WpStream – Live Streaming, Video on Demand, Pay Per View Security & Risk Analysis

The "wpstream" plugin version 4.11.2 exhibits a mixed security posture. While it demonstrates strengths in using prepared statements for all SQL queries and a high percentage of properly escaped output, there are notable areas of concern. The static analysis reveals a substantial attack surface, with 60 AJAX handlers, 23 of which lack authentication checks. This, combined with 7 flows with unsanitized paths identified by taint analysis, presents a significant risk of unauthorized access and potential code execution, especially since one of these flows is rated as high severity. The plugin's vulnerability history shows 4 past medium-severity CVEs, primarily related to Missing Authorization and CSRF. Although there are no currently unpatched vulnerabilities, this pattern suggests a recurring tendency for authorization and input validation weaknesses. The presence of unprotected AJAX endpoints and high-severity taint flows are the most critical findings and outweigh the positive aspects of the code analysis.