Яндекс.ПДС Пингер / Yandex Site search pinger Security & Risk Analysis

The yandex-pinger plugin v1.5 exhibits a mixed security posture. On the positive side, the static analysis reveals no direct entry points like AJAX handlers, REST API routes, or shortcodes, and no dangerous function usage or raw SQL queries. All SQL queries are properly prepared. However, a significant concern arises from the complete lack of output escaping, meaning any dynamic data displayed by the plugin is vulnerable to cross-site scripting (XSS) attacks. The absence of nonce and capability checks on any potential, albeit currently non-existent, entry points is also a weakness. The vulnerability history shows a known medium-severity XSS vulnerability that is currently unpatched. This historical pattern, combined with the current lack of output escaping, strongly suggests that XSS is a persistent risk for this plugin. While the attack surface appears minimal from the static analysis, the unpatched vulnerability and lack of output sanitization present real threats.