WP Custom Author Image Security & Risk Analysis

The author-image plugin v1.0 exhibits a mixed security posture. On the positive side, it has a very small attack surface, with only one shortcode identified as an entry point and no unprotected handlers for AJAX or REST API requests. The absence of known CVEs in its history is also a strong indicator of past security diligence. However, the code analysis reveals significant areas of concern. Notably, 100% of its SQL queries are not using prepared statements, which presents a high risk of SQL injection vulnerabilities. Furthermore, only 44% of output is properly escaped, leaving potential for cross-site scripting (XSS) vulnerabilities. The lack of nonce checks and only one capability check across the plugin's operations suggest that authentication and authorization might not be consistently enforced, especially if the shortcode interacts with sensitive data or functions.