XMPP Statistics Security & Risk Analysis

The "xmpp-statistics" plugin version 1.12 presents a significant security risk primarily due to its extensive unprotected REST API routes. With 26 out of 26 REST API routes lacking permission callbacks, any unauthenticated user can potentially interact with these endpoints, leading to unauthorized data access or manipulation. The lack of nonce checks, capability checks, and dangerously low output escaping (8%) further exacerbates this vulnerability. The plugin also exhibits poor SQL query practices, with 51 queries entirely lacking prepared statements, which opens it up to SQL injection attacks. Despite a clean vulnerability history with no recorded CVEs, this does not negate the inherent risks posed by the code's current state. The plugin's static analysis reveals a large attack surface with a high proportion of unprotected entry points (26 out of 52). While no critical taint flows or dangerous functions were identified, the identified weaknesses represent a substantial security concern. The plugin needs immediate attention to implement proper authentication and authorization for its REST API, as well as address its SQL query and output escaping vulnerabilities.