ACF: Google Font Selector Security & Risk Analysis

The plugin 'acf-google-font-selector-field' v3.0.1 exhibits a mixed security posture. While it demonstrates good practices in its handling of SQL queries by exclusively using prepared statements and avoids dangerous functions and file operations, significant concerns arise from its attack surface and output escaping. The presence of two unprotected AJAX handlers represents a direct gateway for potential malicious input, amplified by the taint analysis revealing two flows with unsanitized paths. The low percentage of properly escaped output further exacerbates this risk, making Cross-Site Scripting (XSS) a likely consequence of exploiting these unprotected entry points.

The plugin's vulnerability history, which includes one unpatched medium severity CVE related to XSS, reinforces these concerns. This indicates a recurring pattern of input validation and output sanitization weaknesses. The fact that this CVE is dated in the future (2025-04-21) might suggest a scheduled patch or a projected vulnerability discovery, but it still highlights a known security flaw that needs to be addressed. Overall, while the database interaction is secure, the lack of proper authentication on AJAX handlers, coupled with insufficient output escaping and past XSS vulnerabilities, creates a considerable risk profile.