Author Details Security & Risk Analysis

The author-details plugin v1.7 exhibits a mixed security posture. On the positive side, it has a remarkably small attack surface with no apparent AJAX handlers, REST API routes, shortcodes, or cron events, and importantly, no recorded vulnerabilities or CVEs. This suggests a history of reasonably secure development. However, the static analysis reveals significant concerns within the codebase. A substantial portion of SQL queries (78%) are not using prepared statements, posing a risk of SQL injection. Furthermore, only 38% of output escaping is properly handled, indicating a potential for cross-site scripting (XSS) vulnerabilities. The taint analysis highlights three high-severity flows with unsanitized paths, which are critical security flaws that could be exploited if reachable. While the absence of external threats and bundled libraries is good, these internal code quality issues represent the primary risks.