Breeze Display Security & Risk Analysis

The "wt-display-breeze" plugin v1.2.4 presents a mixed security profile. On the positive side, it demonstrates good practices by utilizing prepared statements for all SQL queries and has no known unpatched vulnerabilities, indicating a generally well-maintained codebase regarding past issues. The static analysis also shows no direct dangerous functions, file operations, or external HTTP requests, which are common attack vectors.

However, several concerning areas were identified in the static analysis. The plugin exhibits a concerningly low percentage (25%) of properly escaped output, suggesting a high likelihood of Cross-Site Scripting (XSS) vulnerabilities. The taint analysis revealed "flows with unsanitized paths," indicating potential for sensitive data to be exposed or manipulated without proper sanitization, although no critical or high severity issues were flagged in this specific analysis. The absence of nonce checks and capability checks across its entry points (shortcodes) is a significant weakness, allowing unauthenticated or low-privileged users to potentially trigger unintended actions or access restricted data through these shortcodes.

The vulnerability history shows a past medium severity vulnerability related to XSS, reinforcing the concern raised by the low output escaping. While there are no currently unpatched vulnerabilities, the pattern of past XSS issues coupled with the current lack of output escaping and authorization checks on shortcodes suggests an ongoing risk of similar vulnerabilities if not addressed. The plugin's strengths lie in its SQL handling and lack of unpatched CVEs, but its weaknesses in output sanitization and authorization for shortcodes pose a tangible risk to WordPress installations.