xili-tidy-tags Security & Risk Analysis

The xili-tidy-tags plugin exhibits a mixed security posture. On one hand, it demonstrates good practices by utilizing prepared statements for the vast majority of its SQL queries and includes a substantial number of nonce and capability checks, indicating an awareness of common WordPress security mechanisms. The static analysis reveals a relatively small attack surface with no immediately obvious unprotected entry points, and no critical or high-severity issues found in the taint analysis. However, a significant concern arises from its vulnerability history. With four known CVEs, two of which remain unpatched, and a recent vulnerability discovered in September 2025, this plugin has a recurring pattern of security flaws. The common vulnerability types noted (XSS and CSRF) suggest potential issues with input sanitization and state-changing actions. The moderate percentage of improperly escaped output also raises red flags for potential XSS vulnerabilities, even if not immediately identified as critical by the taint analysis.