ArtPlacer Widget Security & Risk Analysis

The 'artplacer-widget' v2.23.2 plugin exhibits a mixed security posture. While the static analysis reveals a relatively small attack surface with no directly unprotected AJAX handlers or REST API routes, and no file operations or external HTTP requests, significant concerns arise from the code signals and vulnerability history. The low percentage of SQL queries using prepared statements (18%) and the similarly low percentage of properly escaped output (5%) are major red flags. These indicate a high likelihood of vulnerabilities like SQL Injection and Cross-Site Scripting, which are corroborated by the plugin's past vulnerability history. The plugin has a concerning history of 5 known CVEs, with one still unpatched, and a majority of these being medium or high severity. Common vulnerability types include XSS, SQL Injection, CSRF, and Missing Authorization, all of which point to fundamental weaknesses in input validation and authorization. The presence of an unpatched high-severity vulnerability, coupled with the code's apparent lack of robust sanitization and escaping, suggests a substantial ongoing risk to WordPress sites using this plugin.