WPZOOM Forms – Drag & Drop Contact Form Builder for WordPress Security & Risk Analysis

The plugin "wpzoom-forms" v1.3.7 presents a generally positive security posture based on the provided static analysis. A notable strength is the absence of known vulnerabilities (CVEs) and the presence of numerous capability checks and nonces, indicating an effort to secure its entry points. The plugin also demonstrates good practices in output escaping, with a high percentage of outputs being properly escaped.

However, there are a few areas of concern. The presence of a single SQL query without prepared statements is a potential risk, as it could be susceptible to SQL injection if the input is not rigorously sanitized. Furthermore, the taint analysis revealed one flow with an unsanitized path, which, while not classified as critical or high severity in this analysis, represents a potential avenue for unintended data manipulation or access if not properly handled downstream. The plugin's limited attack surface and lack of critical vulnerabilities in its history are encouraging signs.