small attack surface, the identified code-level weaknesses and the historical pattern of medium-severity vulnerabilities, especially concerning input sanitization and output escaping, paint a concerning picture. The high proportion of unescaped output combined with the taint analysis findings points to a significant risk of XSS vulnerabilities. Users should be cautious and prioritize updating to a version that addresses these underlying code issues.