WPFront Scroll Top Security & Risk Analysis

The wpfront-scroll-top plugin v3.0.1 exhibits a generally good security posture with a small attack surface and a high percentage of properly escaped outputs. The presence of nonce and capability checks on its single AJAX handler suggests an effort to secure entry points. File operations and external HTTP requests are not a concern in this version. However, the presence of a single SQL query that is not using prepared statements is a minor concern, as it could potentially be vulnerable to SQL injection if the input is not meticulously sanitized before being passed to the query. The vulnerability history reveals one medium severity Cross-Site Scripting (XSS) vulnerability, which was patched as of July 2021. While the current version shows no critical or high severity issues and no unpatched CVEs, the past XSS vulnerability, coupled with the un-prepared SQL statement, indicates a need for continued vigilance in code review and testing to prevent future similar issues. Overall, the plugin appears reasonably secure for its current version, but the minor SQL concern and historical vulnerability warrant attention.