WP Logo Changer Security & Risk Analysis

The "am-login-logo" plugin version 1.2 exhibits a mixed security posture. On the positive side, it demonstrates good practices by utilizing prepared statements for all SQL queries and having a minimal attack surface with no identified AJAX handlers, REST API routes, shortcodes, or cron events that are directly exposed. File operations and external HTTP requests are also absent, reducing potential attack vectors.

However, several significant concerns are present. The use of the dangerous `create_function` PHP construct is a red flag, as it can be a source of vulnerabilities if not handled with extreme care. Furthermore, a concerningly low 37% of output is properly escaped, indicating a high likelihood of Cross-Site Scripting (XSS) vulnerabilities, which is corroborated by the plugin's vulnerability history.

The plugin has a history of known vulnerabilities, including a currently unpatched High severity CVE related to XSS. This pattern suggests a recurring issue with input sanitization and output escaping, despite the generally low attack surface. The recent unpatched vulnerability points to a lack of timely security updates or a persistent flaw in the code's security implementation. While the plugin has strengths in its limited entry points and SQL handling, the prevalence of unescaped output and the dangerous use of `create_function`, coupled with an unpatched high-severity vulnerability, present a considerable risk.