Anything Order by Terms Security & Risk Analysis

The "anything-order-by-terms" v1.4.0 plugin exhibits a mixed security posture. While static analysis indicates a minimal attack surface with no apparent AJAX handlers, REST API routes, shortcodes, or cron events without authentication or permission checks, and no critical taint analysis findings, there are significant concerns.

The presence of a single SQL query that is not using prepared statements is a notable weakness, potentially exposing the site to SQL injection vulnerabilities. Furthermore, the output escaping is not consistently applied, with 43% of outputs not being properly escaped, creating an XSS risk. The vulnerability history reveals a concerning pattern, with a medium-severity vulnerability reported and still unpatched. The common vulnerability type being "Missing Authorization" is also a red flag, especially given the plugin's limited disclosed entry points.

Overall, while the plugin appears to have a small attack surface and some good practices like nonce and capability checks, the unpatched medium vulnerability, the raw SQL query, and the insufficient output escaping present clear and actionable risks that need to be addressed.