- Vulnerable to CSRF which allows an attacker to delete “players”: https://advisories.dxw.com/advisories/jw-player-for-flash-html5-video/
- SQL is not escaped, but the only values put into SQL are constants
Reason for the 'Potentially unsafe' result
The plugin contains or is likely to contain a vulnerability which could be exploited by an end user and which would compromise the site’s confidentiality, integrity or availability:
Contains a CSRF vulnerability.