ARCW Popover Addon Security & Risk Analysis

The plugin "arcw-popover-addon" v0.1.4 exhibits several concerning security practices, despite a lack of known historical vulnerabilities. The static analysis reveals a significant attack surface with two AJAX handlers, both of which lack authentication checks. This is a critical oversight, as it potentially allows any unauthenticated user to trigger plugin functionality, which could be exploited if further vulnerabilities exist within those handlers. Furthermore, the analysis indicates that none of the total outputs are properly escaped, presenting a high risk of Cross-Site Scripting (XSS) vulnerabilities. While the plugin uses prepared statements for its SQL queries, mitigating the risk of SQL Injection, and has no recorded vulnerabilities in its history, these strengths are overshadowed by the immediate and severe risks identified in the code analysis.