YOP Poll Security & Risk Analysis

The yop-poll plugin v6.5.40 exhibits a mixed security posture. While it demonstrates good practices in many areas, including a high percentage of properly escaped output and SQL queries using prepared statements, several concerning aspects are evident. The static analysis reveals a significant attack surface with 10 unprotected AJAX handlers, which could be exploited to bypass authorization checks. Furthermore, the presence of 2 critical severity taint flows with unsanitized paths indicates potential for severe vulnerabilities if these flows are reachable by attackers. The plugin's vulnerability history is also a notable concern, with 14 known CVEs, including one high severity vulnerability. While there are currently no unpatched vulnerabilities, the recurring pattern of vulnerabilities like missing authorization and cross-site scripting suggests a need for more robust security development lifecycle practices. The plugin's strengths lie in its efforts towards secure coding, but the identified unprotected entry points and taint analysis findings necessitate careful attention.