All Related Posts Security & Risk Analysis

The 'all-related-posts' v1.0.4 plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices by avoiding dangerous functions, file operations, and external HTTP requests. All identified SQL queries are properly prepared, and there is no recorded vulnerability history, suggesting a generally stable and secure codebase over time. However, several significant concerns arise from the static analysis. The plugin has a very low rate of output escaping (3%), indicating a high risk of Cross-Site Scripting (XSS) vulnerabilities. Furthermore, the taint analysis revealed two flows with unsanitized paths, which could potentially lead to security issues if these paths are exposed or manipulated. The complete absence of nonce and capability checks across all entry points is also a critical weakness, leaving any potential functionality exposed to unauthorized actions or data manipulation.