Yatra – Travel & Tour Booking Plugin Security & Risk Analysis

The 'yatra' plugin v2.3.3 exhibits a mixed security posture. On the positive side, it has a decent number of entry points (6 AJAX handlers) but crucially, all are protected by authentication checks, which is a strong security practice. The presence of numerous nonce and capability checks further reinforces this good practice. However, the static analysis reveals some concerning code signals, notably the use of the 'unserialize' function, which can be a significant vulnerability vector if not handled with extreme care, especially when dealing with user-supplied input. While taint analysis shows no critical or high severity unsanitized flows, the presence of 5 flows with unsanitized paths, even if classified lower, warrants attention.

The plugin's vulnerability history includes one medium severity CVE related to Cross-site Scripting, which was patched. The fact that there are no currently unpatched vulnerabilities is positive. However, the recurring nature of XSS vulnerabilities in its past suggests that developers need to be particularly vigilant about output escaping and input validation to prevent similar issues from arising in the future. The percentage of properly escaped outputs (78%) is good but not perfect, leaving room for potential XSS if the unescaped outputs are reachable by untrusted input.

In conclusion, 'yatra' v2.3.3 demonstrates good practices in access control and authentication for its entry points. The absence of unpatched CVEs is also reassuring. Nevertheless, the reliance on 'unserialize' without explicit sanitization context in the provided data and the existence of unsanitized paths in taint analysis represent potential risks that require careful review and mitigation. The past XSS vulnerability serves as a reminder of the ongoing need for robust input validation and output escaping.