YASR – Yet Another Star Rating Plugin for WordPress Security & Risk Analysis

The "yet-another-stars-rating" plugin v3.4.15 presents a mixed security posture. While it demonstrates good practices such as a high percentage of SQL queries using prepared statements and a substantial number of capability checks, there are significant concerns. The plugin has a considerable attack surface with 19 AJAX handlers, 13 of which lack authentication checks, creating an immediate risk for unauthorized actions. Additionally, taint analysis reveals two high-severity flows with unsanitized paths, indicating potential for code injection or other exploits. The plugin's vulnerability history is also a major red flag, with a total of 6 known CVEs, including a past critical vulnerability. The variety of common vulnerability types such as missing authorization, XSS, deserialization, and SQL injection further suggests recurring security weaknesses. While the absence of currently unpatched vulnerabilities and a recent vulnerability in late 2023 is somewhat positive, the historical pattern and the identified code-level risks warrant a cautious approach.