ACF Onyx Poll Security & Risk Analysis

The acf-onyx-poll v1.2.0 plugin exhibits a generally positive security posture due to its use of prepared statements for all SQL queries and the absence of dangerous functions or file operations. However, a significant concern arises from the low rate of proper output escaping (45%), indicating a substantial risk of Cross-Site Scripting (XSS) vulnerabilities. This is further corroborated by its vulnerability history, which includes a past medium-severity XSS vulnerability. The plugin has no unpatched CVEs currently, which is a strength, but the consistent pattern of XSS suggests an ongoing weakness in how user-provided data is handled before being displayed to users. While the attack surface is small and protected, the lack of comprehensive output escaping is a critical oversight that could be exploited.