Add User Autocomplete Security & Risk Analysis

The 'add-user-autocomplete' plugin, version 1.1, presents a notable security concern due to its unprotected AJAX handler. While the plugin exhibits strengths such as the absence of known CVEs and a clean history of vulnerabilities, the static analysis reveals significant weaknesses. The single entry point, an AJAX handler, lacks any authentication or authorization checks, making it directly accessible to any user, including unauthenticated ones. This creates a substantial attack surface for this specific function. Furthermore, the analysis indicates that all output is unescaped, raising concerns about potential cross-site scripting (XSS) vulnerabilities if user-supplied data is reflected back to the browser. Although taint analysis did not flag critical or high-severity unsanitized paths, the combination of an unprotected endpoint and unescaped output creates a risky scenario.