Follow Us Badges Security & Risk Analysis

The plugin "wpsite-follow-us-badges" v3.1.11 presents a mixed security posture. While the static analysis shows a generally good level of output escaping and no critical taint flows, there are notable areas of concern. The lack of capability checks on any entry points is a significant weakness, meaning that potentially sensitive actions could be accessed by any user. Furthermore, all SQL queries are executed without prepared statements, which introduces a risk of SQL injection, even if not immediately apparent in the taint analysis for this specific version.

The vulnerability history reveals a pattern of medium-severity Cross-Site Scripting vulnerabilities, with one CVE remaining unpatched. This ongoing history of XSS issues, coupled with the raw SQL queries and lack of capability checks, suggests a recurring oversight in secure coding practices. While the current version appears to have addressed some previous issues and has a controlled attack surface, the historical context and the identified coding practices warrant caution. The absence of external HTTP requests and file operations is a positive indicator, but it does not mitigate the risks posed by unhandled input and historical vulnerabilities.