WPGlobus Security & Risk Analysis

The static analysis of WPGlobus v3.0.2 reveals a generally robust security posture with strong adherence to secure coding practices. The complete absence of unsanitized taint flows, 100% output escaping, and a high percentage of prepared SQL statements are commendable. Furthermore, the presence of nonce and capability checks indicates a good awareness of common WordPress security vulnerabilities.

However, the plugin's vulnerability history presents a significant concern. With seven previously disclosed CVEs, including one high and six medium severity vulnerabilities, there is a clear pattern of past security weaknesses. Although no vulnerabilities are currently unpatched, the frequency and types of past issues (CSRF and XSS) suggest that the codebase may have underlying complexities that have historically led to exploitable flaws. The presence of an outdated bundled library, Select2 v3.5.2, also warrants attention as it could introduce unpatched vulnerabilities that are outside the scope of WPGlobus's own development.

In conclusion, while WPGlobus v3.0.2 demonstrates good current coding practices in its static analysis, its historical vulnerability record and the inclusion of an outdated bundled library suggest a higher than desirable risk profile. Vigilance in patching and regular security audits would be prudent for users of this plugin.