WPSyncSheets For WPForms – Google Sheets Connector for WPForms & Real‑Time Data Export Security & Risk Analysis

The "wpsyncsheets-wpforms" v1.7.0 plugin exhibits a generally good security posture with several strengths, including the absence of exposed REST API routes and shortcodes, and a complete absence of dangerous functions. All identified SQL queries utilize prepared statements, and a solid number of nonce and capability checks (7 each) are present, indicating a conscious effort to secure entry points. The plugin also has limited external interactions, with only one HTTP request.

However, concerns arise from the static analysis results. While there are no explicitly unprotected AJAX handlers or REST API routes, the presence of two "flows with unsanitized paths" in the taint analysis is a significant red flag, despite being classified as low severity. This suggests potential weaknesses in how file paths are handled, which could be exploited under specific circumstances. The output escaping rate of 69% is also a concern, implying that a substantial portion of user-facing output may not be adequately sanitized, potentially leading to cross-site scripting (XSS) vulnerabilities.

The vulnerability history shows one medium severity CVE, which has since been patched. While the lack of currently unpatched vulnerabilities is positive, the historical presence of a medium severity issue, coupled with the taint analysis and output escaping concerns, suggests that the plugin may not be as robust as its initial entry point analysis implies. Continued vigilance and addressing the identified taint flows and output sanitization are recommended.